Browse All CVEs
3,603 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-67261 |
critical | 9.8 | 0.0232 | 2026-10-29 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, co | |
CVE-2026-15734 |
critical | 9.8 | 0.0077 | 2026-10-29 | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and ear | |
CVE-2026-17032 |
critical | 9.8 | 0.0054 | 2026-10-29 | Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's c | |
CVE-2026-19149 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote | |
CVE-2026-19157 |
critical | 9.6 | 0.0038 | 2026-10-29 | Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a | |
CVE-2026-19164 |
critical | 9.6 | 0.0034 | 2026-10-29 | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 151.0.7922. | |
CVE-2026-19166 |
critical | 9.6 | 0.0039 | 2026-10-29 | Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a re | |
CVE-2026-19170 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remo | |
CVE-2026-19171 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remo | |
CVE-2026-19175 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attac | |
CVE-2026-43629 |
critical | 9.2 | 0.0070 | 2026-10-29 | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the K | |
CVE-2026-43631 |
critical | 9.2 | 0.0057 | 2026-10-29 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in | |
CVE-2026-43632 |
critical | 9.2 | 0.0048 | 2026-10-29 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in | |
CVE-2026-48085 |
critical | 9.8 | 0.0059 | 2026-10-29 | OpenReception's appointment booking software provides an end-to-end encrypted appointment | |
CVE-2026-48086 |
critical | 9.9 | 0.0044 | 2026-10-29 | OpenReception's appointment booking software provides an end-to-end encrypted appointment | |
CVE-2026-48087 |
critical | 9.8 | 0.0057 | 2026-10-29 | OpenReception's appointment booking software provides an end-to-end encrypted appointment | |
CVE-2026-48088 |
critical | 9.4 | 0.0038 | 2026-10-29 | OpenReception's appointment booking software provides an end-to-end encrypted appointment | |
CVE-2026-53983 |
critical | 9.2 | 0.0057 | 2026-10-29 | Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forger | |
CVE-2026-65400 |
critical | 9.8 | 0.0172 | 2026-10-29 | KEV | Apple macOS contains an improper authentication vulnerability that could allow an attacker |
CVE-2026-67688 |
critical | 9.8 | 0.0077 | 2026-10-29 | ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerabil | |
CVE-2026-70558 |
critical | 9.3 | 0.0082 | 2026-10-29 | Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path paramet | |
CVE-2026-50481 |
critical | 9.9 | 0.0082 | 2026-10-29 | Modification of assumed-immutable data (maid) in Azure Active Directory allows an authoriz | |
CVE-2026-50515 |
critical | 9.9 | 0.0169 | 2026-10-29 | Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to ex | |
CVE-2026-56161 |
critical | 9.6 | 0.0069 | 2026-10-29 | Improper access control in Azure Logic Apps allows an authorized attacker to disclose info | |
CVE-2026-56162 |
critical | 10.0 | 0.0090 | 2026-10-29 | Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate p | |
CVE-2026-59115 |
critical | 9.9 | 0.0102 | 2026-10-29 | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized atta | |
CVE-2026-59118 |
critical | 9.3 | 0.0072 | 2026-10-29 | Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privil | |
CVE-2026-62830 |
critical | 9.9 | 0.0078 | 2026-10-29 | Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileg | |
CVE-2026-62873 |
critical | 9.8 | 0.0061 | 2026-10-29 | Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an u | |
CVE-2026-62896 |
critical | 9.6 | 0.0069 | 2026-10-29 | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privil | |
CVE-2026-63508 |
critical | 10.0 | 0.0080 | 2026-10-29 | Missing authentication for critical function in Microsoft Planetary Computer Pro allows an | |
CVE-2026-65667 |
critical | 10.0 | 0.0080 | 2026-10-29 | Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privil | |
CVE-2026-68823 |
critical | 9.1 | 0.0093 | 2026-10-29 | Exposed dangerous method or function in Azure Confidential Ledger allows an authorized att | |
CVE-2026-70332 |
critical | 9.6 | 0.0086 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-54203 |
critical | 9.2 | 0.0056 | 2026-10-29 | Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's We | |
CVE-2026-54210 |
critical | 9.5 | 0.0066 | 2026-10-29 | Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functi | |
CVE-2026-54211 |
critical | 9.5 | 0.0064 | 2026-10-29 | Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html | |
CVE-2026-54212 |
critical | 9.5 | 0.0066 | 2026-10-29 | Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vu | |
CVE-2026-54213 |
critical | 9.2 | 0.0071 | 2026-10-29 | Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows t | |
CVE-2026-71558 |
critical | 9.8 | 0.0099 | 2026-10-29 | Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects | |
CVE-2026-71560 |
critical | 9.1 | 0.0077 | 2026-10-29 | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects A | |
CVE-2026-66914 |
critical | 9.2 | 0.0154 | 2026-10-29 | Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0 | |
CVE-2026-19264 |
critical | 9.3 | 0.0101 | 2026-10-29 | Postiz is an open-source social media scheduling tool. The route that serves locally store | |
CVE-2026-64637 |
critical | 9.9 | 0.0047 | 2026-10-29 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authen | |
CVE-2026-71851 |
critical | 9.0 | 0.0055 | 2026-10-29 | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0. | |
CVE-2026-48039 |
critical | 9.1 | 0.0059 | 2026-10-29 | Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads | |
CVE-2026-61808 |
critical | 9.8 | 0.0250 | 2026-10-29 | LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, t | |
CVE-2026-48170 |
critical | 9.1 | 0.0040 | 2026-10-29 | `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype p | |
CVE-2026-71944 |
critical | 9.3 | 0.0317 | 2026-10-29 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71945 |
critical | 9.3 | 0.0317 | 2026-10-29 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 |