Browse All CVEs
3,601 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-52855 |
critical | 9.9 | 0.0051 | 2026-10-29 | Wings is the server control plane for Pterodactyl, a free, open-source game server managem | |
CVE-2026-54725 |
critical | 9.6 | 0.0045 | 2026-10-29 | vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection | |
CVE-2026-38711 |
critical | 9.8 | 0.0275 | 2026-10-29 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-38708 |
critical | 9.8 | 0.0275 | 2026-10-29 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-38713 |
critical | 9.8 | 0.0275 | 2026-10-29 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-51785 |
critical | 9.8 | 0.0115 | 2026-10-29 | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute ar | |
CVE-2026-68770 |
critical | 9.3 | 0.0091 | 2026-10-29 | sentence-transformers contains a security control bypass vulnerability that allows attacke | |
CVE-2026-68771 |
critical | 9.3 | 0.0115 | 2026-10-29 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDatase | |
CVE-2026-67324 |
critical | 9.3 | 0.0064 | 2026-10-29 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short | |
CVE-2026-67330 |
critical | 9.4 | 0.0060 | 2026-10-29 | @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and > | |
CVE-2026-67341 |
critical | 9.3 | 0.0054 | 2026-10-29 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL | |
CVE-2026-67342 |
critical | 9.3 | 0.0054 | 2026-10-29 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP hand | |
CVE-2026-8457 |
critical | 9.8 | 0.0070 | 2026-10-29 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass | |
CVE-2026-68582 |
critical | 9.3 | 0.0033 | 2026-10-29 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) | |
CVE-2026-65321 |
critical | 9.3 | 0.0077 | 2026-10-29 | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticate | |
CVE-2026-18588 |
critical | 9.3 | 0.0110 | 2026-10-29 | A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the func | |
CVE-2026-33591 |
critical | 10.0 | 0.0071 | 2026-10-29 | A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated | |
CVE-2026-2346 |
critical | 9.8 | 0.0051 | 2026-10-29 | Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mo | |
CVE-2026-18108 |
critical | 9.8 | 0.0031 | 2026-10-29 | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encry | |
CVE-2026-64827 |
critical | 9.3 | 0.0083 | 2026-10-29 | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, | |
CVE-2026-68584 |
critical | 9.2 | 0.0053 | 2026-10-29 | SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mo | |
CVE-2026-68586 |
critical | 9.2 | 0.0041 | 2026-10-29 | SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBa | |
CVE-2026-68587 |
critical | 9.2 | 0.0032 | 2026-10-29 | SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHe | |
CVE-2026-69083 |
critical | 9.9 | 0.0047 | 2026-10-29 | SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchA | |
CVE-2026-69084 |
critical | 9.9 | 0.0157 | 2026-10-29 | SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a | |
CVE-2026-69085 |
critical | 9.9 | 0.0139 | 2026-10-29 | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDoc | |
CVE-2026-9390 |
critical | 9.1 | 0.0050 | 2026-10-29 | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _ | |
CVE-2026-9487 |
critical | 9.1 | 0.0028 | 2026-10-29 | XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_si | |
CVE-2026-41452 |
critical | 9.3 | 0.0374 | 2026-10-29 | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middlewa | |
CVE-2026-48031 |
critical | 9.1 | 0.0063 | 2026-10-29 | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by Postgr | |
CVE-2026-52102 |
critical | 9.8 | 0.0294 | 2026-10-29 | An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8 | |
CVE-2026-46713 |
critical | 9.2 | 0.0028 | 2026-10-29 | Misskey is an open source, federated social media platform. Versions 12.37.0 and later, bu | |
CVE-2026-18667 |
critical | 9.3 | 0.0072 | 2026-10-29 | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elev | |
CVE-2026-48317 |
critical | 9.6 | 0.0094 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dy | |
CVE-2026-48323 |
critical | 10.0 | 0.0137 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-48326 |
critical | 9.9 | 0.0097 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-48330 |
critical | 10.0 | 0.0104 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-48331 |
critical | 10.0 | 0.0095 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerabi | |
CVE-2026-48333 |
critical | 9.8 | 0.0095 | 2026-10-29 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-18753 |
critical | 9.1 | 0.0044 | 2026-10-29 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd | |
CVE-2026-18754 |
critical | 9.1 | 0.0044 | 2026-10-29 | The product firmware contains an embedded, static RSA private key utilized by the Lighttpd | |
CVE-2026-14175 |
critical | 9.8 | 0.0052 | 2026-10-29 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Inform | |
CVE-2026-14804 |
critical | 9.1 | 0.0040 | 2026-10-29 | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consul | |
CVE-2026-15721 |
critical | 9.8 | 0.0029 | 2026-10-29 | Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics | |
CVE-2026-60007 |
critical | 9.1 | 0.0055 | 2026-10-29 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguis | |
CVE-2026-61514 |
critical | 9.3 | 0.0083 | 2026-10-29 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulne | |
CVE-2026-61515 |
critical | 9.3 | 0.0244 | 2026-10-29 | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command inj | |
CVE-2026-25289 |
critical | 9.6 | 0.0019 | 2026-10-29 | Memory Corruption when processing Device Capability Extended attributes in certain NAN Ser | |
CVE-2026-69098 |
critical | 9.3 | 0.0091 | 2026-10-29 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_co | |
CVE-2026-69110 |
critical | 9.3 | 0.0084 | 2026-10-29 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows u |