Browse All CVEs
3,593 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-71362 |
critical | 9.1 | 0.9049 | 2026-10-29 | KEV | Adobe Commerce and Magento contains an incorrect authorization vulnerability that could al |
CVE-2026-71398 |
critical | 10.0 | 0.0117 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-73090 |
critical | 9.3 | 0.0040 | 2026-10-29 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpda | |
CVE-2026-73211 |
critical | 9.8 | 0.0073 | 2026-10-29 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollow | |
CVE-2026-18691 |
critical | 9.0 | 0.0036 | 2026-10-29 | An issue in MongoDB Server's intra-cluster connection setup could allow a party with suita | |
CVE-2026-72742 |
critical | 9.2 | 0.0051 | 2026-10-29 | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output fiel | |
CVE-2026-45618 |
critical | 10.0 | 0.0082 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, i | |
CVE-2026-66145 |
critical | 9.1 | 0.0066 | 2026-10-29 | An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build | |
CVE-2026-73032 |
critical | 9.4 | 0.0056 | 2026-10-29 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows atta | |
CVE-2026-73034 |
critical | 9.3 | 0.0570 | 2026-10-29 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote | |
CVE-2026-48765 |
critical | 9.9 | 0.0046 | 2026-10-29 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read col | |
CVE-2026-66147 |
critical | 9.4 | 0.0176 | 2026-10-29 | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Se | |
CVE-2026-71290 |
critical | 9.1 | 0.0033 | 2026-10-29 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or ne | |
CVE-2026-70398 |
critical | 9.6 | 0.0052 | 2026-10-29 | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Manag | |
CVE-2026-72526 |
critical | 9.9 | 0.0070 | 2026-10-29 | A flaw was found in the multicloud-integrations component. The Application propagation con | |
CVE-2026-66659 |
critical | 9.3 | 0.0040 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-67282 |
critical | 10.0 | 0.0078 | 2026-10-29 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 | |
CVE-2026-26035 |
critical | 9.8 | 0.0075 | 2026-10-29 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0. | |
CVE-2026-57858 |
critical | 9.3 | 0.0037 | 2026-10-29 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnera | |
CVE-2026-67285 |
critical | 9.2 | 0.0051 | 2026-10-29 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in | |
CVE-2026-50561 |
critical | 9.4 | 0.0068 | 2026-10-29 | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent developme | |
CVE-2026-73263 |
critical | 9.9 | 0.0065 | 2026-10-29 | Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection | |
CVE-2026-64639 |
critical | 9.3 | 0.0055 | 2026-10-29 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 al | |
CVE-2026-73294 |
critical | 9.9 | 0.0065 | 2026-10-29 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-bet | |
CVE-2026-18847 |
critical | 9.8 | 0.0025 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest cred | |
CVE-2026-73240 |
critical | 9.8 | 0.0104 | 2026-10-29 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This iss | |
CVE-2026-73296 |
critical | 9.4 | 0.0365 | 2026-10-29 | Microsoft UFO open-source framework for intelligent automation across devices and platform | |
CVE-2026-16860 |
critical | 9.9 | 0.0075 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitr | |
CVE-2026-16956 |
critical | 9.8 | 0.0086 | 2026-10-29 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary | |
CVE-2026-17218 |
critical | 9.8 | 0.0080 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due t | |
CVE-2026-17276 |
critical | 9.9 | 0.0047 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privi | |
CVE-2026-73299 |
critical | 10.0 | 0.0178 | 2026-10-29 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-bet | |
CVE-2026-17083 |
critical | 9.8 | 0.0080 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due t | |
CVE-2026-17111 |
critical | 9.8 | 0.0045 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send s | |
CVE-2026-19656 |
critical | 9.9 | 0.0052 | 2026-10-29 | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing an | |
CVE-2026-62420 |
critical | 9.9 | 0.0054 | 2026-10-29 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass ta | |
CVE-2026-63293 |
critical | 9.9 | 0.0059 | 2026-10-29 | A link following vulnerability in LXD allows an attacker to achieve arbitrary file read an | |
CVE-2026-63294 |
critical | 9.9 | 0.0088 | 2026-10-29 | A link following vulnerability in LXD allows an attacker to achieve root command execution | |
CVE-2026-63296 |
critical | 9.9 | 0.0044 | 2026-10-29 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass ta | |
CVE-2026-63297 |
critical | 9.9 | 0.0034 | 2026-10-29 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration mer | |
CVE-2026-63298 |
critical | 9.9 | 0.0069 | 2026-10-29 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance conf | |
CVE-2026-63299 |
critical | 9.9 | 0.0059 | 2026-10-29 | An authorization bypass vulnerability in LXD allows an authenticated user to bypass projec | |
CVE-2026-63300 |
critical | 9.9 | 0.0054 | 2026-10-29 | An improper validation vulnerability in the instancePostMigration function in lxd/instance | |
CVE-2026-72508 |
critical | 9.9 | 0.0081 | 2026-10-29 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cl | |
CVE-2026-72789 |
critical | 9.2 | 0.0037 | 2026-10-29 | SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, tr | |
CVE-2026-72793 |
critical | 9.2 | 0.0031 | 2026-10-29 | SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/syst | |
CVE-2026-72794 |
critical | 9.2 | 0.0032 | 2026-10-29 | siyuan versions before v3.7.4 expose the session cookie signing key through the /api/syste | |
CVE-2026-72795 |
critical | 9.2 | 0.0031 | 2026-10-29 | SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in t | |
CVE-2026-72798 |
critical | 9.2 | 0.0043 | 2026-10-29 | SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAt | |
CVE-2026-72804 |
critical | 9.2 | 0.0043 | 2026-10-29 | SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLo |