Browse All CVEs
50,472 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-120458 |
medium | 6.8 | 0.0016 | 2026-11-02 | Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encm | |
CVE-2026-120457 |
medium | 5.8 | 0.0024 | 2026-11-02 | libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/ | |
CVE-2026-120456 |
medium | 6.9 | 0.0016 | 2026-11-02 | L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr | |
CVE-2026-120455 |
medium | 6.9 | 0.0012 | 2026-11-02 | rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_ad | |
CVE-2026-120454 |
medium | 6.8 | 0.0012 | 2026-11-02 | The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs | |
CVE-2026-120453 |
medium | 4.8 | 0.0023 | 2026-11-02 | The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load | |
CVE-2026-120452 |
medium | 5.2 | 0.0019 | 2026-11-02 | libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl | |
CVE-2026-120451 |
high | 7.0 | 0.0022 | 2026-11-02 | libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilit | |
CVE-2026-120450 |
medium | 5.3 | 0.0024 | 2026-11-02 | LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that all | |
CVE-2026-120449 |
medium | 6.9 | 0.0044 | 2026-11-02 | Outline before 1.12.0 contains an improper access control vulnerability that allows unauth | |
CVE-2026-120448 |
high | 8.6 | 0.0036 | 2026-11-02 | DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api | |
CVE-2026-120447 |
critical | 9.2 | 0.0053 | 2026-11-02 | HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows una | |
CVE-2026-120446 |
high | 8.8 | 0.0104 | 2026-11-02 | madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the pla | |
CVE-2026-120445 |
high | 8.7 | 0.0036 | 2026-11-02 | madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in Acces | |
CVE-2026-120444 |
high | 7.2 | 0.0041 | 2026-11-02 | GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated | |
CVE-2026-120443 |
medium | 5.1 | 0.0027 | 2026-11-02 | GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows una | |
CVE-2026-120442 |
critical | 9.3 | 0.0171 | 2026-11-02 | ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows un | |
CVE-2026-120441 |
medium | 6.9 | 0.0050 | 2026-11-02 | OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() | |
CVE-2026-120440 |
medium | 6.9 | 0.0047 | 2026-11-02 | QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in qui | |
CVE-2026-120439 |
high | 8.3 | 0.0034 | 2026-11-02 | QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs. | |
CVE-2026-120438 |
high | 8.5 | 0.0014 | 2026-11-02 | QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() | |
CVE-2026-120437 |
medium | 6.9 | 0.0016 | 2026-11-02 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of | |
CVE-2026-120436 |
high | 8.5 | 0.0018 | 2026-11-02 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an intege | |
CVE-2026-120435 |
high | 8.5 | 0.0015 | 2026-11-02 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap bu | |
CVE-2026-120434 |
high | 8.5 | 0.0015 | 2026-11-02 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-b | |
CVE-2026-120433 |
high | 8.5 | 0.0018 | 2026-11-02 | Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-b | |
CVE-2026-120432 |
high | 8.5 | 0.0017 | 2026-11-02 | Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability | |
CVE-2026-120431 |
high | 8.5 | 0.0015 | 2026-11-02 | Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-ba | |
CVE-2026-120430 |
medium | 5.3 | 0.0028 | 2026-11-02 | Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Ad | |
CVE-2026-120429 |
high | 7.1 | 0.0035 | 2026-11-02 | Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaCo | |
CVE-2026-120428 |
medium | 5.1 | 0.0036 | 2026-11-02 | PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that | |
CVE-2026-120427 |
medium | 5.3 | 0.0025 | 2026-11-02 | MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view | |
CVE-2026-120426 |
high | 8.7 | 0.0040 | 2026-11-02 | OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the una | |
CVE-2026-120425 |
high | 7.1 | 0.0052 | 2026-11-02 | Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel | |
CVE-2026-120318 |
high | 8.6 | 0.0042 | 2026-11-02 | 1 PoC | Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 |
CVE-2025-71450 |
medium | 4.8 | 0.0013 | 2026-11-02 | inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c | |
CVE-2025-62819 |
medium | 6.5 | 0.0021 | 2026-11-02 | Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewin | |
CVE-2026-73697 |
high | 8.7 | 0.0181 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and | |
CVE-2026-73696 |
high | 8.6 | 0.0049 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect | |
CVE-2026-73695 |
high | 8.7 | 0.0095 | 2026-11-02 | Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerabili | |
CVE-2026-20707 |
medium | 6.8 | 0.0007 | 2026-11-02 | Hardware logic contains race conditions for some 3rd Gen Intel(R) Xeon(R) Scalable Process | |
CVE-2026-20702 |
high | 8.9 | 0.0032 | 2026-11-02 | Protection mechanism failure for some Intel(R) Data Center Attestation Primitives (Intel(R | |
CVE-2025-35987 |
medium | 4.3 | 0.0010 | 2026-11-02 | Omission of security-relevant information for some Intel(R) Software Guard Extensions Data | |
CVE-2026-87766 |
high | 8.8 | 0.0021 | 2026-11-02 | A flaw was found in bubblewrap. During sandbox setup, creating files or directories under | |
CVE-2026-111959 |
critical | 9.1 | 0.0055 | 2026-11-02 | Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 | |
CVE-2026-74993 |
high | 7.5 | 0.0038 | 2026-11-02 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-120463 |
medium | 6.0 | 0.0031 | 2026-11-02 | Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx | |
CVE-2026-114364 |
critical | 9.8 | 0.0045 | 2026-11-02 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-113687 |
critical | 9.8 | 0.0058 | 2026-11-02 | Improper isolation or compartmentalization vulnerability in Apache Syncope. An administ | |
CVE-2026-113511 |
critical | 9.1 | 0.0043 | 2026-11-02 | Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A del |