Browse All CVEs
13,193 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-14380 |
high | 8.8 | 0.0050 | 2026-10-29 | DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced | |
CVE-2026-14895 |
high | 7.5 | 0.0063 | 2026-10-29 | String::Util versions before 1.36 for Perl are susceptible to a regular expression denial | |
CVE-2026-59999 |
high | 7.5 | 0.0016 | 2026-10-29 | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over | |
CVE-2026-60000 |
high | 7.5 | 0.0062 | 2026-10-29 | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource | |
CVE-2026-56437 |
high | 8.4 | 0.0018 | 2026-10-29 | Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a cra | |
CVE-2026-57895 |
high | 8.5 | 0.0016 | 2026-10-29 | Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker | |
CVE-2026-56001 |
high | 8.8 | 0.0039 | 2026-10-29 | A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowi | |
CVE-2026-56002 |
high | 8.8 | 0.0043 | 2026-10-29 | A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 befor | |
CVE-2026-56003 |
high | 8.8 | 0.0040 | 2026-10-29 | A heap buffer overflow due to missing size checking in the property buffer when parsing PC | |
CVE-2026-15053 |
high | 7.5 | 0.0046 | 2026-10-29 | Tanium addressed a denial of service vulnerability in Tanium Server. | |
CVE-2026-22927 |
high | 7.8 | 0.0018 | 2026-10-29 | Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnera | |
CVE-2026-41122 |
high | 7.1 | 0.0028 | 2026-10-29 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1 | |
CVE-2026-44840 |
high | 7.5 | 0.0053 | 2026-10-29 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `check | |
CVE-2026-53482 |
high | 7.5 | 0.0048 | 2026-10-29 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1 | |
CVE-2026-56086 |
high | 8.8 | 0.0042 | 2026-10-29 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1 | |
CVE-2026-56220 |
high | 7.1 | 0.0024 | 2026-10-29 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifes | |
CVE-2026-56226 |
high | 8.7 | 0.0032 | 2026-10-29 | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.ge | |
CVE-2026-56297 |
high | 8.3 | 0.0047 | 2026-10-29 | FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and | |
CVE-2026-58656 |
high | 8.7 | 0.0035 | 2026-10-29 | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter | |
CVE-2026-10698 |
high | 7.2 | 0.0064 | 2026-10-29 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress | |
CVE-2026-10699 |
high | 7.5 | 0.0049 | 2026-10-29 | Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transf | |
CVE-2026-10706 |
high | 7.5 | 0.0042 | 2026-10-29 | In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user rec | |
CVE-2026-10708 |
high | 7.5 | 0.0021 | 2026-10-29 | This vulnerability enables large‑scale data harvesting without requiring app‑specific secr | |
CVE-2026-15067 |
high | 8.8 | 0.0053 | 2026-10-29 | Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabili | |
CVE-2026-49145 |
high | 7.5 | 0.0049 | 2026-10-29 | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a proje | |
CVE-2026-49146 |
high | 7.5 | 0.0061 | 2026-10-29 | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context | |
CVE-2026-49147 |
high | 7.5 | 0.0049 | 2026-10-29 | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from | |
CVE-2026-54652 |
high | 8.1 | 0.0029 | 2026-10-29 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{se | |
CVE-2026-53951 |
high | 8.8 | 0.0026 | 2026-10-29 | Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through | |
CVE-2026-59262 |
high | 7.1 | 0.0042 | 2026-10-29 | AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing doc | |
CVE-2026-59724 |
high | 7.5 | 0.0061 | 2026-10-29 | Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5 | |
CVE-2026-59725 |
high | 7.5 | 0.0064 | 2026-10-29 | Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1 | |
CVE-2026-59868 |
high | 7.5 | 0.0064 | 2026-10-29 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys a | |
CVE-2026-59869 |
high | 7.5 | 0.0059 | 2026-10-29 | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 be | |
CVE-2026-59870 |
high | 7.5 | 0.0074 | 2026-10-29 | js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_ | |
CVE-2026-59871 |
high | 7.5 | 0.0064 | 2026-10-29 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coer | |
CVE-2026-59874 |
high | 8.7 | 0.0043 | 2026-10-29 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace a | |
CVE-2026-59877 |
high | 7.5 | 0.0037 | 2026-10-29 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 an | |
CVE-2026-29009 |
high | 8.8 | 0.0074 | 2026-10-29 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() | |
CVE-2026-39822 |
high | 7.8 | 0.0023 | 2026-10-29 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations out | |
CVE-2026-59261 |
high | 8.4 | 0.0027 | 2026-10-29 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dot | |
CVE-2026-59731 |
high | 8.2 | 0.0033 | 2026-10-29 | Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization | |
CVE-2026-59887 |
high | 7.5 | 0.0047 | 2026-10-29 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the m | |
CVE-2026-59892 |
high | 7.5 | 0.0056 | 2026-10-29 | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentele | |
CVE-2026-59922 |
high | 7.5 | 0.0064 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of c | |
CVE-2026-59925 |
high | 7.5 | 0.0064 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long seque | |
CVE-2026-59928 |
high | 7.5 | 0.0065 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown | |
CVE-2026-60102 |
high | 7.7 | 0.0327 | 2026-10-29 | Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerab | |
CVE-2026-55575 |
high | 8.2 | 0.0049 | 2026-10-29 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior | |
CVE-2026-55760 |
high | 7.5 | 0.0053 | 2026-10-29 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4. |