Browse All CVEs
39,770 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-66150 |
high | 7.8 | 0.0026 | 2026-10-29 | Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall E | |
CVE-2026-66154 |
high | 8.3 | 0.0020 | 2026-10-29 | An insufficient certificate validation in a privileged communication workflow, was identif | |
CVE-2026-71290 |
critical | 9.1 | 0.0033 | 2026-10-29 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or ne | |
CVE-2026-18710 |
high | 8.2 | 0.0014 | 2026-10-29 | A MongoDB driver component could write sensitive configuration information, including a cr | |
CVE-2026-19556 |
high | 8.8 | 0.0041 | 2026-10-29 | Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to | |
CVE-2026-19557 |
high | 8.3 | 0.0030 | 2026-10-29 | Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remot | |
CVE-2026-19558 |
high | 7.5 | 0.0027 | 2026-10-29 | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker | |
CVE-2026-19559 |
high | 8.8 | 0.0041 | 2026-10-29 | Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker | |
CVE-2026-19560 |
high | 8.8 | 0.0041 | 2026-10-29 | Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker | |
CVE-2026-29036 |
high | 8.7 | 0.0044 | 2026-10-29 | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vuln | |
CVE-2026-73245 |
medium | 6.5 | 0.0033 | 2026-10-29 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra' | |
CVE-2026-73246 |
high | 7.5 | 0.0060 | 2026-10-29 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra' | |
CVE-2026-73247 |
high | 8.6 | 0.0041 | 2026-10-29 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's co | |
CVE-2026-73248 |
high | 8.5 | 0.0020 | 2026-10-29 | calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compo | |
CVE-2026-73249 |
high | 7.5 | 0.0044 | 2026-10-29 | calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /b | |
CVE-2026-6484 |
high | 8.2 | 0.0037 | 2026-10-29 | In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution. | |
CVE-2026-64927 |
medium | 6.4 | 0.0033 | 2026-10-29 | A flaw was found in the multicloud-operators-channel component. This vulnerability allows | |
CVE-2026-66878 |
high | 7.7 | 0.0048 | 2026-10-29 | A flaw was found in multicloud-operators-subscription. A privileged user, specifically a n | |
CVE-2026-70398 |
critical | 9.6 | 0.0052 | 2026-10-29 | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Manag | |
CVE-2026-72526 |
critical | 9.9 | 0.0070 | 2026-10-29 | A flaw was found in the multicloud-integrations component. The Application propagation con | |
CVE-2026-73122 |
high | 7.7 | 0.0048 | 2026-10-29 | A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster | |
CVE-2026-19587 |
medium | 6.5 | 0.0036 | 2026-10-29 | Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Exce | |
CVE-2026-19588 |
medium | 6.5 | 0.0035 | 2026-10-29 | Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Ov | |
CVE-2026-9318 |
medium | 4.8 | 0.0030 | 2026-10-29 | tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML ex | |
CVE-2026-12232 |
medium | 6.1 | 0.0015 | 2026-10-29 | The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/ | |
CVE-2026-12233 |
medium | 5.9 | 0.0051 | 2026-10-29 | The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentia | |
CVE-2026-12234 |
high | 7.8 | 0.0011 | 2026-10-29 | The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsy | |
CVE-2026-12235 |
medium | 6.3 | 0.0014 | 2026-10-29 | The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries | |
CVE-2026-64954 |
high | 8.2 | 0.0031 | 2026-10-29 | Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to | |
CVE-2026-19594 |
high | 8.1 | 0.0050 | 2026-10-29 | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior | |
CVE-2026-66659 |
critical | 9.3 | 0.0040 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-19426 |
high | 8.8 | 0.0052 | 2026-10-29 | POS System developed by FitSoft has a Missing Authentication vulnerability. Unauthenticate | |
CVE-2026-19566 |
high | 7.5 | 0.0063 | 2026-10-29 | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ran | |
CVE-2026-67282 |
critical | 10.0 | 0.0078 | 2026-10-29 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 | |
CVE-2026-67283 |
medium | 6.9 | 0.0042 | 2026-10-29 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cot | |
CVE-2026-18652 |
medium | 6.5 | 0.0034 | 2026-10-29 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant | |
CVE-2026-64951 |
low | 3.5 | 0.0028 | 2026-10-29 | A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attemp | |
CVE-2026-64952 |
medium | 6.5 | 0.0030 | 2026-10-29 | The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permis | |
CVE-2026-64955 |
medium | 6.1 | 0.0036 | 2026-10-29 | When Microsoft Excel imports a CSV file, it executes cells beginning with certain characte | |
CVE-2026-67284 |
medium | 5.3 | 0.0035 | 2026-10-29 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cot | |
CVE-2026-68868 |
medium | 6.5 | 0.0060 | 2026-10-29 | The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never | |
CVE-2026-11325 |
high | 8.8 | 0.0068 | 2026-10-29 | Description Cloudflare was recently notified by external researchers of vulnerabilities | |
CVE-2026-70465 |
high | 8.1 | 0.0052 | 2026-10-29 | A buffer copy without checking size of input ('classic buffer overflow') vulnerability in | |
CVE-2026-70560 |
medium | 4.8 | 0.0020 | 2026-10-29 | Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vul | |
CVE-2026-26035 |
critical | 9.8 | 0.0075 | 2026-10-29 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0. | |
CVE-2026-53996 |
high | 7.3 | 0.0013 | 2026-10-29 | NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control | |
CVE-2026-57858 |
critical | 9.3 | 0.0037 | 2026-10-29 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnera | |
CVE-2026-70466 |
medium | 5.3 | 0.0031 | 2026-10-29 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8. | |
CVE-2026-70467 |
low | 3.8 | 0.0026 | 2026-10-29 | A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM | |
CVE-2026-70468 |
high | 8.1 | 0.0046 | 2026-10-29 | A authentication bypass using an alternate path or channel vulnerability in Fortinet Forti |