Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-119423 |
medium | 6.9 | 0.0038 | 2026-10-30 | OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthentic | |
CVE-2026-119422 |
high | 8.2 | 0.0024 | 2026-10-30 | Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that all | |
CVE-2026-119421 |
high | 8.2 | 0.0034 | 2026-10-30 | Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing aut | |
CVE-2026-119420 |
high | 8.7 | 0.0039 | 2026-10-30 | Lago through 1.55.0 contains an authentication bypass vulnerability that allows organizati | |
CVE-2026-119419 |
critical | 9.2 | 0.0039 | 2026-10-30 | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inj | |
CVE-2026-119418 |
critical | 9.2 | 0.0048 | 2026-10-30 | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inj | |
CVE-2026-119417 |
medium | 6.3 | 0.0045 | 2026-10-30 | CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 throu | |
CVE-2026-119416 |
medium | 6.3 | 0.0018 | 2026-10-30 | CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the H | |
CVE-2026-119415 |
medium | 6.3 | 0.0037 | 2026-10-30 | CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allow | |
CVE-2026-119414 |
medium | 5.3 | 0.0036 | 2026-10-30 | Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization b | |
CVE-2026-119409 |
high | 8.6 | 0.0248 | 2026-10-30 | OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticate | |
CVE-2026-119408 |
high | 8.7 | 0.0063 | 2026-10-30 | n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execu | |
CVE-2026-119407 |
high | 7.1 | 0.0014 | 2026-10-30 | Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment | |
CVE-2026-119379 |
high | 8.5 | 0.0028 | 2026-10-30 | SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vuln | |
CVE-2026-119378 |
medium | 6.8 | 0.0025 | 2026-10-30 | SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that | |
CVE-2026-119377 |
low | 2.0 | 0.0013 | 2026-10-30 | SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that i | |
CVE-2026-119376 |
medium | 6.8 | 0.0018 | 2026-10-30 | SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to by | |
CVE-2026-119375 |
medium | 6.8 | 0.0019 | 2026-10-30 | SQLite before 3.54.0 contains an information disclosure vulnerability that allows attacker | |
CVE-2026-119374 |
high | 8.5 | 0.0023 | 2026-10-30 | SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete | |
CVE-2026-119373 |
high | 8.5 | 0.0016 | 2026-10-30 | SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidList | |
CVE-2026-119372 |
medium | 6.8 | 0.0015 | 2026-10-30 | SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a us | |
CVE-2026-119371 |
medium | 6.8 | 0.0019 | 2026-10-30 | SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to by | |
CVE-2026-119364 |
medium | 6.0 | 0.0046 | 2026-10-30 | ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerabi | |
CVE-2026-119147 |
medium | 5.3 | 0.0029 | 2026-10-30 | ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the mod_sftp copy- | |
CVE-2026-119146 |
medium | 6.3 | 0.0046 | 2026-10-30 | ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_re | |
CVE-2025-68395 |
medium | 5.1 | 0.0025 | 2026-10-30 | ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable t | |
CVE-2025-68394 |
high | 8.4 | 0.0020 | 2026-10-30 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerabil | |
CVE-2025-68393 |
high | 8.4 | 0.0020 | 2026-10-30 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerabil | |
CVE-2025-68392 |
medium | 5.1 | 0.0017 | 2026-10-30 | ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of | |
CVE-2025-68391 |
medium | 5.3 | 0.0024 | 2026-10-30 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. A | |
CVE-2026-111505 |
high | 8.8 | 0.0148 | 2026-10-30 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization o | |
CVE-2026-101214 |
high | 7.2 | 0.0284 | 2026-10-30 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization o | |
CVE-2026-110972 |
high | 8.6 | 0.0021 | 2026-10-30 | Płatnik performs client-side authentication. An attacker with access to any application in | |
CVE-2026-110971 |
high | 7.7 | 0.0017 | 2026-10-30 | Use of a weak password encoding algorithm in Płatnik software allows a user who obtains en | |
CVE-2026-110970 |
low | 2.3 | 0.0034 | 2026-10-30 | Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an | |
CVE-2026-101213 |
high | 7.8 | 0.0013 | 2026-10-30 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Manage | |
CVE-2026-101210 |
high | 7.2 | 0.0284 | 2026-10-30 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization o | |
CVE-2026-116366 |
critical | 9.5 | 0.0096 | 2026-10-30 | 1 PoC | An issue has been discovered in ClickHouse Server that, under certain conditions, could al |
CVE-2026-110681 |
high | 8.1 | 0.0043 | 2026-10-30 | Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a | |
CVE-2026-110680 |
high | 7.5 | 0.0047 | 2026-10-30 | Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied o | |
CVE-2025-31704 |
critical | 9.8 | 0.0136 | 2026-10-30 | A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attack | |
CVE-2026-22114 |
medium | 5.3 | 0.0019 | 2026-10-30 | HTTP basic auth enforces no retry limit or backoff. Combined with the default service pass | |
CVE-2026-22110 |
high | 8.7 | 0.0024 | 2026-10-30 | The web server does not check authentication on POST or PUT. An unauthenticated attacker c | |
CVE-2026-22109 |
high | 8.4 | 0.0015 | 2026-10-30 | The shipped WebUI template database retains the factory default passwords for all five acc | |
CVE-2026-22105 |
high | 8.7 | 0.0019 | 2026-10-30 | Delta UFC500 charging stations derive the default credentials of the Service account from | |
CVE-2026-81726 |
high | 8.3 | 0.0034 | 2026-10-30 | NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that by | |
CVE-2024-9287 |
medium | 5.3 | 0.0065 | 2026-10-30 | A vulnerability has been found in the CPython `venv` module and CLI where path names provi | |
CVE-2026-112192 |
medium | 5.3 | 0.0037 | 2026-10-30 | MISP contains a vulnerability in the handling of module plugin settings. When the server r | |
CVE-2026-85268 |
high | 8.7 | 0.0058 | 2026-10-30 | A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Id | |
CVE-2026-14467 |
high | 8.2 | 0.0029 | 2026-10-30 | An information disclosure vulnerability in the Forocoches comments editor that allows an a |