Browse All CVEs
39,705 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-72807 |
high | 8.8 | 0.0033 | 2026-10-29 | SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attrib | |
CVE-2026-72808 |
medium | 6.9 | 0.0035 | 2026-10-29 | SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclo | |
CVE-2026-72809 |
high | 7.1 | 0.0030 | 2026-10-29 | SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerabili | |
CVE-2026-73268 |
critical | 9.9 | 0.0088 | 2026-10-29 | A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). | |
CVE-2026-73269 |
critical | 9.9 | 0.0056 | 2026-10-29 | A flaw was found in the cluster-curator-controller component. A local user, by creating a | |
CVE-2026-73326 |
high | 7.2 | 0.0038 | 2026-10-29 | CamaleonCMS contains a missing authorization vulnerability that allows any authenticated l | |
CVE-2026-73329 |
critical | 9.2 | 0.0042 | 2026-10-29 | CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated | |
CVE-2026-73330 |
high | 7.5 | 0.0079 | 2026-10-29 | CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows auth | |
CVE-2026-73331 |
high | 7.1 | 0.0036 | 2026-10-29 | CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authen | |
CVE-2026-73332 |
critical | 9.2 | 0.0042 | 2026-10-29 | CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form | |
CVE-2026-73411 |
medium | 6.3 | 0.0059 | 2026-10-29 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEs | |
CVE-2026-73412 |
medium | 6.3 | 0.0061 | 2026-10-29 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this | |
CVE-2026-73413 |
high | 8.7 | 0.0059 | 2026-10-29 | Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0 | |
CVE-2026-73414 |
critical | 9.2 | 0.0089 | 2026-10-29 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEs | |
CVE-2026-10543 |
critical | 9.8 | 0.0039 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escala | |
CVE-2026-13094 |
high | 7.8 | 0.0020 | 2026-10-29 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code exe | |
CVE-2026-13105 |
high | 8.8 | 0.0050 | 2026-10-29 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path trav | |
CVE-2026-13367 |
high | 7.8 | 0.0014 | 2026-10-29 | IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerabi | |
CVE-2026-13433 |
critical | 9.6 | 0.0017 | 2026-10-29 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading | |
CVE-2026-13476 |
high | 7.3 | 0.0043 | 2026-10-29 | IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to | |
CVE-2026-13622 |
high | 8.8 | 0.0020 | 2026-10-29 | A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. Du | |
CVE-2026-14866 |
high | 7.1 | 0.0011 | 2026-10-29 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue | |
CVE-2026-16033 |
high | 8.5 | 0.0047 | 2026-10-29 | A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file re | |
CVE-2026-16480 |
high | 7.1 | 0.0034 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper author | |
CVE-2026-16695 |
high | 7.8 | 0.0021 | 2026-10-29 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to exe | |
CVE-2026-18096 |
low | 3.3 | 0.0013 | 2026-10-29 | IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a loc | |
CVE-2026-18097 |
medium | 5.5 | 0.0015 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (incl | |
CVE-2026-18888 |
high | 7.1 | 0.0042 | 2026-10-29 | The MongoDB BI Connector ODBC Driver converts floating point column values into text witho | |
CVE-2026-19001 |
critical | 9.5 | 0.0054 | 2026-10-29 | The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer w | |
CVE-2026-19002 |
high | 8.8 | 0.0040 | 2026-10-29 | A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI | |
CVE-2026-19004 |
high | 8.8 | 0.0050 | 2026-10-29 | An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety i | |
CVE-2026-19130 |
medium | 5.8 | 0.0040 | 2026-10-29 | A flaw was found in the provider-credential-controller component of multicluster-engine (M | |
CVE-2026-19502 |
medium | 6.8 | 0.0018 | 2026-10-29 | MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, w | |
CVE-2026-65370 |
high | 7.5 | 0.0034 | 2026-10-29 | ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in | |
CVE-2026-66898 |
critical | 9.9 | 0.0059 | 2026-10-29 | A path traversal vulnerability in LXD allows an attacker to manipulate file system paths d | |
CVE-2026-73422 |
medium | 5.3 | 0.0055 | 2026-10-29 | Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's serv | |
CVE-2026-73423 |
medium | 5.1 | 0.0026 | 2026-10-29 | Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composab | |
CVE-2026-73425 |
low | 3.7 | 0.0027 | 2026-10-29 | Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify ad | |
CVE-2026-73427 |
low | 2.1 | 0.0057 | 2026-10-29 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1 | |
CVE-2026-73429 |
medium | 5.3 | 0.0051 | 2026-10-29 | Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can c | |
CVE-2026-73430 |
medium | 5.3 | 0.0060 | 2026-10-29 | Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH clien | |
CVE-2026-73490 |
medium | 4.7 | 0.0030 | 2026-10-29 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragm | |
CVE-2026-73491 |
low | 2.3 | 0.0039 | 2026-10-29 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragm | |
CVE-2026-10534 |
critical | 9.8 | 0.0038 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow | |
CVE-2026-17485 |
high | 8.2 | 0.0051 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service an | |
CVE-2026-18744 |
medium | 6.5 | 0.0043 | 2026-10-29 | Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul Ca | |
CVE-2026-18749 |
critical | 9.8 | 0.0051 | 2026-10-29 | The type=track branch authorises on _is_my_case(t_attach.case) only and never checks Vince | |
CVE-2026-18750 |
medium | 5.3 | 0.0032 | 2026-10-29 | vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk fro | |
CVE-2026-19003 |
high | 8.4 | 0.0021 | 2026-10-29 | A data source definition containing an over-length file path setting may cause the MongoDB | |
CVE-2026-71469 |
high | 7.5 | 0.0074 | 2026-10-29 | A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending |