Browse All CVEs
37,981 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-64607 |
medium | 5.3 | 0.0046 | 2026-10-29 | HttpClient based on the classic i/o model fails to correctly release the underlying connec | |
CVE-2026-46593 |
high | 8.6 | 0.0038 | 2026-10-29 | A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Im | |
CVE-2026-46594 |
medium | 5.1 | 0.0055 | 2026-10-29 | A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabber | |
CVE-2026-15227 |
medium | 5.3 | 0.0035 | 2026-10-29 | Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows a | |
CVE-2026-17561 |
critical | 9.8 | 0.0056 | 2026-10-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Softwar | |
CVE-2026-28144 |
medium | 4.3 | 0.0029 | 2026-10-29 | Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps al | |
CVE-2026-28145 |
medium | 5.3 | 0.0016 | 2026-10-29 | Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy | |
CVE-2026-65636 |
low | 2.1 | 0.0020 | 2026-10-29 | Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr m | |
CVE-2026-10685 |
high | 7.6 | 0.0030 | 2026-10-29 | The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys | |
CVE-2026-67350 |
low | 2.1 | 0.0035 | 2026-10-29 | Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows u | |
CVE-2026-10686 |
medium | 5.8 | 0.0064 | 2026-10-29 | Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the | |
CVE-2026-16503 |
critical | 9.1 | 0.0043 | 2026-10-29 | Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that i | |
CVE-2026-16504 |
critical | 9.8 | 0.0048 | 2026-10-29 | Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing | |
CVE-2026-17346 |
high | 8.7 | 0.0062 | 2026-10-29 | The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMME | |
CVE-2026-17347 |
high | 7.7 | 0.0072 | 2026-10-29 | The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator confi | |
CVE-2026-17348 |
medium | 6.9 | 0.0042 | 2026-10-29 | In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required de | |
CVE-2026-17349 |
critical | 9.3 | 0.0040 | 2026-10-29 | /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin | |
CVE-2026-17350 |
medium | 5.3 | 0.0038 | 2026-10-29 | The per-tool permission system (custom roles / role-based tool permissions, introduced in | |
CVE-2026-17351 |
critical | 9.4 | 0.0048 | 2026-10-29 | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the | |
CVE-2026-17566 |
critical | 9.4 | 0.0067 | 2026-10-29 | pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolatin | |
CVE-2026-52857 |
medium | 5.5 | 0.0016 | 2026-10-29 | Wings is the server control plane for Pterodactyl, a free, open-source game server managem | |
CVE-2026-56567 |
low | 3.3 | 0.0014 | 2026-10-29 | HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves | |
CVE-2026-56568 |
medium | 5.3 | 0.0033 | 2026-10-29 | HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Me | |
CVE-2026-56569 |
low | 3.3 | 0.0014 | 2026-10-29 | HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the publ | |
CVE-2026-56570 |
medium | 5.3 | 0.0030 | 2026-10-29 | HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sen | |
CVE-2026-56571 |
medium | 5.3 | 0.0029 | 2026-10-29 | HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of m | |
CVE-2026-59231 |
medium | 5.3 | 0.0045 | 2026-10-29 | Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 | |
CVE-2026-59232 |
medium | 5.3 | 0.0053 | 2026-10-29 | Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allow | |
CVE-2026-67607 |
high | 8.2 | 0.0040 | 2026-10-29 | LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE | |
CVE-2026-52855 |
critical | 9.9 | 0.0051 | 2026-10-29 | Wings is the server control plane for Pterodactyl, a free, open-source game server managem | |
CVE-2026-52856 |
high | 7.5 | 0.0061 | 2026-10-29 | Wings is the server control plane for Pterodactyl, a free, open-source game server managem | |
CVE-2026-21662 |
medium | 4.8 | 0.0050 | 2026-10-29 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Syste | |
CVE-2026-34490 |
medium | 4.8 | 0.0010 | 2026-10-29 | Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Applicat | |
CVE-2026-34495 |
medium | 4.8 | 0.0023 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-34497 |
medium | 4.8 | 0.0023 | 2026-10-29 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerabilit | |
CVE-2026-54725 |
critical | 9.6 | 0.0045 | 2026-10-29 | vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection | |
CVE-2026-54729 |
high | 8.7 | 0.0048 | 2026-10-29 | DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defen | |
CVE-2026-54737 |
high | 7.3 | 0.0046 | 2026-10-29 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and n | |
CVE-2026-55100 |
high | 8.7 | 0.0056 | 2026-10-29 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to | |
CVE-2026-18481 |
medium | 6.2 | 0.0051 | 2026-10-29 | Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #1 | |
CVE-2026-25552 |
medium | 6.3 | 0.0022 | 2026-10-29 | Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated | |
CVE-2026-18394 |
medium | 6.9 | 0.0052 | 2026-10-29 | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 migh | |
CVE-2026-38711 |
critical | 9.8 | 0.0275 | 2026-10-29 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-53510 |
high | 8.1 | 0.0069 | 2026-10-29 | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpo | |
CVE-2026-53599 |
high | 7.5 | 0.0051 | 2026-10-29 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool:: | |
CVE-2026-62324 |
medium | 5.4 | 0.0031 | 2026-10-29 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.1 | |
CVE-2026-62999 |
high | 7.5 | 0.0044 | 2026-10-29 | Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0 | |
CVE-2026-65841 |
medium | 5.3 | 0.0053 | 2026-10-29 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.1 | |
CVE-2026-38708 |
critical | 9.8 | 0.0275 | 2026-10-29 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-38710 |
high | 7.2 | 0.0233 | 2026-10-29 | TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerabi |