Browse All CVEs
3,594 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-72804 |
critical | 9.2 | 0.0043 | 2026-10-29 | SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLo | |
CVE-2026-73268 |
critical | 9.9 | 0.0088 | 2026-10-29 | A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). | |
CVE-2026-73269 |
critical | 9.9 | 0.0056 | 2026-10-29 | A flaw was found in the cluster-curator-controller component. A local user, by creating a | |
CVE-2026-73329 |
critical | 9.2 | 0.0042 | 2026-10-29 | CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated | |
CVE-2026-73332 |
critical | 9.2 | 0.0042 | 2026-10-29 | CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form | |
CVE-2026-73414 |
critical | 9.2 | 0.0089 | 2026-10-29 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEs | |
CVE-2026-10543 |
critical | 9.8 | 0.0039 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escala | |
CVE-2026-13433 |
critical | 9.6 | 0.0017 | 2026-10-29 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading | |
CVE-2026-19001 |
critical | 9.5 | 0.0054 | 2026-10-29 | The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer w | |
CVE-2026-66898 |
critical | 9.9 | 0.0059 | 2026-10-29 | A path traversal vulnerability in LXD allows an attacker to manipulate file system paths d | |
CVE-2026-10534 |
critical | 9.8 | 0.0038 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow | |
CVE-2026-18749 |
critical | 9.8 | 0.0051 | 2026-10-29 | The type=track branch authorises on _is_my_case(t_attach.case) only and never checks Vince | |
CVE-2026-71471 |
critical | 9.0 | 0.0122 | 2026-10-29 | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the | |
CVE-2026-73501 |
critical | 9.1 | 0.0043 | 2026-10-29 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandle | |
CVE-2026-73519 |
critical | 9.3 | 0.0124 | 2026-10-29 | WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into | |
CVE-2026-49481 |
critical | 9.6 | 0.0148 | 2026-10-29 | UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vuln | |
CVE-2026-71193 |
critical | 9.6 | 0.0053 | 2026-10-29 | In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, an | |
CVE-2026-16770 |
critical | 9.8 | 0.0073 | 2026-10-29 | PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via me | |
CVE-2026-49819 |
critical | 9.8 | 0.0108 | 2026-10-29 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing- | |
CVE-2026-59500 |
critical | 10.0 | 0.0050 | 2026-10-29 | : Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP | |
CVE-2026-59503 |
critical | 9.1 | 0.0043 | 2026-10-29 | : Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Persona | |
CVE-2026-59504 |
critical | 9.1 | 0.0043 | 2026-10-29 | : Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generat | |
CVE-2026-59506 |
critical | 9.3 | 0.0041 | 2026-10-29 | : Missing Authentication for Critical Function vulnerability in Priority Portal Generator | |
CVE-2026-59507 |
critical | 9.3 | 0.0034 | 2026-10-29 | : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Act | |
CVE-2026-73483 |
critical | 9.4 | 0.0062 | 2026-10-29 | Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox e | |
CVE-2026-73485 |
critical | 9.0 | 0.0060 | 2026-10-29 | Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node th | |
CVE-2026-73486 |
critical | 9.0 | 0.0066 | 2026-10-29 | Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's custo | |
CVE-2026-73487 |
critical | 9.0 | 0.0096 | 2026-10-29 | Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtab | |
CVE-2026-73601 |
critical | 9.0 | 0.0110 | 2026-10-29 | Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom | |
CVE-2026-73602 |
critical | 9.0 | 0.0083 | 2026-10-29 | Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox | |
CVE-2026-73608 |
critical | 9.2 | 0.0031 | 2026-10-29 | SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7. | |
CVE-2026-49827 |
critical | 9.8 | 0.0086 | 2026-10-29 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. | |
CVE-2026-27544 |
critical | 10.0 | 0.0086 | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | |
CVE-2026-28001 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | |
CVE-2026-28008 |
critical | 9.8 | 0.0061 | 2026-10-29 | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0. | |
CVE-2026-28142 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | |
CVE-2026-28148 |
critical | 9.8 | 0.0034 | 2026-10-29 | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | |
CVE-2026-28149 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | |
CVE-2026-28185 |
critical | 9.8 | 0.0027 | 2026-10-29 | Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. | |
CVE-2026-61962 |
critical | 10.0 | 0.0069 | 2026-10-29 | Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | |
CVE-2026-61966 |
critical | 9.3 | 0.0040 | 2026-10-29 | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. | |
CVE-2026-61967 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. | |
CVE-2026-61969 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. | |
CVE-2026-66424 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions. | |
CVE-2026-66436 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. | |
CVE-2026-66465 |
critical | 9.8 | 0.0061 | 2026-10-29 | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | |
CVE-2026-66472 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | |
CVE-2026-66478 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | |
CVE-2026-66691 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | |
CVE-2026-53790 |
critical | 9.2 | 0.0063 | 2026-10-29 | rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that a |