Browse All CVEs
50,486 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-52804 |
medium | 5.5 | 0.0050 | 2026-11-03 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collab | |
CVE-2026-51772 |
— | — | 0.0030 | 2026-11-03 | 1 PoC | A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenSta |
CVE-2026-50573 |
high | 8.1 | 0.0017 | 2026-11-03 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode | |
CVE-2026-50021 |
high | 8.1 | 0.0018 | 2026-11-03 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker s | |
CVE-2026-50014 |
high | 7.3 | 0.0032 | 2026-11-03 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm passes the lockfile-controlle | |
CVE-2026-49845 |
critical | 9.8 | 0.0089 | 2026-11-03 | SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before | |
CVE-2026-48613 |
medium | 5.9 | 0.0015 | 2026-11-03 | SQL injection vulnerability in phpBB profile field migration due to improper handling of u | |
CVE-2026-45434 |
— | — | 0.2126 | 2026-11-03 | Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leadi | |
CVE-2026-44420 |
high | 8.8 | 0.0456 | 2026-11-03 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, a malici | |
CVE-2026-42533 |
critical | 9.2 | 0.0630 | 2026-11-03 | 12 PoC | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex |
CVE-2026-40369 |
high | 7.8 | 0.0473 | 2026-11-03 | 8 PoC | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate priv |
CVE-2026-35160 |
medium | 5.0 | 0.0084 | 2026-11-03 | Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutrali | |
CVE-2026-35086 |
medium | 6.5 | 0.0050 | 2026-11-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in email services | |
CVE-2026-30872 |
critical | 9.5 | 0.0250 | 2026-11-03 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior | |
CVE-2026-30871 |
critical | 9.5 | 0.0136 | 2026-11-03 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior | |
CVE-2026-29783 |
high | 7.5 | 0.0047 | 2026-11-03 | The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow | |
CVE-2026-27876 |
critical | 9.1 | 0.0201 | 2026-11-03 | 2 PoC | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote |
CVE-2026-27688 |
medium | 5.0 | 0.0026 | 2026-11-03 | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an auth | |
CVE-2026-27612 |
medium | 6.1 | 0.0023 | 2026-11-03 | Repostat is a React component to fetch and display GitHub repository info. Prior to versio | |
CVE-2026-25941 |
high | 8.1 | 0.0033 | 2026-11-03 | FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branc | |
CVE-2026-25929 |
medium | 6.5 | 0.0030 | 2026-11-03 | OpenEMR is a free and open source electronic health records and medical practice managemen | |
CVE-2026-24531 |
high | 7.5 | 0.0055 | 2026-11-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote Fil | |
CVE-2026-24380 |
medium | 5.3 | 0.0022 | 2026-11-03 | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-mana | |
CVE-2026-24317 |
medium | 5.0 | 0.0021 | 2026-11-03 | SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the ap | |
CVE-2026-22356 |
high | 7.5 | 0.0057 | 2026-11-03 | 1 PoC | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote Fil |
CVE-2026-20968 |
medium | 6.7 | 0.0017 | 2026-11-03 | Use after free in DualDAR prior to SMR Jan-2026 Release 1 allows local privileged attacker | |
CVE-2026-20523 |
high | 8.4 | 0.0013 | 2026-11-03 | In neuropilot, there is a possible out of bounds write due to a missing bounds check. This | |
CVE-2026-1602 |
medium | 6.5 | 0.0083 | 2026-11-03 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authentic | |
CVE-2026-18444 |
medium | 6.6 | 0.0018 | 2026-11-03 | There is an integer conversion vulnerability resulting in an out-of-bounds read when loadi | |
CVE-2026-12489 |
medium | 6.5 | 0.0029 | 2026-11-03 | An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 | |
CVE-2026-101967 |
high | 8.8 | 0.0392 | 2026-11-03 | An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juni | |
CVE-2026-0403 |
low | 1.1 | 0.0033 | 2026-11-03 | An insufficient input validation vulnerability in NETGEAR Orbi routers allows attackers c | |
CVE-2026-0383 |
high | 8.2 | 0.0022 | 2026-11-03 | A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with pri | |
CVE-2025-9900 |
high | 8.8 | 0.0100 | 2026-11-03 | A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, trigger | |
CVE-2025-8904 |
critical | 9.0 | 0.0042 | 2026-11-03 | Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file i | |
CVE-2025-8405 |
high | 7.7 | 0.0053 | 2026-11-03 | GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 be | |
CVE-2025-8309 |
high | 8.1 | 0.0030 | 2026-11-03 | There is an improper privilege management vulnerability identified in ManageEngine's Asset | |
CVE-2025-6965 |
high | 7.2 | 0.7345 | 2026-11-03 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregat | |
CVE-2025-68596 |
medium | 5.3 | 0.0027 | 2026-11-03 | Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting In | |
CVE-2025-68586 |
medium | 5.3 | 0.0025 | 2026-11-03 | Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrect | |
CVE-2025-68584 |
medium | 4.3 | 0.0013 | 2026-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codefla | |
CVE-2025-68537 |
high | 7.5 | 0.0039 | 2026-11-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote Fil | |
CVE-2025-67920 |
high | 8.1 | 0.0048 | 2026-11-03 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote Fil | |
CVE-2026-121565 |
high | 7.4 | 0.0016 | 2026-11-03 | Tanium addressed an improper certificate validation vulnerability in multiple products. Pr | |
CVE-2026-121535 |
medium | 6.3 | 0.0052 | 2026-11-03 | A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability | |
CVE-2026-121520 |
medium | 4.5 | 0.0014 | 2026-11-03 | In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit cont | |
CVE-2026-120775 |
high | 7.2 | 0.0035 | 2026-11-03 | Tanium addressed a heap-based buffer overflow vulnerability in Deploy. | |
CVE-2026-116669 |
medium | 6.5 | 0.0025 | 2026-11-03 | Tanium addressed an improper access controls vulnerability in Discover. | |
CVE-2026-116667 |
medium | 4.2 | 0.0014 | 2026-11-03 | Tanium addressed an improper access controls vulnerability in Discover. | |
CVE-2026-116665 |
medium | 4.3 | 0.0022 | 2026-11-03 | Tanium addressed an information disclosure vulnerability in Discover. |