Browse All CVEs
3,594 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-62644 |
critical | 9.8 | 0.0050 | 2026-10-29 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roun | |
CVE-2026-54433 |
critical | 10.0 | 0.0031 | 2026-10-29 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scri | |
CVE-2026-59891 |
critical | 9.6 | 0.0047 | 2026-10-29 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to | |
CVE-2026-15747 |
critical | 9.1 | 0.0025 | 2026-10-29 | Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the | |
CVE-2026-55010 |
critical | 9.8 | 0.0097 | 2026-10-29 | Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized at | |
CVE-2026-55944 |
critical | 9.8 | 0.0153 | 2026-10-29 | 1 PoC | Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacke |
CVE-2026-15409 |
critical | 10.0 | 0.0679 | 2026-10-29 | KEV | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that coul |
CVE-2026-47428 |
critical | 9.6 | 0.0058 | 2026-10-29 | Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, V | |
CVE-2026-48356 |
critical | 9.3 | 0.4458 | 2026-10-29 | KEV | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vuln |
CVE-2026-53633 |
critical | 9.8 | 0.0090 | 2026-10-29 | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-be | |
CVE-2026-15643 |
critical | 9.2 | 0.0039 | 2026-10-29 | AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol serv | |
CVE-2026-15773 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remot | |
CVE-2026-24227 |
critical | 9.8 | 0.0102 | 2026-10-29 | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of | |
CVE-2026-53486 |
critical | 9.1 | 0.0075 | 2026-10-29 | The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive | |
CVE-2026-38450 |
critical | 9.8 | 0.0104 | 2026-10-29 | An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execu | |
CVE-2026-45363 |
critical | 9.1 | 0.0036 | 2026-10-29 | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to | |
CVE-2026-13385 |
critical | 9.5 | 0.0014 | 2026-10-29 | An Improper Validation of Integrity Check Value and Improper Certificate Validation in cer | |
CVE-2026-61451 |
critical | 9.4 | 0.0031 | 2026-10-29 | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the cli | |
CVE-2026-61736 |
critical | 9.3 | 0.0142 | 2026-10-29 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the serv | |
CVE-2026-61740 |
critical | 9.3 | 0.0051 | 2026-10-29 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when Lig | |
CVE-2026-20156 |
critical | 9.8 | 0.0046 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-20157 |
critical | 9.8 | 0.0019 | 2026-10-29 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-52842 |
critical | 9.3 | 0.0025 | 2026-10-29 | Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpand | |
CVE-2026-52843 |
critical | 9.3 | 0.0023 | 2026-10-29 | Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpand | |
CVE-2026-62378 |
critical | 9.0 | 0.0042 | 2026-10-29 | RustFS Console is a web management console for the RustFS distributed file system. From 0. | |
CVE-2026-14960 |
critical | 9.8 | 0.0046 | 2026-10-29 | Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through | |
CVE-2026-50562 |
critical | 9.3 | 0.0021 | 2026-10-29 | FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040a | |
CVE-2026-46339 |
critical | 10.0 | 0.0276 | 2026-10-29 | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js mi | |
CVE-2026-49352 |
critical | 9.8 | 0.0060 | 2026-10-29 | 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcode | |
CVE-2026-51380 |
critical | 9.8 | 0.0050 | 2026-10-29 | Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to | |
CVE-2026-54052 |
critical | 9.9 | 0.0039 | 2026-10-29 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, pro | |
CVE-2026-54458 |
critical | 9.6 | 0.0038 | 2026-10-29 | WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM | |
CVE-2026-55445 |
critical | 9.3 | 0.0053 | 2026-10-29 | Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Ty | |
CVE-2026-15925 |
critical | 9.2 | 0.0018 | 2026-10-29 | Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7 | |
CVE-2026-22752 |
critical | 9.6 | 0.0048 | 2026-10-29 | Authentication bypass by primary weakness vulnerability in Spring Security Spring Authoriz | |
CVE-2026-63304 |
critical | 9.2 | 0.0173 | 2026-10-29 | AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlon | |
CVE-2026-63305 |
critical | 9.2 | 0.0177 | 2026-10-29 | AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php | |
CVE-2026-56453 |
critical | 9.8 | 0.0035 | 2026-10-29 | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerabilit | |
CVE-2026-54733 |
critical | 9.3 | 0.0088 | 2026-10-29 | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure A | |
CVE-2026-59864 |
critical | 9.3 | 0.0133 | 2026-10-29 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota p | |
CVE-2026-59865 |
critical | 9.3 | 0.0436 | 2026-10-29 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota i | |
CVE-2026-59866 |
critical | 9.3 | 0.0141 | 2026-10-29 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota em | |
CVE-2026-3031 |
critical | 9.8 | 0.0070 | 2026-10-29 | Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg libra | |
CVE-2026-45568 |
critical | 9.9 | 0.0054 | 2026-10-29 | zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, z | |
CVE-2026-57073 |
critical | 9.1 | 0.0065 | 2026-10-29 | HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The pars | |
CVE-2026-57074 |
critical | 9.1 | 0.0063 | 2026-10-29 | XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parse | |
CVE-2026-63087 |
critical | 9.3 | 0.0071 | 2026-10-29 | Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allow | |
CVE-2026-45336 |
critical | 10.0 | 0.0056 | 2026-10-29 | HireFlow is a web-based interview management system for managing candidates, scheduling in | |
CVE-2026-46512 |
critical | 9.9 | 0.0065 | 2026-10-29 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialpla | |
CVE-2026-46515 |
critical | 9.3 | 0.0057 | 2026-10-29 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ |