Browse All CVEs
3,594 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-22102 |
critical | 9.3 | 0.0053 | 2026-10-29 | A POST request sent to a specific webserver endpoint can be used to write to arbitrary fil | |
CVE-2026-22103 |
critical | 9.3 | 0.0139 | 2026-10-29 | The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-41041 |
critical | 9.1 | 0.0060 | 2026-10-29 | URL path injection via unencoded user-supplied identifiers vulnerability in Apache Graviti | |
CVE-2026-57401 |
critical | 9.9 | 0.0055 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-57702 |
critical | 9.3 | 0.0045 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-57707 |
critical | 9.3 | 0.0040 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-57710 |
critical | 9.9 | 0.0048 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro | |
CVE-2026-57719 |
critical | 10.0 | 0.0052 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pr | |
CVE-2026-57724 |
critical | 9.8 | 0.0056 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injec | |
CVE-2026-57726 |
critical | 9.3 | 0.0040 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-57739 |
critical | 9.3 | 0.0040 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-57744 |
critical | 9.8 | 0.0056 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-ex | |
CVE-2026-57770 |
critical | 9.8 | 0.0056 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphoto | |
CVE-2026-57811 |
critical | 10.0 | 0.0056 | 2026-10-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realty | |
CVE-2026-57813 |
critical | 9.8 | 0.0048 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows | |
CVE-2026-59515 |
critical | 9.3 | 0.0040 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-59518 |
critical | 9.8 | 0.0056 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Ob | |
CVE-2026-12257 |
critical | 9.3 | 0.0070 | 2026-10-29 | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vuln | |
CVE-2026-60121 |
critical | 9.3 | 0.0330 | 2026-10-29 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in th | |
CVE-2026-61498 |
critical | 9.3 | 0.0401 | 2026-10-29 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in th | |
CVE-2026-6847 |
critical | 9.3 | 0.0088 | 2026-10-29 | Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication | |
CVE-2026-13221 |
critical | 9.1 | 0.0049 | 2026-10-29 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 | |
CVE-2026-57433 |
critical | 9.8 | 0.0047 | 2026-10-29 | Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a | |
CVE-2026-61462 |
critical | 9.2 | 0.0048 | 2026-10-29 | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index. | |
CVE-2026-61500 |
critical | 9.3 | 0.0191 | 2026-10-29 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-crypto | |
CVE-2026-6875 |
critical | 9.5 | 0.0143 | 2026-10-29 | ServiceNow has addressed a remote code execution vulnerability that was identified in the | |
CVE-2026-58409 |
critical | 9.1 | 0.0057 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authentic | |
CVE-2026-51821 |
critical | 9.8 | 0.0069 | 2026-10-29 | SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remo | |
CVE-2026-59801 |
critical | 9.3 | 0.0262 | 2026-10-29 | 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allow | |
CVE-2026-62327 |
critical | 9.3 | 0.0627 | 2026-10-29 | 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerab | |
CVE-2026-58102 |
critical | 9.1 | 0.0034 | 2026-10-29 | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a | |
CVE-2026-27690 |
critical | 9.1 | 0.0068 | 2026-10-29 | Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attack | |
CVE-2026-44747 |
critical | 9.9 | 0.0056 | 2026-10-29 | SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical | |
CVE-2026-44761 |
critical | 9.1 | 0.0050 | 2026-10-29 | SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample cre | |
CVE-2026-15183 |
critical | 9.2 | 0.0031 | 2026-10-29 | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflak | |
CVE-2026-59084 |
critical | 9.1 | 0.0051 | 2026-10-29 | Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements | |
CVE-2026-15043 |
critical | 9.8 | 0.0067 | 2026-10-29 | DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operat | |
CVE-2026-56451 |
critical | 10.0 | 0.0050 | 2026-10-29 | A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applica | |
CVE-2026-58319 |
critical | 9.1 | 0.0075 | 2026-10-29 | Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authe | |
CVE-2026-62422 |
critical | 9.8 | 0.0061 | 2026-10-29 | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 20 | |
CVE-2026-10577 |
critical | 10.0 | 0.0041 | 2026-10-29 | A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product ex | |
CVE-2026-62390 |
critical | 9.8 | 0.0069 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-62392 |
critical | 9.8 | 0.0248 | 2026-10-29 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | |
CVE-2026-10672 |
critical | 9.1 | 0.0058 | 2026-10-29 | subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fi | |
CVE-2026-15265 |
critical | 9.4 | 0.0056 | 2026-10-29 | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privi | |
CVE-2026-58479 |
critical | 9.2 | 0.0440 | 2026-10-29 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection | |
CVE-2026-55954 |
critical | 9.1 | 0.0051 | 2026-10-29 | Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows accoun | |
CVE-2026-59836 |
critical | 9.8 | 0.0022 | 2026-10-29 | A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7 | |
CVE-2026-60082 |
critical | 9.1 | 0.0065 | 2026-10-29 | DBI versions before 1.651 for Perl do not enforce statement handle consistency with the ro | |
CVE-2026-62643 |
critical | 10.0 | 0.0029 | 2026-10-29 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sh |