Browse All CVEs
3,587 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-77992 |
critical | 9.5 | 0.0044 | 2026-10-29 | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabri | |
CVE-2026-77994 |
critical | 9.3 | 0.0039 | 2026-10-29 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - T | |
CVE-2026-66897 |
critical | 9.9 | 0.0072 | 2026-10-29 | A path traversal vulnerability in LXD's instance template processing allows an attacker wi | |
CVE-2026-66587 |
critical | 9.8 | 0.0050 | 2026-10-29 | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. | |
CVE-2026-77995 |
critical | 10.0 | 0.0041 | 2026-10-29 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client | |
CVE-2026-32563 |
critical | 9.8 | 0.0056 | 2026-10-29 | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= | |
CVE-2025-61163 |
critical | 9.8 | 0.0036 | 2026-10-29 | Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain polic | |
CVE-2025-61165 |
critical | 9.8 | 0.0045 | 2026-10-29 | An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of coher | |
CVE-2025-70290 |
critical | 9.8 | 0.0067 | 2026-10-29 | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability i | |
CVE-2025-70293 |
critical | 9.8 | 0.0077 | 2026-10-29 | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability e | |
CVE-2025-51679 |
critical | 9.1 | 0.0063 | 2026-10-29 | An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and n | |
CVE-2025-67066 |
critical | 9.8 | 0.0071 | 2026-10-29 | SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute | |
CVE-2024-11080 |
critical | 9.8 | 0.0081 | 2026-10-29 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Una | |
CVE-2026-76578 |
critical | 9.8 | 0.0121 | 2026-10-29 | 1 PoC | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authenticatio |
CVE-2025-56563 |
critical | 9.8 | 0.0058 | 2026-10-29 | A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tr | |
CVE-2026-92812 |
critical | 9.3 | 0.0044 | 2026-10-29 | Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy contain | |
CVE-2025-55787 |
critical | 9.8 | 0.0047 | 2026-10-29 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. | |
CVE-2026-75885 |
critical | 9.3 | 0.0073 | 2026-10-29 | A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` a | |
CVE-2026-100886 |
critical | 9.3 | 0.0115 | 2026-10-29 | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build2026 | |
CVE-2026-100752 |
critical | 9.3 | 0.0032 | 2026-10-29 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Fr | |
CVE-2026-101108 |
critical | 9.3 | 0.0032 | 2026-10-29 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) | |
CVE-2026-102560 |
critical | 9.8 | 0.0042 | 2026-10-29 | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a | |
CVE-2024-31026 |
critical | 9.8 | 0.0075 | 2026-10-29 | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote | |
CVE-2026-104286 |
critical | 9.8 | 0.0457 | 2026-10-29 | KEV | Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte o |
CVE-2026-63569 |
critical | 9.1 | 0.0033 | 2026-10-29 | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellma | |
CVE-2026-105134 |
critical | 10.0 | 0.8176 | 2026-10-29 | KEV | Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attack |
CVE-2026-21589 |
critical | 9.3 | 0.9948 | 2026-10-29 | KEV 13 PoC | Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service M |
CVE-2026-39746 |
critical | 9.3 | 0.0037 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-39795 |
critical | 9.3 | 0.0030 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-106486 |
critical | 9.9 | 0.0037 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backsta | |
CVE-2025-64393 |
critical | 9.4 | 0.0520 | 2026-10-29 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitra | |
CVE-2025-70516 |
critical | 9.1 | 0.0033 | 2026-10-29 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper au | |
CVE-2025-70520 |
critical | 9.8 | 0.0050 | 2026-10-29 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper au | |
CVE-2026-109422 |
critical | 9.2 | 0.0052 | 2026-10-29 | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 | |
CVE-2026-109566 |
critical | 9.3 | 0.0044 | 2026-10-29 | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that | |
CVE-2026-109705 |
critical | 9.6 | 0.0032 | 2026-10-29 | Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free | |
CVE-2026-109707 |
critical | 9.6 | 0.0032 | 2026-10-29 | Sandbox escape due to use-after-free in the Networking component. This vulnerability was f | |
CVE-2026-109708 |
critical | 9.6 | 0.0033 | 2026-10-29 | Sandbox escape due to incorrect boundary conditions in the Networking component. This vuln | |
CVE-2026-109772 |
critical | 9.1 | 0.0018 | 2026-10-29 | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firef | |
CVE-2026-109774 |
critical | 9.8 | 0.0034 | 2026-10-29 | Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerabilit | |
CVE-2026-109780 |
critical | 9.8 | 0.0036 | 2026-10-29 | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firef | |
CVE-2024-34320 |
critical | 9.8 | 0.0035 | 2026-10-29 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control | |
CVE-2024-34323 |
critical | 10.0 | 0.0036 | 2026-10-29 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Re | |
CVE-2024-34324 |
critical | 9.1 | 0.0030 | 2026-10-29 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hija | |
CVE-2026-92892 |
critical | 9.0 | 0.0034 | 2026-10-29 | Potential arbitrary code execution under specific configurations. Updated October 22, 2026 | |
CVE-2026-105008 |
critical | 9.0 | 0.0066 | 2026-10-29 | No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoof | |
CVE-2026-105010 |
critical | 9.8 | 0.0099 | 2026-10-29 | Use after free in Microsoft Windows Search Component allows an unauthorized attacker to el | |
CVE-2026-105016 |
critical | 9.8 | 0.0166 | 2026-10-29 | Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute co | |
CVE-2026-69634 |
critical | 9.8 | 0.0095 | 2026-10-29 | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute cod | |
CVE-2026-69639 |
critical | 9.8 | 0.0095 | 2026-10-29 | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execut |