Browse All CVEs
10,484 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-106484 |
medium | 4.4 | 0.0012 | 2026-10-29 | Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to | |
CVE-2026-118259 |
medium | 5.3 | 0.0049 | 2026-10-29 | opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telem | |
CVE-2026-118263 |
medium | 6.3 | 0.0039 | 2026-10-29 | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can disc | |
CVE-2026-118265 |
medium | 5.3 | 0.0014 | 2026-10-29 | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader va | |
CVE-2026-118640 |
medium | 5.3 | 0.0019 | 2026-10-29 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in | |
CVE-2026-118641 |
medium | 6.9 | 0.0030 | 2026-10-29 | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter | |
CVE-2026-118642 |
medium | 5.1 | 0.0021 | 2026-10-29 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability tha | |
CVE-2026-118643 |
medium | 5.3 | 0.0026 | 2026-10-29 | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets | |
CVE-2026-118644 |
medium | 5.1 | 0.0020 | 2026-10-29 | n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution conte | |
CVE-2026-118647 |
medium | 5.3 | 0.0026 | 2026-10-29 | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigge | |
CVE-2026-118675 |
medium | 5.1 | 0.0017 | 2026-10-29 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability t | |
CVE-2026-118676 |
medium | 5.1 | 0.0020 | 2026-10-29 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability tha | |
CVE-2026-118677 |
medium | 5.9 | 0.0016 | 2026-10-29 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability i | |
CVE-2026-118679 |
medium | 6.9 | 0.0027 | 2026-10-29 | n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerabili | |
CVE-2026-118680 |
medium | 5.9 | 0.0046 | 2026-10-29 | SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, | |
CVE-2026-118681 |
medium | 6.3 | 0.0024 | 2026-10-29 | go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, w | |
CVE-2026-118685 |
medium | 6.9 | 0.0019 | 2026-10-29 | ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisa | |
CVE-2026-115415 |
medium | 5.9 | 0.0034 | 2026-10-29 | Improper neutralization of input used for LLM prompting in the environment tool in Strands | |
CVE-2026-118266 |
medium | 5.3 | 0.0016 | 2026-10-29 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware ac | |
CVE-2026-118651 |
medium | 5.3 | 0.0021 | 2026-10-29 | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an a | |
CVE-2026-118652 |
medium | 6.1 | 0.0024 | 2026-10-29 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob | |
CVE-2026-118653 |
medium | 5.3 | 0.0042 | 2026-10-29 | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-su | |
CVE-2026-118654 |
medium | 5.9 | 0.0035 | 2026-10-29 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can nor | |
CVE-2026-118655 |
medium | 5.9 | 0.0030 | 2026-10-29 | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an alr | |
CVE-2026-11854 |
medium | 6.1 | 0.0021 | 2026-10-29 | The authentication endpoint generates an error message that includes reflected data direct | |
CVE-2026-54162 |
medium | 4.7 | 0.0025 | 2026-10-29 | Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior t | |
CVE-2026-61529 |
medium | 4.7 | 0.0021 | 2026-10-29 | Endatix is a self-hosted form and survey management platform with a headless API. Prior to | |
CVE-2026-118656 |
medium | 6.1 | 0.0020 | 2026-10-29 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first t | |
CVE-2026-118657 |
medium | 5.9 | 0.0013 | 2026-10-29 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trus | |
CVE-2026-118658 |
medium | 4.7 | 0.0019 | 2026-10-29 | Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from | |
CVE-2026-118661 |
medium | 6.5 | 0.0027 | 2026-10-29 | Happy DOM is a JavaScript implementation of a web browser without its graphical user inter | |
CVE-2026-118662 |
medium | 6.9 | 0.0029 | 2026-10-29 | Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite deve | |
CVE-2026-118663 |
medium | 5.3 | 0.0035 | 2026-10-29 | @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3 | |
CVE-2026-118666 |
medium | 6.0 | 0.0034 | 2026-10-29 | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Pri | |
CVE-2026-118667 |
medium | 4.3 | 0.0039 | 2026-10-29 | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistant | |
CVE-2026-118537 |
medium | 5.3 | 0.0038 | 2026-10-29 | A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of | |
CVE-2026-118538 |
medium | 5.1 | 0.0030 | 2026-10-29 | A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the f | |
CVE-2026-118691 |
medium | 6.3 | 0.0031 | 2026-10-29 | xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the | |
CVE-2026-118693 |
medium | 5.6 | 0.0014 | 2026-10-29 | CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_c | |
CVE-2026-118754 |
medium | 6.9 | 0.0024 | 2026-10-29 | Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/pu | |
CVE-2026-118756 |
medium | 6.7 | 0.0014 | 2026-10-29 | gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage bac | |
CVE-2026-118757 |
medium | 6.9 | 0.0023 | 2026-10-29 | PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a | |
CVE-2026-57448 |
medium | 6.2 | 0.0034 | 2026-10-29 | Blombooru is a self-hosted personal booru for organizing and tagging private image collect | |
CVE-2026-61573 |
medium | 6.1 | 0.0025 | 2026-10-29 | AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects | |
CVE-2026-61575 |
medium | 4.7 | 0.0018 | 2026-10-29 | AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on th | |
CVE-2026-118577 |
medium | 5.3 | 0.0023 | 2026-10-29 | A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted i | |
CVE-2026-118578 |
medium | 5.3 | 0.0022 | 2026-10-29 | A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The a | |
CVE-2026-55561 |
medium | 5.3 | 0.0027 | 2026-10-29 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and | |
CVE-2026-75520 |
medium | 5.4 | 0.0028 | 2026-10-29 | Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Rasp | |
CVE-2026-82411 |
medium | 6.5 | 0.0031 | 2026-10-29 | Open Object provides an API and admin interface to manage objects and object types. From 2 |