Browse All CVEs
13,100 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-72826 |
high | 8.7 | 0.0047 | 2026-10-29 | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a ne | |
CVE-2026-58652 |
high | 7.7 | 0.0067 | 2026-10-29 | luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a Lu | |
CVE-2026-58660 |
high | 7.2 | 0.0050 | 2026-10-29 | Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used b | |
CVE-2026-55202 |
high | 8.8 | 0.0038 | 2026-10-29 | Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host hea | |
CVE-2026-40037 |
high | 7.1 | 0.0031 | 2026-10-29 | OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuar | |
CVE-2026-32989 |
high | 8.6 | 0.0022 | 2026-10-29 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allo | |
CVE-2026-105210 |
high | 8.8 | 0.0024 | 2026-10-29 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in | |
CVE-2026-105212 |
high | 8.7 | 0.0032 | 2026-10-29 | ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the h | |
CVE-2026-105208 |
high | 8.7 | 0.0008 | 2026-10-29 | ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthent | |
CVE-2026-100834 |
high | 8.2 | 0.0032 | 2026-10-29 | http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions | |
CVE-2026-104085 |
high | 8.7 | 0.0199 | 2026-10-29 | odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that | |
CVE-2026-100725 |
high | 8.3 | 0.0024 | 2026-10-29 | http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 shi | |
CVE-2026-100709 |
high | 7.7 | 0.0029 | 2026-10-29 | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_t | |
CVE-2025-71397 |
high | 7.1 | 0.0055 | 2026-10-29 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated us | |
CVE-2025-71395 |
high | 7.1 | 0.0045 | 2026-10-29 | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::r | |
CVE-2025-71391 |
high | 7.1 | 0.0056 | 2026-10-29 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net mod | |
CVE-2025-34509 |
high | 7.5 | 0.5587 | 2026-10-29 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. | |
CVE-2025-34458 |
high | 8.7 | 0.0046 | 2026-10-29 | wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, c | |
CVE-2025-34506 |
high | 8.6 | 0.0091 | 2026-10-29 | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerabi | |
CVE-2025-34457 |
high | 8.7 | 0.0051 | 2026-10-29 | wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, c | |
CVE-2025-34023 |
high | 8.5 | 0.0158 | 2026-10-29 | A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. | |
CVE-2025-34108 |
high | 8.6 | 0.0144 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the login functionality of Disk Puls | |
CVE-2025-15620 |
high | 8.6 | 0.0052 | 2026-10-29 | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain | |
CVE-2024-58300 |
high | 8.7 | 0.0041 | 2026-10-29 | Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticated vulnera | |
CVE-2024-58276 |
high | 8.7 | 0.0041 | 2026-10-29 | Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword paramete | |
CVE-2024-23690 |
high | 7.2 | 0.0113 | 2026-10-29 | The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulner | |
CVE-2024-58275 |
high | 8.7 | 0.0180 | 2026-10-29 | Easywall 0.3.1 allows authenticated remote command execution via a command injection vulne | |
CVE-2023-53907 |
high | 7.1 | 0.0081 | 2026-10-29 | Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the | |
CVE-2023-53937 |
high | 8.5 | 0.0022 | 2026-10-29 | Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows | |
CVE-2018-25308 |
high | 8.7 | 0.0045 | 2026-10-29 | BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerabi | |
CVE-2017-20238 |
high | 7.1 | 0.0024 | 2026-10-29 | Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 c | |
CVE-2017-20243 |
high | 8.8 | 0.0026 | 2026-10-29 | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injectio | |
CVE-2026-119202 |
high | 7.5 | 0.0041 | 2026-10-29 | @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disp | |
CVE-2026-103314 |
high | 7.4 | 0.0040 | 2026-10-29 | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central | |
CVE-2026-119191 |
high | 7.5 | 0.0043 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in J | |
CVE-2026-119190 |
high | 7.4 | 0.0025 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in J | |
CVE-2026-102558 |
high | 8.6 | 0.0040 | 2026-10-29 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocke | |
CVE-2026-102559 |
high | 8.6 | 0.0042 | 2026-10-29 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very | |
CVE-2026-102556 |
high | 8.6 | 0.0028 | 2026-10-29 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocket | |
CVE-2026-102557 |
high | 8.6 | 0.0028 | 2026-10-29 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteA | |
CVE-2026-119194 |
high | 7.5 | 0.0043 | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container | |
CVE-2026-89059 |
high | 7.5 | 0.0089 | 2026-10-29 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image req | |
CVE-2026-119196 |
high | 7.5 | 0.0043 | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decod | |
CVE-2026-119195 |
high | 7.5 | 0.0053 | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indef | |
CVE-2026-119197 |
high | 7.5 | 0.0043 | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds | |
CVE-2026-92092 |
high | 7.4 | 0.0024 | 2026-10-29 | A flaw was found in openshift-ansible. The installer container's `run` script downloads an | |
CVE-2026-119188 |
high | 7.5 | 0.0041 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in J | |
CVE-2026-119187 |
high | 7.5 | 0.0041 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in J | |
CVE-2026-63889 |
high | 8.1 | 0.0036 | 2026-10-29 | In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_ | |
CVE-2026-119250 |
high | 7.8 | 0.0029 | 2026-10-29 | A malicious actor with local access and low privileges could exploit an External Control o |