Browse All CVEs
10,485 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-95720 |
medium | 4.4 | 0.0015 | 2026-10-29 | A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker | |
CVE-2026-115398 |
medium | 6.8 | 0.0018 | 2026-10-29 | Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSyst | |
CVE-2026-115503 |
medium | 6.8 | 0.0013 | 2026-10-29 | Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability i | |
CVE-2026-115507 |
medium | 5.1 | 0.0020 | 2026-10-29 | Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationa | |
CVE-2026-114583 |
medium | 6.9 | 0.0023 | 2026-10-29 | tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with e | |
CVE-2026-105265 |
medium | 6.0 | 0.0039 | 2026-10-29 | A vulnerability exists in the the time zone parameter and does not properly validate user | |
CVE-2026-111100 |
medium | 6.9 | 0.0039 | 2026-10-29 | The ONVIF device service on the E3 responds to certain informational requests without requ | |
CVE-2026-114617 |
medium | 4.2 | 0.0027 | 2026-10-29 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, | |
CVE-2026-114618 |
medium | 6.8 | 0.0035 | 2026-10-29 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, | |
CVE-2026-114619 |
medium | 4.6 | 0.0016 | 2026-10-29 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, | |
CVE-2026-114620 |
medium | 5.4 | 0.0039 | 2026-10-29 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, | |
CVE-2026-115221 |
medium | 5.4 | 0.0014 | 2026-10-29 | A flaw was found in FreeIPA. An improper authorization check allows an authenticated host | |
CVE-2026-115424 |
medium | 5.5 | 0.0016 | 2026-10-29 | A flaw was found in the OpenShift client oc. When extracting container image layers with o | |
CVE-2026-110491 |
medium | 6.9 | 0.0052 | 2026-10-29 | The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplet | |
CVE-2026-115485 |
medium | 6.3 | 0.0020 | 2026-10-29 | A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls s | |
CVE-2026-115535 |
medium | 4.8 | 0.0021 | 2026-10-29 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067 | |
CVE-2026-115638 |
medium | 4.3 | 0.0022 | 2026-10-29 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results | |
CVE-2026-54615 |
medium | 6.0 | 0.0037 | 2026-10-29 | Part-DB is an open source inventory management system for electronic components. Prior to | |
CVE-2026-54631 |
medium | 6.3 | 0.0019 | 2026-10-29 | Part-DB is an open source inventory management system for electronic components. Prior to | |
CVE-2026-55600 |
medium | 5.7 | 0.0044 | 2026-10-29 | Part-DB is an open source inventory management system for electronic components. Prior to | |
CVE-2026-89419 |
medium | 5.0 | 0.0029 | 2026-10-29 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting o | |
CVE-2026-90458 |
medium | 5.4 | 0.0028 | 2026-10-29 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete | |
CVE-2026-55835 |
medium | 6.9 | 0.0039 | 2026-10-29 | Lookyloo is a web interface that allows users to capture a website page and then display a | |
CVE-2026-59188 |
medium | 5.4 | 0.0015 | 2026-10-29 | Part-DB is an open source inventory management system for electronic components. Prior to | |
CVE-2026-86018 |
medium | 5.3 | 0.0040 | 2026-10-29 | Part-DB is an open source inventory management system for electronic components. Prior to | |
CVE-2026-86019 |
medium | 5.3 | 0.0037 | 2026-10-29 | Part-DB is an open source inventory management system for electronic components. Prior to | |
CVE-2026-86020 |
medium | 4.6 | 0.0015 | 2026-10-29 | Part-DB is an open source inventory management system for electronic components. Prior to | |
CVE-2026-109933 |
medium | 6.8 | 0.0031 | 2026-10-29 | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user | |
CVE-2026-109934 |
medium | 5.3 | 0.0028 | 2026-10-29 | The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a pos | |
CVE-2026-109935 |
medium | 5.3 | 0.0028 | 2026-10-29 | The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility cond | |
CVE-2026-111738 |
medium | 5.5 | 0.0028 | 2026-10-29 | The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege | |
CVE-2026-111966 |
medium | 6.8 | 0.0031 | 2026-10-29 | The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one o | |
CVE-2026-112219 |
medium | 4.9 | 0.0033 | 2026-10-29 | The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management | |
CVE-2026-113472 |
medium | 5.4 | 0.0023 | 2026-10-29 | The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly vali | |
CVE-2026-94264 |
medium | 6.8 | 0.0031 | 2026-10-29 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fiel | |
CVE-2026-63243 |
medium | 4.3 | 0.0021 | 2026-10-29 | An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creati | |
CVE-2026-4950 |
medium | 4.8 | 0.0031 | 2026-10-29 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privil | |
CVE-2026-4951 |
medium | 5.1 | 0.0036 | 2026-10-29 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privil | |
CVE-2026-4952 |
medium | 5.1 | 0.0028 | 2026-10-29 | The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", | |
CVE-2025-30051 |
medium | 6.8 | 0.0010 | 2026-10-29 | The CGM CLININET application stores the production database login and password, as well as | |
CVE-2025-30053 |
medium | 6.9 | 0.0035 | 2026-10-29 | The CGM CLININET application runs the cgm-updater process listening on an open network por | |
CVE-2025-58403 |
medium | 5.1 | 0.0050 | 2026-10-29 | CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutral | |
CVE-2026-112821 |
medium | 6.5 | 0.0021 | 2026-10-29 | Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorr | |
CVE-2026-112825 |
medium | 6.5 | 0.0027 | 2026-10-29 | Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manag | |
CVE-2026-115657 |
medium | 4.8 | 0.0014 | 2026-10-29 | When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Pla | |
CVE-2026-89312 |
medium | 6.9 | 0.0028 | 2026-10-29 | `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without | |
CVE-2026-89313 |
medium | 6.3 | 0.0023 | 2026-10-29 | `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** whi | |
CVE-2026-89314 |
medium | 6.9 | 0.0025 | 2026-10-29 | `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested l | |
CVE-2026-89315 |
medium | 6.9 | 0.0025 | 2026-10-29 | `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising | |
CVE-2026-89316 |
medium | 6.3 | 0.0021 | 2026-10-29 | `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap |