Browse All CVEs
50,488 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-122140 |
medium | 6.3 | 0.0035 | 2026-11-04 | Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows | |
CVE-2026-122139 |
medium | 6.9 | 0.0035 | 2026-11-04 | blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability | |
CVE-2026-122138 |
medium | 6.3 | 0.0033 | 2026-11-04 | BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vuln | |
CVE-2026-122137 |
medium | 5.4 | 0.0011 | 2026-11-04 | Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the | |
CVE-2026-122136 |
medium | 4.1 | 0.0012 | 2026-11-04 | Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_insta | |
CVE-2026-122135 |
high | 8.6 | 0.0047 | 2026-11-04 | Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attac | |
CVE-2026-122134 |
high | 8.6 | 0.0047 | 2026-11-04 | Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows atta | |
CVE-2026-122133 |
high | 8.6 | 0.0037 | 2026-11-04 | Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that | |
CVE-2026-122132 |
medium | 5.1 | 0.0027 | 2026-11-04 | go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlas | |
CVE-2026-122131 |
medium | 6.3 | 0.0033 | 2026-11-04 | Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnera | |
CVE-2026-122130 |
high | 8.3 | 0.0032 | 2026-11-04 | CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forw | |
CVE-2026-122129 |
medium | 6.9 | 0.0040 | 2026-11-04 | CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decod | |
CVE-2026-122127 |
high | 8.7 | 0.0039 | 2026-11-04 | CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cp | |
CVE-2026-122126 |
high | 8.2 | 0.0037 | 2026-11-04 | reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket: | |
CVE-2026-122009 |
medium | 5.5 | 0.0050 | 2026-11-04 | A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the func | |
CVE-2026-121969 |
high | 7.1 | 0.0034 | 2026-11-04 | netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in ha | |
CVE-2026-121968 |
high | 7.1 | 0.0032 | 2026-11-04 | Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c ha | |
CVE-2026-102339 |
high | 8.2 | 0.0029 | 2026-11-04 | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. P | |
CVE-2025-71457 |
critical | 9.3 | 0.0044 | 2026-11-04 | vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows u | |
CVE-2025-71456 |
high | 8.6 | 0.0026 | 2026-11-04 | vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated l | |
CVE-2025-71455 |
medium | 5.9 | 0.0034 | 2026-11-04 | vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows | |
CVE-2025-71454 |
medium | 6.9 | 0.0019 | 2026-11-04 | vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csr | |
CVE-2025-71453 |
medium | 5.1 | 0.0024 | 2026-11-04 | vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/ | |
CVE-2026-102664 |
high | 7.1 | 0.0030 | 2026-11-04 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.1 | |
CVE-2026-102340 |
high | 8.5 | 0.0028 | 2026-11-04 | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. P | |
CVE-2026-122013 |
critical | 9.3 | 0.0082 | 2026-11-04 | A vulnerability was detected in Comfast CF-WR632AX 2.6.0.1. Affected by this vulnerability | |
CVE-2026-115758 |
high | 8.2 | 0.0014 | 2026-11-04 | SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet() i | |
CVE-2026-104203 |
high | 7.5 | 0.0080 | 2026-11-04 | Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's Med | |
CVE-2023-4853 |
high | 8.1 | 0.0228 | 2026-11-04 | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain charac | |
CVE-2026-97373 |
medium | 5.8 | 0.0024 | 2026-11-04 | draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the | |
CVE-2026-115762 |
medium | 6.1 | 0.0017 | 2026-11-04 | draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the | |
CVE-2026-18142 |
high | 7.1 | 0.0044 | 2026-11-04 | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.2 | |
CVE-2026-122220 |
critical | 9.1 | 0.0033 | 2026-11-04 | WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass | |
CVE-2026-113374 |
high | 8.6 | 0.0028 | 2026-11-04 | Sonatype Nexus Repository 3 does not require realm administration permission when a user c | |
CVE-2026-113373 |
critical | 9.1 | 0.0021 | 2026-11-04 | Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs | |
CVE-2026-113372 |
high | 7.1 | 0.0022 | 2026-11-04 | Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group reposi | |
CVE-2026-113371 |
high | 7.1 | 0.0022 | 2026-11-04 | Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, th | |
CVE-2026-113370 |
high | 7.7 | 0.0021 | 2026-11-04 | Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reinde | |
CVE-2026-113369 |
medium | 6.3 | 0.0024 | 2026-11-04 | Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI | |
CVE-2026-113368 |
medium | 5.3 | 0.0014 | 2026-11-04 | Sonatype Nexus Repository 3 does not check that a user account is authorized to access a r | |
CVE-2025-7203 |
medium | 4.9 | 0.0015 | 2026-11-04 | The Management Console and product files expose sensitive data, including remote log serve | |
CVE-2025-6623 |
medium | 4.3 | 0.0027 | 2026-11-04 | The carbon console accepts user-supplied XML input without sufficiently encoding potential | |
CVE-2025-13591 |
medium | 5.3 | 0.0030 | 2026-11-04 | The authentication endpoint of WSO2 Identity Server fails to provide a consistent system r | |
CVE-2025-13173 |
medium | 6.5 | 0.0019 | 2026-11-04 | Tokens associated with user sessions are not revoked when the corresponding user session i | |
CVE-2025-10149 |
high | 8.2 | 0.0018 | 2026-11-04 | The SCIM endpoint does not sufficiently validate authorization for federated users when pe | |
CVE-2026-12109 |
medium | 5.5 | 0.0021 | 2026-11-04 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 throu | |
CVE-2025-70521 |
critical | 9.8 | 0.0043 | 2026-11-04 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 doe | |
CVE-2025-70518 |
critical | 10.0 | 0.0056 | 2026-11-04 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 doe | |
CVE-2025-56565 |
high | 7.6 | 0.0019 | 2026-11-04 | DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive | |
CVE-2025-61478 |
high | 7.5 | 0.0046 | 2026-11-04 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a |