Browse All CVEs
13,168 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40738 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions. | |
CVE-2026-40752 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions. | |
CVE-2026-40756 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. | |
CVE-2026-40757 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. | |
CVE-2026-49268 |
high | 8.8 | 0.0051 | 2026-10-29 | A remote attacker can inject LDAP special characters into the Distinguished Name (DN) cons | |
CVE-2026-52707 |
high | 8.1 | 0.0049 | 2026-10-29 | Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. | |
CVE-2026-54193 |
high | 7.7 | 0.0033 | 2026-10-29 | Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions. | |
CVE-2026-54417 |
high | 8.7 | 0.0042 | 2026-10-29 | An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allo | |
CVE-2026-54813 |
high | 8.5 | 0.0021 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-54814 |
high | 8.1 | 0.0033 | 2026-10-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote Fil | |
CVE-2026-54816 |
high | 7.5 | 0.0033 | 2026-10-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Ad | |
CVE-2026-54818 |
high | 8.5 | 0.0028 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-55738 |
high | 8.7 | 0.0040 | 2026-10-29 | A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rx | |
CVE-2026-11311 |
high | 8.6 | 0.0057 | 2026-10-29 | When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vul | |
CVE-2026-22283 |
high | 7.5 | 0.0021 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functional | |
CVE-2026-32804 |
high | 8.1 | 0.0023 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication | |
CVE-2026-35065 |
high | 8.8 | 0.0035 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication f | |
CVE-2026-35066 |
high | 7.1 | 0.0018 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control | |
CVE-2026-35067 |
high | 8.0 | 0.0015 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control | |
CVE-2026-49502 |
high | 8.1 | 0.0021 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication | |
CVE-2026-54415 |
high | 8.6 | 0.0035 | 2026-10-29 | Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azurio | |
CVE-2026-54810 |
high | 7.5 | 0.0024 | 2026-10-29 | Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrect | |
CVE-2026-32652 |
high | 7.8 | 0.0010 | 2026-10-29 | Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulne | |
CVE-2026-35069 |
high | 8.0 | 0.0023 | 2026-10-29 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization | |
CVE-2026-53875 |
high | 7.1 | 0.0055 | 2026-10-29 | picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch funct | |
CVE-2026-30802 |
high | 8.8 | 0.0025 | 2026-10-29 | Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buf | |
CVE-2026-30803 |
high | 8.8 | 0.0030 | 2026-10-29 | Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) | |
CVE-2026-7300 |
high | 8.8 | 0.0025 | 2026-10-29 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RT | |
CVE-2026-53869 |
high | 8.7 | 0.0059 | 2026-10-29 | Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints t | |
CVE-2026-53871 |
high | 8.6 | 0.0037 | 2026-10-29 | Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_pro | |
CVE-2026-55197 |
high | 7.1 | 0.0035 | 2026-10-29 | Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/se | |
CVE-2026-55198 |
high | 7.1 | 0.0035 | 2026-10-29 | Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session | |
CVE-2026-10696 |
high | 7.5 | 0.0027 | 2026-10-29 | Use of an incorrectly resolved name or reference in the pinget backend in Devolutions Uni | |
CVE-2026-11407 |
high | 8.6 | 0.0062 | 2026-10-29 | Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authent | |
CVE-2026-32682 |
high | 7.1 | 0.0029 | 2026-10-29 | When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacke | |
CVE-2026-50107 |
high | 8.6 | 0.0049 | 2026-10-29 | When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fab | |
CVE-2026-55201 |
high | 7.4 | 0.0030 | 2026-10-29 | Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability i | |
CVE-2026-12530 |
high | 8.4 | 0.0034 | 2026-10-29 | Improper neutralization of argument delimiters in the install_packages() method in AWS Bed | |
CVE-2026-48989 |
high | 8.9 | 0.0040 | 2026-10-29 | Windows-MCP is an open-source project that integrates AI agents with Windows. In versions | |
CVE-2026-48997 |
high | 7.1 | 0.0095 | 2026-10-29 | e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command i | |
CVE-2026-50196 |
high | 7.5 | 0.0045 | 2026-10-29 | Steeltoe is an open source project that provides a collection of libraries that helps user | |
CVE-2026-8050 |
high | 7.5 | 0.0037 | 2026-10-29 | In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference t | |
CVE-2026-45357 |
high | 7.5 | 0.0039 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-45617 |
high | 7.5 | 0.0046 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-48759 |
high | 7.1 | 0.0020 | 2026-10-29 | TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Objec | |
CVE-2026-48764 |
high | 8.2 | 0.0033 | 2026-10-29 | TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is impleme | |
CVE-2026-8811 |
high | 7.1 | 0.0032 | 2026-10-29 | SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during enc | |
CVE-2026-11719 |
high | 8.6 | 0.0014 | 2026-10-29 | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases du | |
CVE-2026-11958 |
high | 7.3 | 0.0010 | 2026-10-29 | Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DF | |
CVE-2026-50141 |
high | 7.1 | 0.0043 | 2026-10-29 | Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vul |