Browse All CVEs
3,594 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-53791 |
critical | 9.1 | 0.0050 | 2026-10-29 | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauth | |
CVE-2026-53793 |
critical | 9.1 | 0.0039 | 2026-10-29 | rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote cli | |
CVE-2026-70452 |
critical | 9.1 | 0.0046 | 2026-10-29 | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remot | |
CVE-2026-70460 |
critical | 9.2 | 0.0045 | 2026-10-29 | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious s | |
CVE-2026-67614 |
critical | 9.3 | 0.0096 | 2026-10-29 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal | |
CVE-2026-73567 |
critical | 9.1 | 0.0044 | 2026-10-29 | sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, | |
CVE-2026-73644 |
critical | 9.6 | 0.0041 | 2026-10-29 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorizat | |
CVE-2026-73649 |
critical | 9.8 | 0.0073 | 2026-10-29 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior t | |
CVE-2026-74880 |
critical | 9.3 | 0.0056 | 2026-10-29 | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in key | |
CVE-2026-74886 |
critical | 9.3 | 0.0068 | 2026-10-29 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where | |
CVE-2026-74890 |
critical | 9.3 | 0.0021 | 2026-10-29 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in Ca | |
CVE-2026-71479 |
critical | 9.1 | 0.0065 | 2026-10-29 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset mana | |
CVE-2026-50770 |
critical | 9.8 | 0.0061 | 2026-10-29 | An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate | |
CVE-2026-50772 |
critical | 9.8 | 0.0068 | 2026-10-29 | An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrar | |
CVE-2026-51346 |
critical | 9.1 | 0.0070 | 2026-10-29 | SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a | |
CVE-2026-74253 |
critical | 10.0 | 0.0032 | 2026-10-29 | Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user | |
CVE-2026-74254 |
critical | 9.3 | 0.0039 | 2026-10-29 | Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla ext | |
CVE-2026-50774 |
critical | 9.8 | 0.0061 | 2026-10-29 | An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the | |
CVE-2026-67678 |
critical | 9.8 | 0.0077 | 2026-10-29 | File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to | |
CVE-2026-47686 |
critical | 9.9 | 0.0058 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/se | |
CVE-2026-47698 |
critical | 9.8 | 0.0097 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup | |
CVE-2026-65974 |
critical | 9.9 | 0.0103 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and | |
CVE-2026-67967 |
critical | 9.8 | 0.0065 | 2026-10-29 | Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute | |
CVE-2026-75110 |
critical | 9.3 | 0.0066 | 2026-10-29 | MemOS is a memory operating system for LLMs and AI agents. In deployments where authentica | |
CVE-2026-64849 |
critical | 9.3 | 0.1002 | 2026-10-29 | KEV | MLflow contains a server-side request forgery vulnerability that can allow attackers to re |
CVE-2026-67960 |
critical | 9.8 | 0.0073 | 2026-10-29 | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberC | |
CVE-2026-71424 |
critical | 9.6 | 0.0049 | 2026-10-29 | Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mc | |
CVE-2026-38165 |
critical | 9.8 | 0.0087 | 2026-10-29 | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine conf | |
CVE-2026-67919 |
critical | 9.8 | 0.0093 | 2026-10-29 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginE | |
CVE-2026-15748 |
critical | 9.8 | 0.0409 | 2026-10-29 | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all ve | |
CVE-2026-34884 |
critical | 9.8 | 0.0069 | 2026-10-29 | SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache | |
CVE-2026-75626 |
critical | 9.3 | 0.0033 | 2026-10-29 | SpiderFoot fails to HTML-escape correlation titles built from external scan data sources i | |
CVE-2026-75627 |
critical | 9.3 | 0.0084 | 2026-10-29 | Bastillion fails to properly validate request URI paths in its controller dispatcher, allo | |
CVE-2026-74902 |
critical | 9.3 | 0.0020 | 2026-10-29 | SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload vali | |
CVE-2026-75827 |
critical | 9.3 | 0.0086 | 2026-10-29 | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic | |
CVE-2026-75828 |
critical | 9.3 | 0.0039 | 2026-10-29 | Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() | |
CVE-2026-75832 |
critical | 9.3 | 0.0030 | 2026-10-29 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 | |
CVE-2026-75835 |
critical | 9.3 | 0.0031 | 2026-10-29 | Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization v | |
CVE-2026-75837 |
critical | 9.3 | 0.0049 | 2026-10-29 | Grav before 2.0.14 fails to guard the access field in the core group blueprint with the re | |
CVE-2026-75843 |
critical | 9.4 | 0.0038 | 2026-10-29 | ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction e | |
CVE-2026-75851 |
critical | 9.4 | 0.0039 | 2026-10-29 | ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to pro | |
CVE-2026-75852 |
critical | 9.3 | 0.0066 | 2026-10-29 | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in th | |
CVE-2026-75854 |
critical | 9.3 | 0.0089 | 2026-10-29 | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redi | |
CVE-2026-74987 |
critical | 9.8 | 0.0072 | 2026-10-29 | Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. So | |
CVE-2026-74988 |
critical | 9.8 | 0.0061 | 2026-10-29 | Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs sho | |
CVE-2026-74989 |
critical | 9.8 | 0.0057 | 2026-10-29 | Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory | |
CVE-2026-74990 |
critical | 9.8 | 0.0072 | 2026-10-29 | Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 | |
CVE-2026-28192 |
critical | 9.6 | 0.0043 | 2026-10-29 | Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versio | |
CVE-2026-32444 |
critical | 9.9 | 0.0079 | 2026-10-29 | Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions. | |
CVE-2026-32463 |
critical | 9.9 | 0.0048 | 2026-10-29 | Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions. |