Browse All CVEs
13,189 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-4930 |
high | 7.1 | 0.0014 | 2026-10-29 | SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that a | |
CVE-2026-53925 |
high | 7.8 | 0.0019 | 2026-10-29 | Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, t | |
CVE-2026-56766 |
high | 8.6 | 0.0244 | 2026-10-29 | Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authe | |
CVE-2026-56767 |
high | 8.7 | 0.0060 | 2026-10-29 | Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability | |
CVE-2026-56768 |
high | 8.7 | 0.0071 | 2026-10-29 | Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-li | |
CVE-2026-56770 |
high | 8.7 | 0.0058 | 2026-10-29 | libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index | |
CVE-2026-56789 |
high | 7.1 | 0.0042 | 2026-10-29 | RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb func | |
CVE-2026-56790 |
high | 7.0 | 0.0031 | 2026-10-29 | CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overfl | |
CVE-2026-37453 |
high | 7.5 | 0.0054 | 2026-10-29 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a re | |
CVE-2026-37454 |
high | 7.5 | 0.0034 | 2026-10-29 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a re | |
CVE-2026-46601 |
high | 7.5 | 0.0061 | 2026-10-29 | The webp decoder can panic when processing a VP8 chunk with dimensions that do not match t | |
CVE-2026-46602 |
high | 7.5 | 0.0061 | 2026-10-29 | The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a m | |
CVE-2026-57520 |
high | 7.1 | 0.0064 | 2026-10-29 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows | |
CVE-2026-12473 |
high | 8.3 | 0.0039 | 2026-10-29 | Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch | |
CVE-2026-37452 |
high | 7.5 | 0.0053 | 2026-10-29 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a re | |
CVE-2026-56445 |
high | 8.8 | 0.0064 | 2026-10-29 | The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DI | |
CVE-2026-13281 |
high | 8.3 | 0.0026 | 2026-10-29 | Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacke | |
CVE-2026-13283 |
high | 7.5 | 0.0034 | 2026-10-29 | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a r | |
CVE-2026-50176 |
high | 8.7 | 0.0071 | 2026-10-29 | The WebSocket Application Programming Interface lacks restrictions on the number of authen | |
CVE-2026-9219 |
high | 8.3 | 0.0035 | 2026-10-29 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a pred | |
CVE-2026-9220 |
high | 8.7 | 0.0039 | 2026-10-29 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts re | |
CVE-2026-9221 |
high | 8.7 | 0.0026 | 2026-10-29 | The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier use | |
CVE-2026-48615 |
high | 7.5 | 0.0040 | 2026-10-29 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY | |
CVE-2026-48619 |
high | 7.5 | 0.0064 | 2026-10-29 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN fram | |
CVE-2026-48933 |
high | 7.5 | 0.0371 | 2026-10-29 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.e | |
CVE-2026-50741 |
high | 8.8 | 0.0494 | 2026-10-29 | Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by | |
CVE-2026-8797 |
high | 8.5 | 0.0015 | 2026-10-29 | An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a | |
CVE-2026-49486 |
high | 7.5 | 0.0044 | 2026-10-29 | The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connec | |
CVE-2026-57872 |
high | 7.5 | 0.0145 | 2026-10-29 | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision | |
CVE-2026-57873 |
high | 7.5 | 0.0035 | 2026-10-29 | An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi i | |
CVE-2026-57874 |
high | 7.5 | 0.0055 | 2026-10-29 | An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVisi | |
CVE-2026-57875 |
high | 7.5 | 0.0073 | 2026-10-29 | An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsi | |
CVE-2026-57876 |
high | 7.5 | 0.0055 | 2026-10-29 | An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-L | |
CVE-2026-57877 |
high | 8.6 | 0.0043 | 2026-10-29 | An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and | |
CVE-2026-11625 |
high | 7.5 | 0.0051 | 2026-10-29 | Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked pr | |
CVE-2026-11702 |
high | 7.5 | 0.0051 | 2026-10-29 | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across fo | |
CVE-2026-57912 |
high | 7.5 | 0.0042 | 2026-10-29 | Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by r | |
CVE-2026-57913 |
high | 7.5 | 0.0042 | 2026-10-29 | Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing | |
CVE-2026-57918 |
high | 7.1 | 0.0030 | 2026-10-29 | libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read | |
CVE-2026-40711 |
high | 8.0 | 0.0135 | 2026-10-29 | Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, | |
CVE-2026-57920 |
high | 7.7 | 0.0038 | 2026-10-29 | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass a | |
CVE-2026-57921 |
high | 7.5 | 0.0030 | 2026-10-29 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' p | |
CVE-2026-57923 |
high | 7.5 | 0.0027 | 2026-10-29 | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations | |
CVE-2026-54824 |
high | 7.5 | 0.0042 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. | |
CVE-2026-54826 |
high | 7.6 | 0.0031 | 2026-10-29 | Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. | |
CVE-2026-54832 |
high | 7.5 | 0.0035 | 2026-10-29 | Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. | |
CVE-2026-54833 |
high | 7.4 | 0.0032 | 2026-10-29 | Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. | |
CVE-2026-54834 |
high | 7.5 | 0.0042 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. | |
CVE-2026-54835 |
high | 7.5 | 0.0035 | 2026-10-29 | Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions. | |
CVE-2026-54837 |
high | 7.5 | 0.0039 | 2026-10-29 | Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One In |