Browse All CVEs
10,479 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-116678 |
medium | 5.8 | 0.0033 | 2026-10-29 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the | |
CVE-2026-116679 |
medium | 5.4 | 0.0031 | 2026-10-29 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version | |
CVE-2026-116680 |
medium | 6.4 | 0.0019 | 2026-10-29 | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox vali | |
CVE-2026-117515 |
medium | 6.9 | 0.0041 | 2026-10-29 | A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d724203 | |
CVE-2026-117516 |
medium | 5.5 | 0.0041 | 2026-10-29 | A weakness has been identified in oretnom23 php-travel-agency-system. The affected element | |
CVE-2026-117526 |
medium | 4.8 | 0.0014 | 2026-10-29 | A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability | |
CVE-2026-16491 |
medium | 6.5 | 0.0029 | 2026-10-29 | Grafana’s RBAC service ignored the requested folder when checking whether a user was a fol | |
CVE-2026-87085 |
medium | 6.3 | 0.0021 | 2026-10-29 | Tanium addressed a SQL injection vulnerability in Provision. | |
CVE-2026-118173 |
medium | 6.1 | 0.0030 | 2026-10-29 | MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomp | |
CVE-2026-116684 |
medium | 6.8 | 0.0037 | 2026-10-29 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protoco | |
CVE-2026-116685 |
medium | 5.9 | 0.0040 | 2026-10-29 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protoco | |
CVE-2026-116686 |
medium | 6.5 | 0.0034 | 2026-10-29 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protoco | |
CVE-2026-116689 |
medium | 5.9 | 0.0027 | 2026-10-29 | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows red | |
CVE-2026-116691 |
medium | 6.5 | 0.0021 | 2026-10-29 | MLflow is an open source AI engineering platform for agents, large language models, and ma | |
CVE-2026-116694 |
medium | 6.3 | 0.0038 | 2026-10-29 | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, J | |
CVE-2026-116695 |
medium | 5.3 | 0.0035 | 2026-10-29 | Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Pr | |
CVE-2026-116773 |
medium | 4.3 | 0.0026 | 2026-10-29 | russh is a Rust SSH client and server library that includes an SSH agent protocol implemen | |
CVE-2026-116774 |
medium | 4.3 | 0.0026 | 2026-10-29 | russh is a Rust SSH client and server library that includes an SSH agent protocol implemen | |
CVE-2026-57192 |
medium | 6.0 | 0.0065 | 2026-10-29 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asteris | |
CVE-2026-57203 |
medium | 6.9 | 0.0014 | 2026-10-29 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asteris | |
CVE-2026-118128 |
medium | 6.9 | 0.0036 | 2026-10-29 | A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function | |
CVE-2026-118318 |
medium | 4.3 | 0.0020 | 2026-10-29 | Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote att | |
CVE-2026-118319 |
medium | 4.3 | 0.0017 | 2026-10-29 | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacke | |
CVE-2026-118322 |
medium | 4.3 | 0.0021 | 2026-10-29 | Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attack | |
CVE-2026-22063 |
medium | 6.0 | 0.0014 | 2026-10-29 | The private keys of eight eMudhra intermediate CA certificates have been compromised. eMud | |
CVE-2026-50571 |
medium | 5.7 | 0.0023 | 2026-10-29 | WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation | |
CVE-2026-58496 |
medium | 4.3 | 0.0021 | 2026-10-29 | Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.0.7 | |
CVE-2026-118271 |
medium | 5.3 | 0.0031 | 2026-10-29 | A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts | |
CVE-2026-118272 |
medium | 5.3 | 0.0025 | 2026-10-29 | A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function D | |
CVE-2013-20009 |
medium | 4.8 | 0.0022 | 2026-10-29 | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that | |
CVE-2026-105272 |
medium | 4.2 | 0.0018 | 2026-10-29 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting fu | |
CVE-2026-107625 |
medium | 6.4 | 0.0019 | 2026-10-29 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restric | |
CVE-2026-107745 |
medium | 4.2 | 0.0032 | 2026-10-29 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vuln | |
CVE-2026-109209 |
medium | 6.4 | 0.0021 | 2026-10-29 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted V | |
CVE-2026-109848 |
medium | 4.2 | 0.0022 | 2026-10-29 | GROWI contains an authorization bypass vulnerability in its tag update API and the page up | |
CVE-2026-109974 |
medium | 6.4 | 0.0019 | 2026-10-29 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted V | |
CVE-2026-115624 |
medium | 5.3 | 0.0022 | 2026-10-29 | GROWI contains a missing authorization check vulnerability in its collaborative editing fe | |
CVE-2026-117605 |
medium | 5.3 | 0.0026 | 2026-10-29 | nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin Prod | |
CVE-2026-117606 |
medium | 5.3 | 0.0028 | 2026-10-29 | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authentic | |
CVE-2026-117608 |
medium | 6.9 | 0.0014 | 2026-10-29 | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHe | |
CVE-2026-118273 |
medium | 5.3 | 0.0031 | 2026-10-29 | A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is | |
CVE-2026-118274 |
medium | 5.3 | 0.0031 | 2026-10-29 | A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue i | |
CVE-2026-118371 |
medium | 6.3 | 0.0014 | 2026-10-29 | LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendr | |
CVE-2026-118372 |
medium | 6.3 | 0.0014 | 2026-10-29 | LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attac | |
CVE-2026-118373 |
medium | 6.3 | 0.0009 | 2026-10-29 | LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because u | |
CVE-2026-118376 |
medium | 6.0 | 0.0027 | 2026-10-29 | WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedI | |
CVE-2026-118384 |
medium | 6.1 | 0.0032 | 2026-10-29 | GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c. | |
CVE-2026-111727 |
medium | 6.4 | 0.0021 | 2026-10-29 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site S | |
CVE-2026-118275 |
medium | 6.9 | 0.0043 | 2026-10-29 | A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function Dat | |
CVE-2026-118276 |
medium | 5.1 | 0.0024 | 2026-10-29 | A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affec |