Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-61864 |
low | 2.1 | 0.0010 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation t | |
CVE-2026-61863 |
low | 2.1 | 0.0019 | 2026-10-29 | ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF | |
CVE-2026-61862 |
low | 2.1 | 0.0010 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability | |
CVE-2026-61861 |
medium | 6.3 | 0.0055 | 2026-10-29 | ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCap | |
CVE-2026-61860 |
medium | 6.3 | 0.0035 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occ | |
CVE-2026-61859 |
medium | 4.8 | 0.0017 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnera | |
CVE-2026-61858 |
medium | 4.8 | 0.0025 | 2026-10-29 | ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and | |
CVE-2026-61857 |
medium | 6.3 | 0.0027 | 2026-10-29 | ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing | |
CVE-2026-61465 |
medium | 4.8 | 0.0017 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory alloca | |
CVE-2026-61464 |
low | 1.0 | 0.0009 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerab | |
CVE-2026-58660 |
high | 7.2 | 0.0050 | 2026-10-29 | Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used b | |
CVE-2026-58652 |
high | 7.7 | 0.0067 | 2026-10-29 | luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a Lu | |
CVE-2026-56379 |
critical | 9.2 | 0.0164 | 2026-10-29 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in th | |
CVE-2026-56378 |
medium | 6.3 | 0.0039 | 2026-10-29 | ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read | |
CVE-2026-56370 |
medium | 4.8 | 0.0018 | 2026-10-29 | ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedCom | |
CVE-2026-56369 |
medium | 6.3 | 0.0023 | 2026-10-29 | ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the Passke | |
CVE-2026-56362 |
low | 2.1 | 0.0019 | 2026-10-29 | ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixel | |
CVE-2026-56361 |
medium | 4.8 | 0.0013 | 2026-10-29 | ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing | |
CVE-2026-55202 |
high | 8.8 | 0.0038 | 2026-10-29 | Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host hea | |
CVE-2026-41401 |
medium | 6.9 | 0.0067 | 2026-10-29 | libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_ | |
CVE-2026-40037 |
high | 7.1 | 0.0032 | 2026-10-29 | OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuar | |
CVE-2026-35632 |
medium | 6.9 | 0.0042 | 2026-10-29 | OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and | |
CVE-2026-32989 |
high | 8.6 | 0.0022 | 2026-10-29 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allo | |
CVE-2026-22185 |
medium | 4.6 | 0.0015 | 2026-10-29 | OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to c | |
CVE-2026-109266 |
medium | 6.9 | 0.0029 | 2026-10-29 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerabili | |
CVE-2026-105215 |
critical | 9.3 | 0.0034 | 2026-10-29 | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hoste | |
CVE-2026-105212 |
high | 8.7 | 0.0032 | 2026-10-29 | ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the h | |
CVE-2026-105210 |
high | 8.8 | 0.0024 | 2026-10-29 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in | |
CVE-2026-105209 |
critical | 9.3 | 0.0022 | 2026-10-29 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnera | |
CVE-2026-105208 |
high | 8.7 | 0.0008 | 2026-10-29 | ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthent | |
CVE-2026-105207 |
critical | 9.3 | 0.0031 | 2026-10-29 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts a | |
CVE-2026-105206 |
medium | 5.3 | 0.0028 | 2026-10-29 | ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization fla | |
CVE-2026-105081 |
low | 2.0 | 0.0020 | 2026-10-29 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symboli | |
CVE-2026-104436 |
medium | 6.3 | 0.0027 | 2026-10-29 | Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows | |
CVE-2026-104085 |
high | 8.7 | 0.0199 | 2026-10-29 | odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that | |
CVE-2026-100834 |
high | 8.2 | 0.0032 | 2026-10-29 | http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions | |
CVE-2026-100725 |
high | 8.3 | 0.0024 | 2026-10-29 | http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 shi | |
CVE-2026-100724 |
medium | 6.3 | 0.0034 | 2026-10-29 | http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses | |
CVE-2026-100709 |
high | 7.7 | 0.0029 | 2026-10-29 | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_t | |
CVE-2025-71398 |
medium | 5.8 | 0.0033 | 2026-10-29 | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authen | |
CVE-2025-71397 |
high | 7.1 | 0.0055 | 2026-10-29 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated us | |
CVE-2025-71396 |
low | 2.3 | 0.0055 | 2026-10-29 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a defa | |
CVE-2025-71395 |
high | 7.1 | 0.0045 | 2026-10-29 | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::r | |
CVE-2025-71394 |
low | 2.3 | 0.0037 | 2026-10-29 | SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANAL | |
CVE-2025-71393 |
medium | 6.0 | 0.0046 | 2026-10-29 | SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits w | |
CVE-2025-71392 |
critical | 9.4 | 0.0044 | 2026-10-29 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escap | |
CVE-2025-71391 |
high | 7.1 | 0.0056 | 2026-10-29 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net mod | |
CVE-2025-71381 |
medium | 6.9 | 0.0029 | 2026-10-29 | Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to " | |
CVE-2025-71334 |
critical | 9.3 | 0.0436 | 2026-10-29 | Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing valida | |
CVE-2025-34509 |
high | 7.5 | 0.5625 | 2026-10-29 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. |