Browse All CVEs
3,593 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42537 |
critical | 9.8 | 0.0129 | 2026-10-29 | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommend | |
CVE-2026-44416 |
critical | 9.8 | 0.0124 | 2026-10-29 | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry componen | |
CVE-2026-55799 |
critical | 9.8 | 0.0122 | 2026-10-29 | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 | |
CVE-2026-72564 |
critical | 9.6 | 0.0044 | 2026-10-29 | An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authen | |
CVE-2026-72565 |
critical | 9.8 | 0.0068 | 2026-10-29 | A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remo | |
CVE-2026-72567 |
critical | 9.8 | 0.0079 | 2026-10-29 | An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f3 | |
CVE-2026-72569 |
critical | 9.1 | 0.0074 | 2026-10-29 | A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauth | |
CVE-2026-72575 |
critical | 9.1 | 0.0053 | 2026-10-29 | An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated | |
CVE-2026-72577 |
critical | 9.8 | 0.0127 | 2026-10-29 | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote | |
CVE-2026-72580 |
critical | 9.8 | 0.0165 | 2026-10-29 | An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows | |
CVE-2026-72589 |
critical | 9.8 | 0.0195 | 2026-10-29 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an u | |
CVE-2026-72590 |
critical | 9.8 | 0.0204 | 2026-10-29 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an u | |
CVE-2026-72592 |
critical | 9.8 | 0.0080 | 2026-10-29 | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauth | |
CVE-2026-72593 |
critical | 9.8 | 0.0079 | 2026-10-29 | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthent | |
CVE-2026-13206 |
critical | 9.8 | 0.0177 | 2026-10-29 | Improper neutralization of special elements used in an OS command ('OS command injection') | |
CVE-2026-63106 |
critical | 9.3 | 0.0050 | 2026-10-29 | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the | |
CVE-2026-47754 |
critical | 9.3 | 0.0047 | 2026-10-29 | Metacat is data repository software that helps researchers preserve, share, and discover d | |
CVE-2026-48158 |
critical | 9.3 | 0.0067 | 2026-10-29 | use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15: | |
CVE-2026-16626 |
critical | 9.3 | 0.0045 | 2026-10-29 | Improper restriction of XML external entity reference vulnerability (unauthenticated) in J | |
CVE-2026-48159 |
critical | 9.3 | 0.0067 | 2026-10-29 | use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 an | |
CVE-2026-48160 |
critical | 9.3 | 0.0067 | 2026-10-29 | react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and | |
CVE-2026-72911 |
critical | 9.9 | 0.0072 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and | |
CVE-2026-48161 |
critical | 9.3 | 0.0067 | 2026-10-29 | react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20: | |
CVE-2026-34265 |
critical | 9.8 | 0.0064 | 2026-10-29 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logica | |
CVE-2026-44758 |
critical | 9.1 | 0.0077 | 2026-10-29 | SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileg | |
CVE-2026-19425 |
critical | 9.3 | 0.0064 | 2026-10-29 | Travel Agency Management System developed by Win Men Intermational has a SQL Injection vul | |
CVE-2026-13716 |
critical | 9.1 | 0.0080 | 2026-10-29 | Path traversal in server import and admin file upload in Crafty Controller. Allows a remot | |
CVE-2026-10579 |
critical | 9.8 | 0.0046 | 2026-10-29 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would acce | |
CVE-2026-58231 |
critical | 10.0 | 0.0086 | 2026-10-29 | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication cl | |
CVE-2026-13737 |
critical | 9.2 | 0.0067 | 2026-10-29 | CommServe contained an allowlist bypass vulnerability affecting command execution authoriz | |
CVE-2026-13738 |
critical | 9.2 | 0.0067 | 2026-10-29 | CommServe contained an authorization bypass vulnerability affecting a limited set of comma | |
CVE-2026-72550 |
critical | 9.8 | 0.0061 | 2026-10-29 | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthen | |
CVE-2026-72599 |
critical | 9.8 | 0.0061 | 2026-10-29 | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to ex | |
CVE-2026-72603 |
critical | 9.9 | 0.0223 | 2026-10-29 | An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.crea | |
CVE-2026-18972 |
critical | 9.6 | 0.0035 | 2026-10-29 | An authenticated attacker can spoof another GUI user's identity by sending their request w | |
CVE-2026-58115 |
critical | 10.0 | 0.0095 | 2026-10-29 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All | |
CVE-2026-72785 |
critical | 9.3 | 0.0027 | 2026-10-29 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A co | |
CVE-2026-48046 |
critical | 9.3 | 0.0036 | 2026-10-29 | Streambert is a cross-platform Electron Desktop App to stream and download video content. | |
CVE-2026-48056 |
critical | 10.0 | 0.0055 | 2026-10-29 | Streambert is a cross-platform Electron Desktop App to stream and download video content. | |
CVE-2026-17061 |
critical | 10.0 | 0.0081 | 2026-10-29 | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from | |
CVE-2026-47702 |
critical | 9.1 | 0.0030 | 2026-10-29 | TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used | |
CVE-2026-73069 |
critical | 9.1 | 0.0066 | 2026-10-29 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, | |
CVE-2026-12571 |
critical | 9.8 | 0.0327 | 2026-10-29 | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows acco | |
CVE-2026-50516 |
critical | 9.4 | 0.0083 | 2026-10-29 | Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacke | |
CVE-2026-59124 |
critical | 9.8 | 0.0153 | 2026-10-29 | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allow | |
CVE-2026-69223 |
critical | 9.1 | 0.0078 | 2026-10-29 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue | |
CVE-2026-27302 |
critical | 10.0 | 0.0117 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-47705 |
critical | 9.6 | 0.0056 | 2026-10-29 | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the | |
CVE-2026-48381 |
critical | 9.0 | 0.0078 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-69102 |
critical | 9.3 | 0.0064 | 2026-10-29 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secre |