Browse All CVEs
13,136 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-56111 |
high | 8.3 | 0.0065 | 2026-10-29 | Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELIN | |
CVE-2026-13164 |
high | 8.8 | 0.0071 | 2026-10-29 | Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps/accounts/ | |
CVE-2026-44601 |
high | 7.5 | 0.0034 | 2026-10-29 | Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client cra | |
CVE-2026-44602 |
high | 7.5 | 0.0033 | 2026-10-29 | Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of orde | |
CVE-2026-41139 |
high | 8.8 | 0.0058 | 2026-10-29 | Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to be | |
CVE-2026-8063 |
high | 7.1 | 0.0023 | 2026-10-29 | An authenticated user can crash mongod when running $rankFusion or $scoreFusion with an em | |
CVE-2026-44406 |
high | 7.8 | 0.0016 | 2026-10-29 | ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewSer | |
CVE-2024-43384 |
high | 8.0 | 0.0034 | 2026-10-29 | A low privileged remote attacker can gain the root password due to improper removal of sen | |
CVE-2026-44407 |
high | 7.5 | 0.0027 | 2026-10-29 | A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, whi | |
CVE-2026-3953 |
high | 8.8 | 0.0034 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-41642 |
high | 7.5 | 0.0050 | 2026-10-29 | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming | |
CVE-2026-41643 |
high | 7.5 | 0.0054 | 2026-10-29 | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming | |
CVE-2026-42010 |
high | 7.1 | 0.0105 | 2026-10-29 | A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-S | |
CVE-2026-42285 |
high | 7.5 | 0.0042 | 2026-10-29 | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming | |
CVE-2026-41490 |
high | 8.3 | 0.0027 | 2026-10-29 | Dagster is an orchestration platform for the development, production, and observation of d | |
CVE-2026-41554 |
high | 7.1 | 0.0014 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-41505 |
high | 8.7 | 0.0026 | 2026-10-29 | RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to | |
CVE-2026-41688 |
high | 7.7 | 0.0023 | 2026-10-29 | Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 a | |
CVE-2026-42011 |
high | 7.4 | 0.0047 | 2026-10-29 | A flaw was found in gnutls. This vulnerability occurs because permitted name constraints w | |
CVE-2026-5786 |
high | 8.8 | 0.1120 | 2026-10-29 | An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1 | |
CVE-2026-6973 |
high | 7.2 | 0.3445 | 2026-10-29 | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability |
CVE-2026-41653 |
high | 7.0 | 0.0036 | 2026-10-29 | BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cro | |
CVE-2026-42214 |
high | 7.8 | 0.0024 | 2026-10-29 | Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, No | |
CVE-2026-33811 |
high | 7.5 | 0.0088 | 2026-10-29 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a | |
CVE-2026-33814 |
high | 7.5 | 0.0084 | 2026-10-29 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing C | |
CVE-2026-39820 |
high | 7.5 | 0.0078 | 2026-10-29 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to tr | |
CVE-2026-39836 |
high | 7.5 | 0.0063 | 2026-10-29 | The Dial and LookupPort functions panic on Windows when provided with an input containing | |
CVE-2026-42225 |
high | 8.2 | 0.0016 | 2026-10-29 | PJSIP is a free and open source multimedia communication library written in C. Prior to ve | |
CVE-2026-42047 |
high | 8.6 | 0.0038 | 2026-10-29 | Inngest is a platform for running event-driven and scheduled background functions with que | |
CVE-2026-42449 |
high | 8.5 | 0.0021 | 2026-10-29 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, pro | |
CVE-2026-26129 |
high | 7.5 | 0.0114 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in M36 | |
CVE-2026-26164 |
high | 7.5 | 0.0080 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in M36 | |
CVE-2026-33111 |
high | 7.5 | 0.0114 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in Cop | |
CVE-2026-34327 |
high | 8.2 | 0.0064 | 2026-10-29 | Externally controlled reference to a resource in another sphere in Microsoft Partner Cente | |
CVE-2026-40213 |
high | 7.4 | 0.0021 | 2026-10-29 | OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for m | |
CVE-2026-41105 |
high | 8.1 | 0.0083 | 2026-10-29 | Server-side request forgery (ssrf) in Azure Notification Service allows an authorized atta | |
CVE-2026-42826 |
high | 7.5 | 0.0084 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unaut | |
CVE-2026-8034 |
high | 7.9 | 0.0052 | 2026-10-29 | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise | |
CVE-2026-6411 |
high | 7.3 | 0.0016 | 2026-10-29 | This vulnerability, in the MAXHUB Pivot client application versions prior to v1.36.2, may | |
CVE-2026-42203 |
high | 8.6 | 0.0037 | 2026-10-29 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From | |
CVE-2026-42261 |
high | 7.1 | 0.0024 | 2026-10-29 | PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From versio | |
CVE-2026-42271 |
high | 8.7 | 0.9144 | 2026-10-29 | KEV | BerriAI LiteLLM contains a command injection vulnerability that could allow any authentica |
CVE-2026-42272 |
high | 7.8 | 0.0040 | 2026-10-29 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior | |
CVE-2026-42273 |
high | 7.8 | 0.0030 | 2026-10-29 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior | |
CVE-2026-42274 |
high | 7.8 | 0.0037 | 2026-10-29 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior | |
CVE-2026-42275 |
high | 8.7 | 0.0033 | 2026-10-29 | zrok is software for sharing web services, files, and network resources. Prior to version | |
CVE-2023-42344 |
high | 7.3 | 0.0234 | 2026-10-29 | Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive | |
CVE-2023-42346 |
high | 7.5 | 0.0023 | 2026-10-29 | Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host. | |
CVE-2026-42278 |
high | 8.8 | 0.0045 | 2026-10-29 | UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG St | |
CVE-2026-8137 |
high | 7.4 | 0.0046 | 2026-10-29 | A vulnerability has been found in Totolink X5000R 9.1.0u.6369_B20230113. This vulnerabilit |