Browse All CVEs
50,446 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-101393 |
medium | 4.3 | 0.0015 | 2026-11-06 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark | |
CVE-2026-97027 |
low | 3.6 | 0.0013 | 2026-11-06 | Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an applic | |
CVE-2026-97026 |
low | 3.9 | 0.0010 | 2026-11-06 | Flatpak creates temporary child repository directories under the user cache with world-wri | |
CVE-2026-97025 |
low | 3.2 | 0.0013 | 2026-11-06 | Flatpak writes the OCI repository authentication token with world-readable permissions (06 | |
CVE-2026-96284 |
low | 2.5 | 0.0012 | 2026-11-06 | A malicious user can get read-access to files in the flatpak-system-helper context if a sy | |
CVE-2026-96283 |
low | 3.3 | 0.0011 | 2026-11-06 | By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pul | |
CVE-2026-96282 |
low | 3.1 | 0.0024 | 2026-11-06 | A malicious Flatpak extension can probe the host filesystem to determine what files and di | |
CVE-2026-96546 |
low | 2.5 | 0.0018 | 2026-11-06 | A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. | |
CVE-2026-14456 |
high | 7.5 | 0.0073 | 2026-11-06 | Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Init | |
CVE-2026-54876 |
high | 7.5 | 0.0050 | 2026-11-06 | Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has ena | |
CVE-2026-101545 |
high | 7.0 | 0.0009 | 2026-11-06 | Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (compo | |
CVE-2026-101516 |
medium | 6.5 | 0.0027 | 2026-11-06 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi | |
CVE-2026-119217 |
— | — | — | 2026-11-06 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate is | |
CVE-2026-71463 |
low | 2.7 | 0.0027 | 2026-11-06 | Notification template Jinja AST whitelist only inspects static Getattr nodes | |
CVE-2026-68744 |
low | 3.3 | 0.0013 | 2026-11-06 | A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder | |
CVE-2026-112061 |
medium | 5.3 | 0.0022 | 2026-11-06 | librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp | |
CVE-2026-112060 |
medium | 6.1 | 0.0018 | 2026-11-06 | librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds writ | |
CVE-2026-101588 |
medium | 5.3 | 0.0032 | 2026-11-06 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). | |
CVE-2026-101582 |
medium | 5.8 | 0.0032 | 2026-11-06 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integ | |
CVE-2026-101580 |
medium | 5.8 | 0.0032 | 2026-11-06 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-secur | |
CVE-2026-101579 |
high | 7.2 | 0.0027 | 2026-11-06 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc- | |
CVE-2026-101578 |
medium | 5.3 | 0.0032 | 2026-11-06 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-secur | |
CVE-2026-101568 |
medium | 5.3 | 0.0025 | 2026-11-06 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-healt | |
CVE-2026-101562 |
high | 7.5 | 0.0030 | 2026-11-06 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect) | |
CVE-2026-101531 |
high | 7.5 | 0.0040 | 2026-11-06 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Ana | |
CVE-2026-101480 |
medium | 5.3 | 0.0033 | 2026-11-06 | Vulnerability in Oracle Secure Backup (component: NDMP daemon). Supported versions that a | |
CVE-2026-46429 |
medium | 5.5 | 0.0026 | 2026-11-06 | GeoNode is a geospatial content management system, a platform for the management and publi | |
CVE-2026-33050 |
high | 8.8 | 0.0065 | 2026-11-06 | 1 PoC | GeoNode is a geospatial content management system, a platform for the management and publi |
CVE-2026-87876 |
low | 3.0 | 0.0033 | 2026-11-06 | Two case-insensitive comparisons on request-derived usernames outside the main authorizati | |
CVE-2026-86564 |
low | 3.3 | 0.0014 | 2026-11-06 | A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data | |
CVE-2026-55649 |
medium | 6.3 | 0.0032 | 2026-11-06 | GeoNode is a geospatial content management system, a platform for the management and publi | |
CVE-2026-123974 |
high | 7.8 | 0.0014 | 2026-11-06 | In all versions of PyTorch's TorchServe, a predictable extraction directory in /tmp lets a | |
CVE-2026-91926 |
low | 3.7 | 0.0037 | 2026-11-06 | A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when | |
CVE-2026-91142 |
low | 3.6 | 0.0012 | 2026-11-06 | A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID | |
CVE-2026-90463 |
medium | 4.0 | 0.0015 | 2026-11-06 | A flaw was found in the sssd NSS responder. This input validation vulnerability allows a l | |
CVE-2026-124040 |
critical | 9.2 | 0.0051 | 2026-11-06 | 1 PoC | CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after |
CVE-2026-124039 |
medium | 4.8 | 0.0010 | 2026-11-06 | Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that all | |
CVE-2026-124031 |
medium | 6.8 | 0.0012 | 2026-11-06 | GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpe | |
CVE-2026-124030 |
medium | 6.8 | 0.0012 | 2026-11-06 | GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in s | |
CVE-2026-124029 |
medium | 6.9 | 0.0027 | 2026-11-06 | Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that | |
CVE-2026-124028 |
low | 2.3 | 0.0019 | 2026-11-06 | mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core tha | |
CVE-2026-124027 |
high | 8.7 | 0.0049 | 2026-11-06 | ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/ | |
CVE-2026-124026 |
medium | 5.3 | 0.0030 | 2026-11-06 | Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in | |
CVE-2026-124025 |
medium | 5.3 | 0.0028 | 2026-11-06 | Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketContr | |
CVE-2026-101472 |
medium | 5.5 | 0.0013 | 2026-11-06 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co | |
CVE-2026-101470 |
medium | 6.0 | 0.0015 | 2026-11-06 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co | |
CVE-2026-89020 |
high | 8.7 | 0.0056 | 2026-11-06 | 1 PoC | MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buf |
CVE-2026-66338 |
high | 7.2 | 0.0029 | 2026-11-06 | A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsin | |
CVE-2026-59849 |
high | 7.5 | 0.0044 | 2026-11-06 | A flaw was found in libssh. Logic errors in automatic certificate-based public key authent | |
CVE-2026-59846 |
low | 3.9 | 0.0012 | 2026-11-06 | A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handl |