Browse All CVEs
13,136 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-10845 |
high | 7.3 | 0.0047 | 2026-10-29 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authe | |
CVE-2026-41045 |
high | 7.0 | 0.0016 | 2026-10-29 | A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allo | |
CVE-2026-41046 |
high | 7.3 | 0.0019 | 2026-10-29 | A path traversal attack when using a "configName" parameter in qSnapper before version 1.3 | |
CVE-2026-41048 |
high | 8.4 | 0.0018 | 2026-10-29 | Incorrect caching of authentication between different polkit methods in qSnapper before ve | |
CVE-2026-41049 |
high | 8.4 | 0.0018 | 2026-10-29 | Incorrect caching of authentication between different users of the qSnapper dbus service | |
CVE-2026-8858 |
high | 8.8 | 0.0041 | 2026-10-29 | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerab | |
CVE-2026-48712 |
high | 7.5 | 0.0046 | 2026-10-29 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 an | |
CVE-2026-53539 |
high | 7.5 | 0.0046 | 2026-10-29 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing | |
CVE-2026-53571 |
high | 8.2 | 0.0058 | 2026-10-29 | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, th | |
CVE-2026-54271 |
high | 8.2 | 0.0030 | 2026-10-29 | protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a pre | |
CVE-2026-54283 |
high | 7.5 | 0.0048 | 2026-10-29 | Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() | |
CVE-2026-54290 |
high | 7.1 | 0.0033 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. Prio | |
CVE-2026-55388 |
high | 8.1 | 0.0048 | 2026-10-29 | piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, pi | |
CVE-2026-56109 |
high | 7.0 | 0.0014 | 2026-10-29 | The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-fre | |
CVE-2026-53779 |
high | 8.7 | 0.0059 | 2026-10-29 | WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allo | |
CVE-2026-54299 |
high | 7.5 | 0.0033 | 2026-10-29 | Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/40 | |
CVE-2026-10852 |
high | 7.5 | 0.0047 | 2026-10-29 | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerab | |
CVE-2026-44271 |
high | 8.8 | 0.0044 | 2026-10-29 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutrali | |
CVE-2026-44272 |
high | 8.8 | 0.0044 | 2026-10-29 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutrali | |
CVE-2026-44274 |
high | 7.8 | 0.0017 | 2026-10-29 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Res | |
CVE-2026-55603 |
high | 7.5 | 0.0029 | 2026-10-29 | http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, | |
CVE-2026-48505 |
high | 7.4 | 0.0030 | 2026-10-29 | Filament is a collection of full-stack components for accelerated Laravel development. Fro | |
CVE-2026-54281 |
high | 8.7 | 0.0050 | 2026-10-29 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1. | |
CVE-2026-55409 |
high | 7.6 | 0.0028 | 2026-10-29 | Filament is a collection of full-stack components for accelerated Laravel development. Fro | |
CVE-2026-56221 |
high | 7.1 | 0.0034 | 2026-10-29 | Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts wh | |
CVE-2026-56280 |
high | 7.1 | 0.0032 | 2026-10-29 | Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jo | |
CVE-2026-56324 |
high | 8.8 | 0.0033 | 2026-10-29 | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpo | |
CVE-2026-54232 |
high | 8.8 | 0.0056 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, | |
CVE-2026-10658 |
high | 7.1 | 0.0028 | 2026-10-29 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when | |
CVE-2026-10711 |
high | 8.8 | 0.0037 | 2026-10-29 | Missing authentication for critical function vulnerability in AKIN Software Computer Impor | |
CVE-2026-54892 |
high | 8.7 | 0.0089 | 2026-10-29 | Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenti | |
CVE-2026-56225 |
high | 8.7 | 0.0037 | 2026-10-29 | Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key | |
CVE-2026-56243 |
high | 8.6 | 0.0035 | 2026-10-29 | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST | |
CVE-2026-56248 |
high | 8.7 | 0.0043 | 2026-10-29 | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-servic | |
CVE-2026-56701 |
high | 7.1 | 0.0031 | 2026-10-29 | Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG fi | |
CVE-2026-35018 |
high | 8.7 | 0.0127 | 2026-10-29 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remo | |
CVE-2026-56815 |
high | 7.4 | 0.0017 | 2026-10-29 | pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerabi | |
CVE-2026-54309 |
high | 8.8 | 0.0055 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/ | |
CVE-2026-54312 |
high | 7.2 | 0.0040 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user | |
CVE-2026-56402 |
high | 7.1 | 0.0038 | 2026-10-29 | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApproval | |
CVE-2026-56695 |
high | 7.1 | 0.0040 | 2026-10-29 | OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to T | |
CVE-2026-11940 |
high | 7.8 | 0.0075 | 2026-10-29 | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archi | |
CVE-2026-12957 |
high | 8.5 | 0.0023 | 2026-10-29 | Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on a | |
CVE-2026-12958 |
high | 8.5 | 0.0019 | 2026-10-29 | Missing symlink validation in Language Servers for AWS may allow an arbitrary file write o | |
CVE-2026-13007 |
high | 8.7 | 0.0061 | 2026-10-29 | Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* t | |
CVE-2026-33760 |
high | 8.8 | 0.0050 | 2026-10-29 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1. | |
CVE-2026-34914 |
high | 8.3 | 0.0039 | 2026-10-29 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0 | |
CVE-2026-44792 |
high | 8.9 | 0.0039 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, | |
CVE-2026-44959 |
high | 8.8 | 0.0059 | 2026-10-29 | A missing validation of user input exists when saving delivery limitations in Revive Adser | |
CVE-2026-45732 |
high | 8.3 | 0.0035 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, |