Browse All CVEs
13,136 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-49444 |
high | 7.1 | 0.0039 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, | |
CVE-2026-54301 |
high | 7.0 | 0.0024 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, | |
CVE-2026-54302 |
high | 7.0 | 0.0023 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, | |
CVE-2026-54304 |
high | 7.1 | 0.0038 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, | |
CVE-2026-54305 |
high | 8.9 | 0.0037 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, | |
CVE-2026-54307 |
high | 8.5 | 0.0039 | 2026-10-29 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, | |
CVE-2026-55255 |
high | 8.4 | 0.0089 | 2026-10-29 | KEV | Langflow contains an authorization bypass through user-controlled key vulnerability which |
CVE-2026-55446 |
high | 7.5 | 0.0058 | 2026-10-29 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1. | |
CVE-2026-56115 |
high | 8.7 | 0.0045 | 2026-10-29 | Bootimus through 0.1.70 contains a broken access control vulnerability that allows authent | |
CVE-2026-56116 |
high | 7.1 | 0.0029 | 2026-10-29 | dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in th | |
CVE-2026-45135 |
high | 8.1 | 0.0068 | 2026-10-29 | Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, | |
CVE-2026-49401 |
high | 8.4 | 0.0020 | 2026-10-29 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permiss | |
CVE-2026-49402 |
high | 8.1 | 0.0044 | 2026-10-29 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:ch | |
CVE-2026-49440 |
high | 7.4 | 0.0024 | 2026-10-29 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.che | |
CVE-2026-52844 |
high | 7.5 | 0.0062 | 2026-10-29 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windo | |
CVE-2026-54317 |
high | 7.6 | 0.0031 | 2026-10-29 | Home Assistant is open source home automation software that puts local control and privacy | |
CVE-2026-54318 |
high | 7.1 | 0.0017 | 2026-10-29 | Home Assistant is open source home automation software that puts local control and privacy | |
CVE-2026-53754 |
high | 7.5 | 0.0043 | 2026-10-29 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker | |
CVE-2026-53755 |
high | 7.5 | 0.0158 | 2026-10-29 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker | |
CVE-2026-54320 |
high | 8.4 | 0.0035 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-54321 |
high | 7.0 | 0.0040 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-54322 |
high | 7.7 | 0.0030 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-55249 |
high | 8.8 | 0.0055 | 2026-10-29 | @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec too | |
CVE-2026-39253 |
high | 8.1 | 0.0072 | 2026-10-29 | An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via | |
CVE-2026-54328 |
high | 7.3 | 0.0016 | 2026-10-29 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with tempor | |
CVE-2026-54555 |
high | 7.8 | 0.0020 | 2026-10-29 | rtk filters and compresses command outputs before they reach your LLM context. Prior to 0. | |
CVE-2026-41862 |
high | 8.8 | 0.0076 | 2026-10-29 | Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) | |
CVE-2026-54512 |
high | 8.1 | 0.0094 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-11972 |
high | 8.2 | 0.0072 | 2026-10-29 | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tar | |
CVE-2026-5818 |
high | 7.2 | 0.0024 | 2026-10-29 | Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwa | |
CVE-2026-7574 |
high | 8.7 | 0.0011 | 2026-10-29 | Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2 | |
CVE-2026-54639 |
high | 8.8 | 0.0036 | 2026-10-29 | Style Dictionary, a build system for creating cross-platform styles, has a prototype pollu | |
CVE-2026-12681 |
high | 8.9 | 0.0027 | 2026-10-29 | Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Goog | |
CVE-2026-10735 |
high | 7.5 | 0.0043 | 2026-10-29 | Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro Wo | |
CVE-2026-13006 |
high | 7.0 | 0.0018 | 2026-10-29 | ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up | |
CVE-2026-56052 |
high | 7.6 | 0.0038 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-10745 |
high | 7.9 | 0.0043 | 2026-10-29 | Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Insta | |
CVE-2026-56232 |
high | 8.7 | 0.0034 | 2026-10-29 | Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on | |
CVE-2026-56244 |
high | 7.1 | 0.0024 | 2026-10-29 | Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supaba | |
CVE-2026-56245 |
high | 8.8 | 0.0034 | 2026-10-29 | Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECUR | |
CVE-2026-56256 |
high | 7.1 | 0.0030 | 2026-10-29 | Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. S | |
CVE-2026-35025 |
high | 8.6 | 0.0050 | 2026-10-29 | ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that | |
CVE-2026-42450 |
high | 8.4 | 0.0018 | 2026-10-29 | OpenColorIO is a color management framework for visual effects and animation. Prior to ver | |
CVE-2026-57280 |
high | 8.8 | 0.0051 | 2026-10-29 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the impli | |
CVE-2026-57296 |
high | 8.8 | 0.0083 | 2026-10-29 | Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal | |
CVE-2026-57301 |
high | 8.8 | 0.0063 | 2026-10-29 | Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins contro | |
CVE-2026-57303 |
high | 7.1 | 0.0036 | 2026-10-29 | Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML e | |
CVE-2026-11878 |
high | 8.2 | 0.0022 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-12986 |
high | 7.3 | 0.0027 | 2026-10-29 | A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, | |
CVE-2026-55488 |
high | 7.7 | 0.0060 | 2026-10-29 | motionEye (mEye) is an online interface for a piece of software called "motion," which is |