Browse All CVEs
13,207 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54371 |
high | 8.4 | 0.0015 | 2026-10-29 | attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and s | |
CVE-2026-49049 |
high | 7.5 | 0.0099 | 2026-10-29 | The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated att | |
CVE-2026-55607 |
high | 7.7 | 0.0069 | 2026-10-29 | Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree | |
CVE-2026-55844 |
high | 7.5 | 0.0020 | 2026-10-29 | Home Assistant is open source home automation software that puts local control and privacy | |
CVE-2026-56124 |
high | 8.7 | 0.0064 | 2026-10-29 | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability | |
CVE-2026-57320 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions. | |
CVE-2026-57332 |
high | 7.1 | 0.0034 | 2026-10-29 | Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions. | |
CVE-2026-57333 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions. | |
CVE-2026-57336 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions. | |
CVE-2026-57337 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions. | |
CVE-2026-57338 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. | |
CVE-2026-13580 |
high | 7.4 | 0.0080 | 2026-10-29 | A security vulnerability has been detected in Edimax EW-7478APC 1.04. This affects the fun | |
CVE-2026-13582 |
high | 7.4 | 0.0080 | 2026-10-29 | A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAc | |
CVE-2026-13583 |
high | 7.4 | 0.0080 | 2026-10-29 | A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the function formUSB | |
CVE-2026-13744 |
high | 8.8 | 0.0046 | 2026-10-29 | Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to | |
CVE-2026-13749 |
high | 8.8 | 0.0054 | 2026-10-29 | Improper neutralization in the Snowpark annotation processor callback template in Snowflak | |
CVE-2026-13752 |
high | 8.0 | 0.0033 | 2026-10-29 | Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unin | |
CVE-2026-56285 |
high | 7.7 | 0.0046 | 2026-10-29 | Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domai | |
CVE-2026-56783 |
high | 7.1 | 0.0035 | 2026-10-29 | Parseable before 2.9.2 contains an information disclosure vulnerability in the notificatio | |
CVE-2026-57948 |
high | 7.6 | 0.0016 | 2026-10-29 | Pinpoint through version 3.1.0 contains an insecure session management vulnerability that | |
CVE-2026-57949 |
high | 7.1 | 0.0029 | 2026-10-29 | ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization v | |
CVE-2026-57950 |
high | 8.6 | 0.0037 | 2026-10-29 | ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vu | |
CVE-2026-57951 |
high | 7.1 | 0.0043 | 2026-10-29 | Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_ste | |
CVE-2026-57959 |
high | 8.2 | 0.0026 | 2026-10-29 | Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation v | |
CVE-2026-57960 |
high | 8.3 | 0.0042 | 2026-10-29 | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control | |
CVE-2026-57999 |
high | 7.7 | 0.0147 | 2026-10-29 | luci-app-tailscale-community contains a command injection vulnerability in the tailscale.d | |
CVE-2026-58000 |
high | 8.7 | 0.0172 | 2026-10-29 | luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection v | |
CVE-2026-13762 |
high | 7.9 | 0.0063 | 2026-10-29 | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled m | |
CVE-2026-13763 |
high | 7.9 | 0.0068 | 2026-10-29 | Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS W | |
CVE-2026-43715 |
high | 8.8 | 0.0126 | 2026-10-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed | |
CVE-2026-53426 |
high | 8.2 | 0.0018 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allow | |
CVE-2026-56017 |
high | 7.5 | 0.0049 | 2026-10-29 | JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereferen | |
CVE-2026-56018 |
high | 7.5 | 0.0061 | 2026-10-29 | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify | |
CVE-2026-34594 |
high | 8.8 | 0.0138 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-34597 |
high | 8.8 | 0.0066 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-41896 |
high | 7.5 | 0.0028 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-53404 |
high | 7.3 | 0.0065 | 2026-10-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valv | |
CVE-2026-55957 |
high | 7.3 | 0.0285 | 2026-10-29 | Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm | |
CVE-2026-34592 |
high | 7.7 | 0.0034 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-8023 |
high | 7.5 | 0.0087 | 2026-10-29 | Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTT | |
CVE-2026-56808 |
high | 8.6 | 0.0248 | 2026-10-29 | DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulner | |
CVE-2026-12578 |
high | 8.4 | 0.0037 | 2026-10-29 | The affected product is vulnerable to a deserialization of untrusted data, which may allow | |
CVE-2026-10763 |
high | 7.0 | 0.0043 | 2026-10-29 | PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due t | |
CVE-2026-13149 |
high | 7.7 | 0.0036 | 2026-10-29 | brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function ex | |
CVE-2026-8141 |
high | 7.2 | 0.0032 | 2026-10-29 | The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scrip | |
CVE-2026-49877 |
high | 8.1 | 0.0051 | 2026-10-29 | Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege W | |
CVE-2026-14161 |
high | 8.7 | 0.0055 | 2026-10-29 | Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerabi | |
CVE-2026-41053 |
high | 8.8 | 0.0052 | 2026-10-29 | Incorrect authentication caching in the team member ship expansion of the Rancher Github a | |
CVE-2026-53691 |
high | 8.6 | 0.0067 | 2026-10-29 | An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows authenticated | |
CVE-2026-57080 |
high | 7.5 | 0.0049 | 2026-10-29 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an unca |