Browse All CVEs
39,771 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-18698 |
medium | 5.3 | 0.0024 | 2026-10-29 | An issue in MongoDB Server could allow an authenticated user with a limited database-scope | |
CVE-2026-18699 |
medium | 6.0 | 0.0040 | 2026-10-29 | An issue in MongoDB Server's query planner could allow an authenticated user with read-lev | |
CVE-2026-18700 |
medium | 6.0 | 0.0040 | 2026-10-29 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with | |
CVE-2026-18701 |
high | 7.1 | 0.0040 | 2026-10-29 | An issue in MongoDB Server's query subsystem could allow an authenticated user with read p | |
CVE-2026-18702 |
medium | 5.3 | 0.0027 | 2026-10-29 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped | |
CVE-2026-18703 |
low | 2.3 | 0.0014 | 2026-10-29 | An issue in MongoDB Server could allow a party with a valid client certificate and a corre | |
CVE-2026-18704 |
high | 7.1 | 0.0029 | 2026-10-29 | An issue in MongoDB Server's aggregation framework could allow an authenticated user with | |
CVE-2026-18705 |
high | 7.1 | 0.0036 | 2026-10-29 | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user | |
CVE-2026-18706 |
high | 7.5 | 0.0047 | 2026-10-29 | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated u | |
CVE-2026-18709 |
medium | 5.9 | 0.0019 | 2026-10-29 | An issue in MongoDB Server could allow an authenticated user with direct network access to | |
CVE-2026-69115 |
high | 7.1 | 0.0030 | 2026-10-29 | OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authen | |
CVE-2026-69117 |
high | 7.1 | 0.0032 | 2026-10-29 | NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, | |
CVE-2026-69119 |
high | 7.2 | 0.0046 | 2026-10-29 | Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HT | |
CVE-2026-72742 |
critical | 9.2 | 0.0051 | 2026-10-29 | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output fiel | |
CVE-2026-73221 |
medium | 5.3 | 0.0043 | 2026-10-29 | CVAT is an open source interactive video and image annotation tool for computer vision. Fr | |
CVE-2026-73222 |
high | 8.8 | 0.0032 | 2026-10-29 | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1 | |
CVE-2026-73228 |
medium | 5.3 | 0.0056 | 2026-10-29 | Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Fra | |
CVE-2024-14042 |
low | 2.1 | 0.0050 | 2026-10-29 | A vulnerability was found in Open5GS up to 2.7.1. This affects the function hss_ogs_diam_s | |
CVE-2026-45618 |
critical | 10.0 | 0.0082 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, i | |
CVE-2026-65655 |
low | 2.3 | 0.0037 | 2026-10-29 | When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy | |
CVE-2026-66145 |
critical | 9.1 | 0.0066 | 2026-10-29 | An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build | |
CVE-2026-66146 |
medium | 6.1 | 0.0030 | 2026-10-29 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 95 | |
CVE-2026-70339 |
medium | 5.4 | 0.0041 | 2026-10-29 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium- | |
CVE-2026-71467 |
high | 7.5 | 0.0083 | 2026-10-29 | A flaw was found in search-v2-api. The authentication middleware in the affected component | |
CVE-2026-71468 |
medium | 5.3 | 0.0042 | 2026-10-29 | A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refre | |
CVE-2026-71474 |
— | — | 0.0016 | 2026-10-29 | A flaw was found in insights-client. When the application receives a non-200 response, it | |
CVE-2026-71475 |
medium | 6.8 | 0.0069 | 2026-10-29 | A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spok | |
CVE-2026-71845 |
high | 7.7 | 0.0050 | 2026-10-29 | A flaw was found in insights-client. The setDefault() function logs the value of every env | |
CVE-2026-73031 |
high | 8.2 | 0.0066 | 2026-10-29 | telegram-search contains a stored cross-site scripting vulnerability that allows remote at | |
CVE-2026-73032 |
critical | 9.4 | 0.0056 | 2026-10-29 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows atta | |
CVE-2026-73034 |
critical | 9.3 | 0.0570 | 2026-10-29 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote | |
CVE-2026-73229 |
medium | 4.3 | 0.0037 | 2026-10-29 | Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3 | |
CVE-2026-73231 |
high | 7.8 | 0.0021 | 2026-10-29 | Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, | |
CVE-2026-73243 |
medium | 5.8 | 0.0043 | 2026-10-29 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1 | |
CVE-2026-73244 |
medium | 5.3 | 0.0044 | 2026-10-29 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1 | |
CVE-2026-73281 |
low | 3.5 | 0.0016 | 2026-10-29 | In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended | |
CVE-2026-73282 |
medium | 4.8 | 0.0016 | 2026-10-29 | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pa | |
CVE-2026-73283 |
low | 2.5 | 0.0015 | 2026-10-29 | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to | |
CVE-2026-18634 |
high | 8.4 | 0.0034 | 2026-10-29 | An insecure handling of serialized objects vulnerability was found in the one of the servi | |
CVE-2026-19550 |
high | 8.2 | 0.0048 | 2026-10-29 | A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permi | |
CVE-2026-19579 |
medium | 5.3 | 0.0034 | 2026-10-29 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) | |
CVE-2026-48762 |
medium | 5.4 | 0.0030 | 2026-10-29 | TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcripti | |
CVE-2026-48763 |
high | 8.2 | 0.0053 | 2026-10-29 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upl | |
CVE-2026-48765 |
critical | 9.9 | 0.0046 | 2026-10-29 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read col | |
CVE-2026-55676 |
high | 8.7 | 0.0060 | 2026-10-29 | Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP | |
CVE-2026-63133 |
high | 7.1 | 0.0055 | 2026-10-29 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract. | |
CVE-2026-63134 |
medium | 5.3 | 0.0042 | 2026-10-29 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract. | |
CVE-2026-63177 |
high | 7.1 | 0.0037 | 2026-10-29 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based acc | |
CVE-2026-66147 |
critical | 9.4 | 0.0176 | 2026-10-29 | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Se | |
CVE-2026-66148 |
medium | 6.3 | 0.0110 | 2026-10-29 | An authenticated command injection vulnerability was identified in GMS Command-Line Interf |