Browse All CVEs
13,117 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-116864 |
high | 7.2 | 0.0030 | 2026-10-29 | Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. | |
CVE-2026-116865 |
high | 7.2 | 0.0030 | 2026-10-29 | Editor PHP Object Injection in Zippy <= 1.7.0 versions. | |
CVE-2026-114148 |
high | 7.8 | 0.0036 | 2026-10-29 | 1 PoC | Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate pri |
CVE-2026-108494 |
high | 7.1 | 0.0019 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions. | |
CVE-2026-107328 |
high | 8.8 | 0.0082 | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execu |
CVE-2026-107329 |
high | 8.8 | 0.0082 | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execu |
CVE-2026-107327 |
high | 8.8 | 0.0066 | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execu |
CVE-2026-107326 |
high | 8.8 | 0.0069 | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execu |
CVE-2026-104324 |
high | 8.8 | 0.0065 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execu | |
CVE-2026-104328 |
high | 8.8 | 0.0069 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execu | |
CVE-2026-103092 |
high | 8.8 | 0.0037 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execu | |
CVE-2026-102590 |
high | 7.7 | 0.0024 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtai | |
CVE-2026-101288 |
high | 8.8 | 0.0069 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execu | |
CVE-2026-86016 |
high | 8.2 | 0.0028 | 2026-10-29 | VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerH | |
CVE-2026-104875 |
high | 7.1 | 0.0041 | 2026-10-29 | Ente provides end-to-end encrypted cloud services and security tools. Prior to server imag | |
CVE-2026-107020 |
high | 7.5 | 0.0058 | 2026-10-29 | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader ver | |
CVE-2026-92982 |
high | 8.5 | 0.0047 | 2026-10-29 | A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit | |
CVE-2026-115713 |
high | 7.5 | 0.0016 | 2026-10-29 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud E | |
CVE-2026-115708 |
high | 7.2 | 0.0018 | 2026-10-29 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud E | |
CVE-2026-115709 |
high | 8.2 | 0.0026 | 2026-10-29 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud E | |
CVE-2026-2100 |
high | 7.5 | 0.0131 | 2026-10-29 | A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling | |
CVE-2026-11837 |
high | 7.3 | 0.0016 | 2026-10-29 | 1 PoC | A local privilege escalation vulnerability was found in the ansible.posix authorized_key m |
CVE-2026-113170 |
high | 8.8 | 0.0037 | 2026-10-29 | Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a | |
CVE-2026-113180 |
high | 8.8 | 0.0042 | 2026-10-29 | Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 | |
CVE-2026-39736 |
high | 8.5 | 0.0031 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-61611 |
high | 7.5 | 0.0045 | 2026-10-29 | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::u | |
CVE-2026-73261 |
high | 7.5 | 0.0042 | 2026-10-29 | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP | |
CVE-2026-100353 |
high | 7.5 | 0.0034 | 2026-10-29 | kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three | |
CVE-2026-55786 |
high | 8.4 | 0.0041 | 2026-10-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 unti | |
CVE-2026-92158 |
high | 7.2 | 0.0086 | 2026-10-29 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and oth | |
CVE-2026-100413 |
high | 7.0 | 0.0037 | 2026-10-29 | SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, th | |
CVE-2026-116399 |
high | 8.8 | 0.0017 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect | |
CVE-2026-119052 |
high | 8.7 | 0.0061 | 2026-10-29 | llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc | |
CVE-2026-119051 |
high | 8.2 | 0.0032 | 2026-10-29 | flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten | |
CVE-2026-119049 |
high | 7.2 | 0.0039 | 2026-10-29 | FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authentic | |
CVE-2019-25781 |
high | 8.7 | 0.0042 | 2026-10-29 | Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inl | |
CVE-2026-67615 |
high | 8.7 | 0.0054 | 2026-10-29 | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability | |
CVE-2026-94109 |
high | 8.6 | 0.0078 | 2026-10-29 | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injectio | |
CVE-2026-49142 |
high | 8.7 | 0.0036 | 2026-10-29 | OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromi | |
CVE-2026-42693 |
high | 7.1 | 0.0018 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-101974 |
high | 7.1 | 0.0025 | 2026-10-29 | An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Netw | |
CVE-2026-101987 |
high | 7.1 | 0.0027 | 2026-10-29 | An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon | |
CVE-2026-97860 |
high | 8.4 | 0.0019 | 2026-10-29 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unq | |
CVE-2026-103665 |
high | 8.4 | 0.0019 | 2026-10-29 | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecu | |
CVE-2026-109822 |
high | 7.1 | 0.0031 | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with in | |
CVE-2026-119028 |
high | 8.7 | 0.0042 | 2026-10-29 | oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attack | |
CVE-2026-119027 |
high | 7.7 | 0.0039 | 2026-10-29 | oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attack | |
CVE-2026-96767 |
high | 7.2 | 0.0042 | 2026-10-29 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to | |
CVE-2026-115821 |
high | 7.2 | 0.0030 | 2026-10-29 | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' | |
CVE-2026-119025 |
high | 7.7 | 0.0145 | 2026-10-29 | 1 PoC | open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attack |