Browse All CVEs
39,766 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-14478 |
high | 7.8 | 0.0015 | 2026-10-29 | A maliciously created executable, when executed on the victim's machine, may allow a local | |
CVE-2026-14479 |
medium | 5.5 | 0.0015 | 2026-10-29 | A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, ma | |
CVE-2026-18171 |
medium | 5.7 | 0.0014 | 2026-10-29 | Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-gues | |
CVE-2026-49262 |
low | 3.0 | 0.0017 | 2026-10-29 | In the Aimeos Pagible content management system prior to version 0.10.4, the administrativ | |
CVE-2026-50561 |
critical | 9.4 | 0.0068 | 2026-10-29 | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent developme | |
CVE-2026-66375 |
high | 8.1 | 0.0040 | 2026-10-29 | A low-privilege authenticated user may permanently remove protected internal metadata acro | |
CVE-2026-66376 |
medium | 5.4 | 0.0022 | 2026-10-29 | Credentials for a deleted user may remain valid for a short period under specific conditio | |
CVE-2026-66377 |
medium | 5.3 | 0.0036 | 2026-10-29 | An unauthenticated user may access restricted repository information under specific condit | |
CVE-2026-66378 |
medium | 4.3 | 0.0030 | 2026-10-29 | An authenticated user without repository read permission may access private NuGet metadata | |
CVE-2026-66379 |
medium | 4.3 | 0.0030 | 2026-10-29 | An authenticated user may view private Puppet module metadata without repository read acce | |
CVE-2026-66380 |
medium | 4.3 | 0.0030 | 2026-10-29 | An authenticated user without repository read permission may access private OCI referrer m | |
CVE-2026-66381 |
medium | 5.3 | 0.0039 | 2026-10-29 | A repository reader with cache-deploy permission may access content outside a configured u | |
CVE-2026-66382 |
medium | 4.3 | 0.0035 | 2026-10-29 | An authenticated user may write files outside the intended Artifactory work directory unde | |
CVE-2026-67286 |
medium | 6.3 | 0.0052 | 2026-10-29 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file | |
CVE-2026-67287 |
medium | 6.3 | 0.0042 | 2026-10-29 | Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < | |
CVE-2026-68752 |
high | 7.2 | 0.0049 | 2026-10-29 | A Project Resource Manager may gain broader administrative privileges under specific condi | |
CVE-2026-68753 |
medium | 5.3 | 0.0031 | 2026-10-29 | An unauthenticated user may access restricted Artifactory content when a credentialed remo | |
CVE-2026-68754 |
medium | 6.5 | 0.0031 | 2026-10-29 | A repository publisher without delete permission may modify protected package content unde | |
CVE-2026-68755 |
medium | 4.3 | 0.0026 | 2026-10-29 | A bundle writer may create misleading release promotion information under specific conditi | |
CVE-2026-68756 |
medium | 6.6 | 0.0047 | 2026-10-29 | A party with write access to stored session data may affect JFrog Artifactory under specif | |
CVE-2026-68757 |
high | 7.5 | 0.0027 | 2026-10-29 | A user with access to a valid SAML response may impersonate another user under specific co | |
CVE-2026-68760 |
medium | 5.3 | 0.0046 | 2026-10-29 | An unauthenticated user may bypass authentication under specific cache conditions. | |
CVE-2026-73262 |
medium | 5.4 | 0.0030 | 2026-10-29 | Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in | |
CVE-2026-73263 |
critical | 9.9 | 0.0065 | 2026-10-29 | Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection | |
CVE-2026-73264 |
high | 7.6 | 0.0043 | 2026-10-29 | Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthou | |
CVE-2026-73291 |
high | 7.1 | 0.0039 | 2026-10-29 | Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. | |
CVE-2026-15803 |
high | 8.7 | 0.0047 | 2026-10-29 | In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entit | |
CVE-2026-54183 |
medium | 4.3 | 0.0042 | 2026-10-29 | Apache Airflow's secrets masker hides values stored under sensitive key names when they ar | |
CVE-2026-58076 |
high | 8.8 | 0.0048 | 2026-10-29 | Apache Airflow's serialization layer reconstructed exception nodes by calling `import_stri | |
CVE-2026-59242 |
medium | 5.4 | 0.0053 | 2026-10-29 | Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint pass | |
CVE-2026-59244 |
medium | 6.5 | 0.0023 | 2026-10-29 | Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a d | |
CVE-2026-64639 |
critical | 9.3 | 0.0055 | 2026-10-29 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 al | |
CVE-2026-65017 |
medium | 6.5 | 0.0039 | 2026-10-29 | Apache Airflow's Config API did not mask team-scoped sensitive configuration values in mul | |
CVE-2026-65926 |
low | 3.1 | 0.0024 | 2026-10-29 | An anonymous caller when anonymous access is enabled, or a low-privilege authenticated use | |
CVE-2026-65937 |
high | 8.0 | 0.0041 | 2026-10-29 | In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass fr | |
CVE-2026-65938 |
medium | 4.3 | 0.0025 | 2026-10-29 | In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability | |
CVE-2026-65939 |
medium | 6.8 | 0.0038 | 2026-10-29 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogT | |
CVE-2026-65940 |
medium | 6.8 | 0.0035 | 2026-10-29 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitra | |
CVE-2026-65941 |
high | 8.8 | 0.0068 | 2026-10-29 | In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with | |
CVE-2026-66016 |
medium | 6.7 | 0.0012 | 2026-10-29 | Under specific self-hosted Helm configurations, generated TLS private keys may be retained | |
CVE-2026-66384 |
medium | 5.3 | 0.0066 | 2026-10-29 | KEV | JFrog Artifactory contains an improper limitation of a pathname to a restricted directory |
CVE-2026-67260 |
high | 7.3 | 0.0078 | 2026-10-29 | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_i | |
CVE-2026-67587 |
high | 8.8 | 0.0061 | 2026-10-29 | Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running i | |
CVE-2026-68076 |
medium | 5.4 | 0.0034 | 2026-10-29 | Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or | |
CVE-2026-68758 |
medium | 6.5 | 0.0035 | 2026-10-29 | A low-privileged authenticated user may access restricted support information under specif | |
CVE-2026-68759 |
high | 7.2 | 0.0033 | 2026-10-29 | A holder of a valid integration credential may impersonate other users under specific cond | |
CVE-2026-68968 |
high | 7.5 | 0.0042 | 2026-10-29 | Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller | |
CVE-2026-68969 |
medium | 6.5 | 0.0036 | 2026-10-29 | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in c | |
CVE-2026-68970 |
medium | 6.5 | 0.0023 | 2026-10-29 | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a li | |
CVE-2026-68971 |
medium | 6.5 | 0.0033 | 2026-10-29 | Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materiali |