Browse All CVEs
50,476 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-100493 |
medium | 6.9 | 0.0017 | 2026-11-03 | An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an atta | |
CVE-2026-107366 |
high | 8.3 | 0.0030 | 2026-11-03 | IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no own | |
CVE-2026-6719 |
high | 7.5 | 0.0034 | 2026-11-03 | IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that coul | |
CVE-2026-4413 |
medium | 6.1 | 0.0021 | 2026-11-03 | IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability al | |
CVE-2026-4405 |
low | 3.3 | 0.0014 | 2026-11-03 | IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read | |
CVE-2026-81648 |
critical | 10.0 | 0.0215 | 2026-11-03 | 1 PoC | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authoriza |
CVE-2026-92809 |
medium | 5.3 | 0.0035 | 2026-11-03 | PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries ar | |
CVE-2026-121449 |
high | 7.1 | 0.0040 | 2026-11-03 | Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() a | |
CVE-2026-121448 |
high | 8.7 | 0.0048 | 2026-11-03 | Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated u | |
CVE-2026-121447 |
medium | 5.3 | 0.0017 | 2026-11-03 | svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attac | |
CVE-2026-121446 |
medium | 5.3 | 0.0020 | 2026-11-03 | svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that | |
CVE-2026-121445 |
high | 8.2 | 0.0038 | 2026-11-03 | darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of | |
CVE-2026-121444 |
high | 8.7 | 0.0042 | 2026-11-03 | svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of servic | |
CVE-2026-121443 |
medium | 6.9 | 0.0030 | 2026-11-03 | svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allo | |
CVE-2026-121442 |
medium | 5.3 | 0.0018 | 2026-11-03 | Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenti | |
CVE-2026-121441 |
medium | 6.3 | 0.0022 | 2026-11-03 | Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request | |
CVE-2026-121440 |
medium | 6.3 | 0.0022 | 2026-11-03 | Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers a | |
CVE-2026-121439 |
medium | 6.9 | 0.0019 | 2026-11-03 | Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulne | |
CVE-2026-121438 |
medium | 6.9 | 0.0029 | 2026-11-03 | Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link | |
CVE-2026-121437 |
high | 8.7 | 0.0062 | 2026-11-03 | Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows rem | |
CVE-2026-121436 |
high | 8.6 | 0.0045 | 2026-11-03 | Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that all | |
CVE-2026-121435 |
medium | 5.3 | 0.0018 | 2026-11-03 | Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authentic | |
CVE-2026-121434 |
medium | 5.3 | 0.0016 | 2026-11-03 | Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add | |
CVE-2026-121433 |
medium | 5.1 | 0.0020 | 2026-11-03 | AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows | |
CVE-2026-121432 |
medium | 5.1 | 0.0019 | 2026-11-03 | AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege | |
CVE-2026-121431 |
medium | 6.9 | 0.0027 | 2026-11-03 | AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows s | |
CVE-2026-121430 |
medium | 5.3 | 0.0014 | 2026-11-03 | AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST | |
CVE-2026-121429 |
high | 8.7 | 0.0147 | 2026-11-03 | AzuraCast through 0.23.8 contains a command injection vulnerability that allows station us | |
CVE-2026-121428 |
high | 8.7 | 0.0074 | 2026-11-03 | AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authen | |
CVE-2026-121427 |
high | 8.7 | 0.0032 | 2026-11-03 | AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id | |
CVE-2026-121426 |
high | 8.3 | 0.0022 | 2026-11-03 | Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addresspa | |
CVE-2026-121425 |
high | 8.3 | 0.0032 | 2026-11-03 | Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an | |
CVE-2026-121424 |
high | 8.3 | 0.0034 | 2026-11-03 | Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addresspa | |
CVE-2026-121423 |
high | 7.1 | 0.0034 | 2026-11-03 | SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authentic | |
CVE-2026-121422 |
medium | 5.1 | 0.0025 | 2026-11-03 | SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability tha | |
CVE-2026-121421 |
medium | 5.3 | 0.0033 | 2026-11-03 | SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in netwo | |
CVE-2026-121420 |
medium | 4.8 | 0.0016 | 2026-11-03 | SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in | |
CVE-2026-121419 |
high | 8.6 | 0.0032 | 2026-11-03 | SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where | |
CVE-2026-121418 |
medium | 5.3 | 0.0020 | 2026-11-03 | SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that a | |
CVE-2026-121417 |
high | 8.8 | 0.0020 | 2026-11-03 | SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backen | |
CVE-2026-121416 |
high | 7.1 | 0.0031 | 2026-11-03 | SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style fu | |
CVE-2026-121415 |
medium | 6.3 | 0.0037 | 2026-11-03 | Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type va | |
CVE-2026-121414 |
high | 8.2 | 0.0033 | 2026-11-03 | Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serializati | |
CVE-2026-121413 |
low | 2.3 | 0.0031 | 2026-11-03 | Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypa | |
CVE-2026-121412 |
high | 7.1 | 0.0038 | 2026-11-03 | FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerabili | |
CVE-2026-121411 |
low | 2.3 | 0.0023 | 2026-11-03 | FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin i | |
CVE-2026-121410 |
medium | 5.3 | 0.0023 | 2026-11-03 | FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRET | |
CVE-2026-121409 |
high | 8.2 | 0.0033 | 2026-11-03 | FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious ser | |
CVE-2026-121408 |
medium | 6.0 | 0.0022 | 2026-11-03 | FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel beca | |
CVE-2026-121407 |
high | 7.1 | 0.0031 | 2026-11-03 | FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's re |