Browse All CVEs
3,594 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-64767 |
critical | 9.8 | 0.0089 | 2026-10-29 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macO | |
CVE-2026-11756 |
critical | 10.0 | 0.0081 | 2026-10-29 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPE | |
CVE-2026-16462 |
critical | 9.3 | 0.0075 | 2026-10-29 | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a re | |
CVE-2026-65880 |
critical | 10.0 | 0.0077 | 2026-10-29 | Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < | |
CVE-2026-66713 |
critical | 9.8 | 0.0172 | 2026-10-29 | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in | |
CVE-2026-59726 |
critical | 10.0 | 0.0302 | 2026-10-29 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default | |
CVE-2026-54003 |
critical | 9.1 | 0.0074 | 2026-10-29 | Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby si | |
CVE-2026-58122 |
critical | 9.3 | 0.0037 | 2026-10-29 | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows u | |
CVE-2026-58123 |
critical | 9.3 | 0.0465 | 2026-10-29 | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerabili | |
CVE-2026-28564 |
critical | 9.8 | 0.0068 | 2026-10-29 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in | |
CVE-2026-40005 |
critical | 9.1 | 0.0054 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-40008 |
critical | 9.8 | 0.0060 | 2026-10-29 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnera | |
CVE-2026-15378 |
critical | 9.3 | 0.0053 | 2026-10-29 | A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remo | |
CVE-2026-41880 |
critical | 9.0 | 0.0133 | 2026-10-29 | R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR | |
CVE-2026-56688 |
critical | 9.1 | 0.0200 | 2026-10-29 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of | |
CVE-2026-56261 |
critical | 9.2 | 0.0051 | 2026-10-29 | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the D | |
CVE-2026-59792 |
critical | 9.8 | 0.0060 | 2026-10-29 | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in p | |
CVE-2026-61444 |
critical | 9.4 | 0.0050 | 2026-10-29 | PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py w | |
CVE-2026-15143 |
critical | 9.3 | 0.0054 | 2026-10-29 | A flaw was found in the file_type content detector of guardrails-detectors. This vulnerabi | |
CVE-2026-55500 |
critical | 9.9 | 0.0048 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoin | |
CVE-2026-51119 |
critical | 9.1 | 0.0054 | 2026-10-29 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the | |
CVE-2026-58492 |
critical | 9.2 | 0.0053 | 2026-10-29 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableEx | |
CVE-2026-2397 |
critical | 9.8 | 0.0048 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-59151 |
critical | 9.6 | 0.0053 | 2026-10-29 | Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow | |
CVE-2026-5801 |
critical | 9.8 | 0.0058 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-61459 |
critical | 9.3 | 0.0236 | 2026-10-29 | MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structu | |
CVE-2026-57211 |
critical | 10.0 | 0.0063 | 2026-10-29 | RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the Ra | |
CVE-2026-57216 |
critical | 10.0 | 0.0050 | 2026-10-29 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, | |
CVE-2026-57807 |
critical | 9.8 | 0.0073 | 2026-10-29 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Secur | |
CVE-2026-9726 |
critical | 9.8 | 0.0056 | 2026-10-29 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabili | |
CVE-2026-10768 |
critical | 9.8 | 0.0213 | 2026-10-29 | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. | |
CVE-2026-12535 |
critical | 9.8 | 0.0056 | 2026-10-29 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabili | |
CVE-2026-55884 |
critical | 9.2 | 0.0050 | 2026-10-29 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 thr | |
CVE-2026-11913 |
critical | 9.8 | 0.0056 | 2026-10-29 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *. | |
CVE-2026-15089 |
critical | 9.1 | 0.0040 | 2026-10-29 | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest reg | |
CVE-2026-20744 |
critical | 9.3 | 0.0076 | 2026-10-29 | The charging station websocket endpoint accepts connections without proper authentication | |
CVE-2026-57827 |
critical | 10.0 | 0.0233 | 2026-10-29 | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17. | |
CVE-2026-57828 |
critical | 9.0 | 0.0054 | 2026-10-29 | Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1 | |
CVE-2026-61445 |
critical | 9.4 | 0.0064 | 2026-10-29 | PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilitie | |
CVE-2026-61447 |
critical | 10.0 | 0.1524 | 2026-10-29 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execu | |
CVE-2026-56271 |
critical | 9.3 | 0.0066 | 2026-10-29 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JW | |
CVE-2026-61876 |
critical | 9.4 | 0.0162 | 2026-10-29 | LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status ta | |
CVE-2026-10666 |
critical | 9.8 | 0.0065 | 2026-10-29 | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the f | |
CVE-2026-14453 |
critical | 9.6 | 0.0084 | 2026-10-29 | This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centr | |
CVE-2026-13014 |
critical | 9.2 | 0.0070 | 2026-10-29 | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unaut | |
CVE-2026-22093 |
critical | 9.5 | 0.0026 | 2026-10-29 | The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not valid | |
CVE-2026-22095 |
critical | 9.3 | 0.0139 | 2026-10-29 | The network diagnosis endpoint on the web server at port 8090 is vulnerable to command inj | |
CVE-2026-22096 |
critical | 9.3 | 0.0055 | 2026-10-29 | The webserver running on port 8090 does not require authentication. This allows for sensit | |
CVE-2026-22097 |
critical | 9.3 | 0.0033 | 2026-10-29 | The firmware update mechanism does not include cryptographic signature validation. This al | |
CVE-2026-22098 |
critical | 9.2 | 0.0043 | 2026-10-29 | Various sensitive information such as passwords and charging card UIDs are written to log |