Browse All CVEs
3,603 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-9193 |
critical | 9.9 | 0.0046 | 2026-10-29 | An improper privilege management vulnerability in the Hadoop integration of Progress MarkL | |
CVE-2026-9195 |
critical | 9.3 | 0.0065 | 2026-10-29 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server bef | |
CVE-2026-17617 |
critical | 9.8 | 0.0034 | 2026-10-29 | IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request F | |
CVE-2026-20267 |
critical | 9.0 | 0.0038 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-20272 |
critical | 9.8 | 0.0057 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-20303 |
critical | 9.9 | 0.0049 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-20304 |
critical | 9.9 | 0.0042 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-20310 |
critical | 9.1 | 0.0059 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-48168 |
critical | 10.0 | 0.0150 | 2026-10-29 | PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude G | |
CVE-2026-8470 |
critical | 9.1 | 0.0011 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0 | |
CVE-2026-9205 |
critical | 9.8 | 0.0030 | 2026-10-29 | IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_ | |
CVE-2026-71319 |
critical | 9.6 | 0.0063 | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools | |
CVE-2026-67531 |
critical | 9.3 | 0.0073 | 2026-10-29 | FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1. | |
CVE-2026-66909 |
critical | 9.8 | 0.0115 | 2026-10-29 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using na | |
CVE-2026-61466 |
critical | 9.1 | 0.0071 | 2026-10-29 | In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server acce | |
CVE-2026-63687 |
critical | 9.1 | 0.0028 | 2026-10-29 | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the aut | |
CVE-2026-65583 |
critical | 9.1 | 0.0028 | 2026-10-29 | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens withou | |
CVE-2026-68079 |
critical | 9.8 | 0.0068 | 2026-10-29 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be re | |
CVE-2026-12605 |
critical | 9.6 | 0.0043 | 2026-10-29 | In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSo | |
CVE-2026-5134 |
critical | 9.8 | 0.0048 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-64993 |
critical | 9.1 | 0.0024 | 2026-10-29 | Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerab | |
CVE-2026-28005 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versi | |
CVE-2026-28139 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. | |
CVE-2026-32327 |
critical | 9.1 | 0.0046 | 2026-10-29 | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any | |
CVE-2026-34191 |
critical | 9.1 | 0.0059 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-53975 |
critical | 9.3 | 0.0168 | 2026-10-29 | OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that al | |
CVE-2026-53976 |
critical | 9.3 | 0.0261 | 2026-10-29 | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints / | |
CVE-2026-54489 |
critical | 9.8 | 0.0062 | 2026-10-29 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, co | |
CVE-2026-65507 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. | |
CVE-2026-65508 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. | |
CVE-2026-65520 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | |
CVE-2026-65546 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | |
CVE-2026-65548 |
critical | 9.9 | 0.0079 | 2026-10-29 | Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. | |
CVE-2026-65552 |
critical | 9.8 | 0.0056 | 2026-10-29 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | |
CVE-2026-65553 |
critical | 10.0 | 0.0086 | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 | |
CVE-2026-65556 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versio | |
CVE-2026-65571 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | |
CVE-2026-65572 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | |
CVE-2026-65573 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | |
CVE-2026-65574 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. | |
CVE-2026-65575 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. | |
CVE-2026-65576 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | |
CVE-2026-65577 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. | |
CVE-2026-65578 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | |
CVE-2026-65579 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | |
CVE-2026-65581 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. | |
CVE-2026-66447 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. | |
CVE-2026-66662 |
critical | 9.8 | 0.0055 | 2026-10-29 | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. | |
CVE-2026-66665 |
critical | 10.0 | 0.0052 | 2026-10-29 | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | |
CVE-2026-66709 |
critical | 9.1 | 0.0082 | 2026-10-29 | Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. |