Browse All CVEs
3,593 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57308 |
critical | 9.8 | 0.0083 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-62183 |
critical | 9.8 | 0.0069 | 2026-10-29 | Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user | |
CVE-2026-63071 |
critical | 9.8 | 0.0075 | 2026-10-29 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administra | |
CVE-2026-46412 |
critical | 10.0 | 0.0076 | 2026-10-29 | @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Serve | |
CVE-2026-41252 |
critical | 9.8 | 0.0111 | 2026-10-29 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds chec | |
CVE-2026-41521 |
critical | 9.1 | 0.0067 | 2026-10-29 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow v | |
CVE-2026-54051 |
critical | 9.9 | 0.0047 | 2026-10-29 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the a | |
CVE-2026-39878 |
critical | 9.3 | 0.0043 | 2026-10-29 | Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerabili | |
CVE-2026-12341 |
critical | 9.8 | 0.0040 | 2026-10-29 | This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attack | |
CVE-2026-60032 |
critical | 9.4 | 0.0041 | 2026-10-29 | Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 | |
CVE-2026-60034 |
critical | 9.4 | 0.0042 | 2026-10-29 | Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - | |
CVE-2026-61424 |
critical | 10.0 | 0.0044 | 2026-10-29 | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classif | |
CVE-2026-61425 |
critical | 9.4 | 0.0057 | 2026-10-29 | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla ext | |
CVE-2026-61900 |
critical | 10.0 | 0.0044 | 2026-10-29 | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownlo | |
CVE-2026-62414 |
critical | 9.1 | 0.0040 | 2026-10-29 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The | |
CVE-2026-64193 |
critical | 9.8 | 0.0144 | 2026-10-29 | Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED | |
CVE-2026-44231 |
critical | 9.1 | 0.0025 | 2026-10-29 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to | |
CVE-2026-63766 |
critical | 9.3 | 0.0215 | 2026-10-29 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.p | |
CVE-2026-63767 |
critical | 9.3 | 0.0112 | 2026-10-29 | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle d | |
CVE-2024-51311 |
critical | 9.8 | 0.0051 | 2026-10-29 | The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC f | |
CVE-2024-51313 |
critical | 9.8 | 0.0051 | 2026-10-29 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 f | |
CVE-2026-13380 |
critical | 9.0 | 0.0039 | 2026-10-29 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTT | |
CVE-2026-53595 |
critical | 9.4 | 0.0194 | 2026-10-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior t | |
CVE-2024-51312 |
critical | 9.8 | 0.0051 | 2026-10-29 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 f | |
CVE-2024-51314 |
critical | 9.8 | 0.0051 | 2026-10-29 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 f | |
CVE-2024-51315 |
critical | 9.8 | 0.0051 | 2026-10-29 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 f | |
CVE-2026-52656 |
critical | 9.8 | 0.0073 | 2026-10-29 | An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based | |
CVE-2026-64625 |
critical | 9.3 | 0.0060 | 2026-10-29 | AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wrap | |
CVE-2026-15899 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a | |
CVE-2026-15900 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote | |
CVE-2026-15901 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attack | |
CVE-2026-62415 |
critical | 9.1 | 0.0045 | 2026-10-29 | Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6. | |
CVE-2026-64608 |
critical | 9.8 | 0.0081 | 2026-10-29 | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. Wh | |
CVE-2026-64609 |
critical | 9.1 | 0.0078 | 2026-10-29 | Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserial | |
CVE-2026-64606 |
critical | 9.8 | 0.0078 | 2026-10-29 | Deserialization of untrusted data vulnerability that may allow class-registration checks t | |
CVE-2026-1617 |
critical | 9.8 | 0.0047 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-65008 |
critical | 9.3 | 0.0249 | 2026-10-29 | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::d | |
CVE-2026-16349 |
critical | 9.8 | 0.0030 | 2026-10-29 | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed i | |
CVE-2026-16350 |
critical | 9.8 | 0.0060 | 2026-10-29 | Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was | |
CVE-2026-16351 |
critical | 9.8 | 0.0058 | 2026-10-29 | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability | |
CVE-2026-16352 |
critical | 9.8 | 0.0058 | 2026-10-29 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnera | |
CVE-2026-16353 |
critical | 9.8 | 0.0060 | 2026-10-29 | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in F | |
CVE-2026-16355 |
critical | 9.8 | 0.0060 | 2026-10-29 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed i | |
CVE-2026-16356 |
critical | 9.8 | 0.0058 | 2026-10-29 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnera | |
CVE-2026-16357 |
critical | 9.8 | 0.0060 | 2026-10-29 | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in F | |
CVE-2026-16358 |
critical | 9.8 | 0.0030 | 2026-10-29 | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in | |
CVE-2026-16359 |
critical | 9.1 | 0.0047 | 2026-10-29 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fi | |
CVE-2026-16360 |
critical | 9.8 | 0.0061 | 2026-10-29 | Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bu | |
CVE-2026-16361 |
critical | 9.8 | 0.0057 | 2026-10-29 | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence o | |
CVE-2026-16363 |
critical | 9.8 | 0.0064 | 2026-10-29 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed |