Browse All CVEs
13,207 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57081 |
high | 7.5 | 0.0049 | 2026-10-29 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply | |
CVE-2026-58014 |
high | 8.6 | 0.0056 | 2026-10-29 | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_strin | |
CVE-2026-58015 |
high | 7.5 | 0.0084 | 2026-10-29 | A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SAS | |
CVE-2026-58374 |
high | 7.1 | 0.0029 | 2026-10-29 | In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Li | |
CVE-2026-27957 |
high | 8.8 | 0.0081 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-44949 |
high | 7.0 | 0.0039 | 2026-10-29 | A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webh | |
CVE-2026-48285 |
high | 8.6 | 0.0083 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forg | |
CVE-2026-48307 |
high | 8.8 | 0.0055 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scr | |
CVE-2026-10652 |
high | 7.4 | 0.0042 | 2026-10-29 | Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in d | |
CVE-2026-10653 |
high | 8.1 | 0.0042 | 2026-10-29 | The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- | |
CVE-2026-49451 |
high | 7.5 | 0.0075 | 2026-10-29 | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along wit | |
CVE-2026-58165 |
high | 8.7 | 0.0034 | 2026-10-29 | OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerabi | |
CVE-2026-58166 |
high | 8.8 | 0.0085 | 2026-10-29 | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerab | |
CVE-2026-58167 |
high | 7.1 | 0.0042 | 2026-10-29 | Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including pl | |
CVE-2026-58168 |
high | 7.7 | 0.0041 | 2026-10-29 | DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows | |
CVE-2026-58169 |
high | 7.7 | 0.0042 | 2026-10-29 | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability th | |
CVE-2026-58170 |
high | 7.2 | 0.0055 | 2026-10-29 | Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied prop | |
CVE-2026-58176 |
high | 7.1 | 0.0032 | 2026-10-29 | RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management en | |
CVE-2026-58375 |
high | 8.7 | 0.0063 | 2026-10-29 | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentic | |
CVE-2026-8864 |
high | 7.3 | 0.0014 | 2026-10-29 | The HP Fan Control App might allow local escalation of privileges. An updated version of H | |
CVE-2026-9263 |
high | 8.1 | 0.0033 | 2026-10-29 | The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/is | |
CVE-2026-10129 |
high | 8.5 | 0.0031 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protect | |
CVE-2026-10564 |
high | 8.2 | 0.0036 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The le | |
CVE-2026-11595 |
high | 7.5 | 0.0078 | 2026-10-29 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sens | |
CVE-2026-11806 |
high | 7.5 | 0.0047 | 2026-10-29 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arb | |
CVE-2026-12084 |
high | 7.5 | 0.0026 | 2026-10-29 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin | |
CVE-2026-13759 |
high | 8.8 | 0.0055 | 2026-10-29 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclass | |
CVE-2026-9836 |
high | 7.5 | 0.0045 | 2026-10-29 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information | |
CVE-2026-13207 |
high | 8.7 | 0.0061 | 2026-10-29 | FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segme | |
CVE-2026-44628 |
high | 8.7 | 0.0064 | 2026-10-29 | An unauthenticated attacker can crash the worklist server with a single crafted query when | |
CVE-2026-35505 |
high | 8.7 | 0.0065 | 2026-10-29 | An unauthenticated remote attacker can repeatedly send crafted connection requests to leak | |
CVE-2026-50254 |
high | 8.7 | 0.0065 | 2026-10-29 | An unauthenticated remote attacker can repeatedly send a single crafted connection request | |
CVE-2026-52196 |
high | 7.5 | 0.0052 | 2026-10-29 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote a | |
CVE-2026-52868 |
high | 8.8 | 0.0049 | 2026-10-29 | An unauthenticated attacker can read worklist records from a directory outside the intende | |
CVE-2026-57585 |
high | 7.5 | 0.0049 | 2026-10-29 | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there | |
CVE-2026-58447 |
high | 7.1 | 0.0027 | 2026-10-29 | Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level au | |
CVE-2026-58448 |
high | 7.1 | 0.0040 | 2026-10-29 | yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM modul | |
CVE-2026-13774 |
high | 8.1 | 0.0030 | 2026-10-29 | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker w | |
CVE-2026-13777 |
high | 8.8 | 0.0032 | 2026-10-29 | Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150. | |
CVE-2026-13778 |
high | 7.8 | 0.0014 | 2026-10-29 | Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local at | |
CVE-2026-13779 |
high | 8.1 | 0.0039 | 2026-10-29 | Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a | |
CVE-2026-13783 |
high | 8.8 | 0.0032 | 2026-10-29 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker | |
CVE-2026-13784 |
high | 8.8 | 0.0032 | 2026-10-29 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker | |
CVE-2026-13786 |
high | 8.8 | 0.0041 | 2026-10-29 | Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker | |
CVE-2026-13787 |
high | 8.1 | 0.0042 | 2026-10-29 | Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a | |
CVE-2026-13788 |
high | 8.8 | 0.0041 | 2026-10-29 | Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a | |
CVE-2026-13791 |
high | 8.1 | 0.0035 | 2026-10-29 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.78 | |
CVE-2026-13794 |
high | 7.5 | 0.0049 | 2026-10-29 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows p | |
CVE-2026-13799 |
high | 8.1 | 0.0032 | 2026-10-29 | Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker t | |
CVE-2026-13800 |
high | 7.8 | 0.0012 | 2026-10-29 | Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 |