Browse All CVEs
37,878 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-41453 |
high | 8.7 | 0.0050 | 2026-10-29 | Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid | |
CVE-2026-61372 |
high | 7.5 | 0.0081 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-68930 |
medium | 6.5 | 0.0038 | 2026-10-29 | Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-sco | |
CVE-2026-69152 |
high | 7.5 | 0.0065 | 2026-10-29 | The brace-expansion library generates arbitrary strings containing a common prefix and suf | |
CVE-2026-18612 |
high | 8.9 | 0.0397 | 2026-10-29 | A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the fun | |
CVE-2026-18613 |
high | 8.9 | 0.0100 | 2026-10-29 | A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the fu | |
CVE-2026-40717 |
high | 7.8 | 0.0016 | 2026-10-29 | Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Acc | |
CVE-2026-61523 |
high | 8.6 | 0.0119 | 2026-10-29 | WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets ed | |
CVE-2026-61524 |
high | 8.6 | 0.0103 | 2026-10-29 | WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the | |
CVE-2026-18614 |
high | 8.9 | 0.0362 | 2026-10-29 | A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.e | |
CVE-2026-18615 |
high | 8.9 | 0.0362 | 2026-10-29 | A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is t | |
CVE-2026-18616 |
high | 8.9 | 0.0362 | 2026-10-29 | A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is t | |
CVE-2026-59912 |
high | 7.8 | 0.0015 | 2026-10-29 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an I | |
CVE-2026-59913 |
high | 7.8 | 0.0017 | 2026-10-29 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Mi | |
CVE-2026-18631 |
low | 2.1 | 0.0040 | 2026-10-29 | A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects t | |
CVE-2026-18632 |
low | 2.1 | 0.0039 | 2026-10-29 | A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects th | |
CVE-2026-18641 |
medium | 5.5 | 0.0266 | 2026-10-29 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management Sy | |
CVE-2026-18644 |
low | 2.1 | 0.0054 | 2026-10-29 | A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the | |
CVE-2026-18654 |
medium | 6.9 | 0.0046 | 2026-10-29 | Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CL | |
CVE-2026-18655 |
high | 7.1 | 0.0042 | 2026-10-29 | Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the | |
CVE-2026-47211 |
high | 8.4 | 0.0019 | 2026-10-29 | Ouroboros is a local-first runtime for AI coding agents that records their actions and app | |
CVE-2026-48031 |
critical | 9.1 | 0.0063 | 2026-10-29 | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by Postgr | |
CVE-2026-58139 |
medium | 6.0 | 0.0051 | 2026-10-29 | The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that a | |
CVE-2026-62354 |
high | 7.7 | 0.0045 | 2026-10-29 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 thr | |
CVE-2026-66296 |
medium | 5.1 | 0.0037 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oas | |
CVE-2026-67599 |
high | 8.6 | 0.0243 | 2026-10-29 | ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component tha | |
CVE-2026-68979 |
medium | 5.9 | 0.0081 | 2026-10-29 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that | |
CVE-2026-68980 |
low | 2.3 | 0.0048 | 2026-10-29 | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated | |
CVE-2026-68981 |
high | 8.8 | 0.0074 | 2026-10-29 | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application RE | |
CVE-2026-69185 |
high | 7.5 | 0.0063 | 2026-10-29 | Socket.IO enables bidirectional and low-latency communication for every platform. Prior to | |
CVE-2026-69192 |
high | 7.7 | 0.0046 | 2026-10-29 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript | |
CVE-2026-69198 |
medium | 6.9 | 0.0048 | 2026-10-29 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript | |
CVE-2026-18645 |
low | 2.1 | 0.0054 | 2026-10-29 | A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the functio | |
CVE-2026-18646 |
medium | 5.5 | 0.0077 | 2026-10-29 | A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects un | |
CVE-2026-18647 |
medium | 5.5 | 0.0047 | 2026-10-29 | A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4 | |
CVE-2026-18648 |
low | 1.9 | 0.0021 | 2026-10-29 | A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the | |
CVE-2026-18733 |
high | 7.5 | 0.0057 | 2026-10-29 | A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0 | |
CVE-2026-18736 |
medium | 5.3 | 0.0033 | 2026-10-29 | Shlink contains a server-side request forgery vulnerability that allows authenticated API | |
CVE-2026-18737 |
high | 7.1 | 0.0040 | 2026-10-29 | Shlink contains a blind SQL injection vulnerability that allows any authenticated API key | |
CVE-2026-18738 |
medium | 5.1 | 0.0049 | 2026-10-29 | Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that all | |
CVE-2026-41447 |
high | 8.5 | 0.0017 | 2026-10-29 | FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows lo | |
CVE-2026-48061 |
medium | 5.9 | 0.0037 | 2026-10-29 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior t | |
CVE-2026-48113 |
high | 8.5 | 0.0039 | 2026-10-29 | Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior t | |
CVE-2026-49131 |
medium | 5.1 | 0.0029 | 2026-10-29 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows au | |
CVE-2026-49132 |
medium | 5.1 | 0.0019 | 2026-10-29 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows au | |
CVE-2026-52102 |
critical | 9.8 | 0.0294 | 2026-10-29 | An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8 | |
CVE-2026-52521 |
high | 8.1 | 0.0040 | 2026-10-29 | A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute | |
CVE-2026-66065 |
high | 8.4 | 0.0024 | 2026-10-29 | Ouroboros is a local-first runtime for AI coding agents that records their actions and app | |
CVE-2026-69243 |
medium | 6.3 | 0.0044 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-69244 |
high | 7.1 | 0.0053 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 |