Browse All CVEs
39,815 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-48056 |
critical | 10.0 | 0.0055 | 2026-10-29 | Streambert is a cross-platform Electron Desktop App to stream and download video content. | |
CVE-2026-51583 |
high | 8.5 | 0.0040 | 2026-10-29 | An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Ser | |
CVE-2026-73210 |
medium | 5.1 | 0.0047 | 2026-10-29 | A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture | |
CVE-2026-17061 |
critical | 10.0 | 0.0081 | 2026-10-29 | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from | |
CVE-2026-17535 |
medium | 6.2 | 0.0016 | 2026-10-29 | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion | |
CVE-2026-18125 |
high | 7.5 | 0.0159 | 2026-10-29 | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allo | |
CVE-2026-18127 |
high | 7.7 | 0.0072 | 2026-10-29 | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 | |
CVE-2026-18129 |
high | 8.1 | 0.0146 | 2026-10-29 | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager bef | |
CVE-2026-18635 |
high | 7.2 | 0.0046 | 2026-10-29 | Velociraptor's VQL has a query() plugin which allows running a VQL query in a different or | |
CVE-2026-18636 |
medium | 6.8 | 0.0040 | 2026-10-29 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the | |
CVE-2026-18860 |
high | 8.7 | 0.0044 | 2026-10-29 | Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses | |
CVE-2026-47702 |
critical | 9.1 | 0.0030 | 2026-10-29 | TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used | |
CVE-2026-72922 |
high | 8.2 | 0.0048 | 2026-10-29 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous | |
CVE-2026-73066 |
medium | 6.8 | 0.0013 | 2026-10-29 | Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model | |
CVE-2026-73067 |
medium | 6.7 | 0.0013 | 2026-10-29 | Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loade | |
CVE-2026-11733 |
low | 1.1 | 0.0078 | 2026-10-29 | A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator | |
CVE-2026-11734 |
low | 1.1 | 0.0089 | 2026-10-29 | A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin | |
CVE-2026-11737 |
medium | 4.3 | 0.0033 | 2026-10-29 | Insufficient input validation vulnerability in the listed NETGEAR models allows authentic | |
CVE-2026-11738 |
medium | 4.3 | 0.0040 | 2026-10-29 | Insufficient input validation vulnerability in the listed NETGEAR models allows authentica | |
CVE-2026-11739 |
medium | 4.9 | 0.0255 | 2026-10-29 | A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a | |
CVE-2026-18638 |
medium | 6.5 | 0.0041 | 2026-10-29 | Any authenticated Velociraptor user — including one holding only the readerrole — can term | |
CVE-2026-18639 |
high | 7.3 | 0.0039 | 2026-10-29 | When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email c | |
CVE-2026-18640 |
high | 7.1 | 0.0043 | 2026-10-29 | The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticate | |
CVE-2026-19078 |
medium | 4.3 | 0.0036 | 2026-10-29 | A flaw was found in the oauth-server component. This open redirect vulnerability occurs wh | |
CVE-2026-42142 |
high | 7.1 | 0.0037 | 2026-10-29 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API hand | |
CVE-2026-48495 |
high | 7.1 | 0.0035 | 2026-10-29 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callba | |
CVE-2026-48766 |
high | 7.6 | 0.0043 | 2026-10-29 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest me | |
CVE-2026-53413 |
high | 8.3 | 0.0049 | 2026-10-29 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, w | |
CVE-2026-53414 |
medium | 6.5 | 0.0036 | 2026-10-29 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, wh | |
CVE-2026-53415 |
high | 8.3 | 0.0049 | 2026-10-29 | Use after Free in the annotator function of Zoom Clients may allow a meeting participant t | |
CVE-2026-53416 |
high | 7.1 | 0.0021 | 2026-10-29 | Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct i | |
CVE-2026-56720 |
medium | 5.3 | 0.0034 | 2026-10-29 | CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in th | |
CVE-2026-56721 |
high | 8.7 | 0.0052 | 2026-10-29 | CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via in | |
CVE-2026-67179 |
high | 7.8 | 0.0021 | 2026-10-29 | Genkit does not properly validate host request headers. Any host on the developer's networ | |
CVE-2026-67180 |
high | 7.5 | 0.0023 | 2026-10-29 | Google Turbinia allows arbitrary command execution via worker tasks. An attacker with priv | |
CVE-2026-6726 |
high | 7.9 | 0.0019 | 2026-10-29 | An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that c | |
CVE-2026-6727 |
medium | 5.9 | 0.0015 | 2026-10-29 | A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A pr | |
CVE-2026-73069 |
critical | 9.1 | 0.0066 | 2026-10-29 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, | |
CVE-2026-73079 |
high | 8.5 | 0.0039 | 2026-10-29 | Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI | |
CVE-2026-9214 |
medium | 4.3 | 0.0023 | 2026-10-29 | Insufficient input validation vulnerability in the NETGEAR R7000 models allows authentica | |
CVE-2026-12571 |
critical | 9.8 | 0.0327 | 2026-10-29 | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows acco | |
CVE-2026-18247 |
medium | 5.3 | 0.0044 | 2026-10-29 | A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions ear | |
CVE-2026-20349 |
high | 8.6 | 0.0101 | 2026-10-29 | KEV | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense |
CVE-2026-40375 |
medium | 6.5 | 0.0084 | 2026-10-29 | Missing authorization in Dynamics Business Central allows an authorized attacker to disclo | |
CVE-2026-47285 |
medium | 6.5 | 0.0092 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in Vis | |
CVE-2026-47299 |
high | 7.2 | 0.0101 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in Azu | |
CVE-2026-47704 |
high | 7.1 | 0.0056 | 2026-10-29 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has | |
CVE-2026-48483 |
medium | 5.4 | 0.0033 | 2026-10-29 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forw | |
CVE-2026-49179 |
high | 8.8 | 0.0086 | 2026-10-29 | 1 PoC | Improper neutralization of special elements used in a command ('command injection') in Win |
CVE-2026-50516 |
critical | 9.4 | 0.0083 | 2026-10-29 | Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacke |