Browse All CVEs
10,485 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-89317 |
medium | 6.3 | 0.0015 | 2026-10-29 | gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 § | |
CVE-2026-89318 |
medium | 6.9 | 0.0017 | 2026-10-29 | `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `ciph | |
CVE-2026-89319 |
medium | 6.3 | 0.0021 | 2026-10-29 | `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` pr | |
CVE-2026-105963 |
medium | 5.1 | 0.0051 | 2026-10-29 | Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_ | |
CVE-2026-111965 |
medium | 4.3 | 0.0026 | 2026-10-29 | The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA ve | |
CVE-2026-115722 |
medium | 6.9 | 0.0013 | 2026-10-29 | RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_h | |
CVE-2026-94263 |
medium | 4.8 | 0.0020 | 2026-10-29 | The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress pl | |
CVE-2026-115749 |
medium | 4.8 | 0.0022 | 2026-10-29 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbi | |
CVE-2026-115750 |
medium | 6.3 | 0.0022 | 2026-10-29 | mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that | |
CVE-2026-115751 |
medium | 6.3 | 0.0025 | 2026-10-29 | Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery | |
CVE-2026-55190 |
medium | 6.5 | 0.0026 | 2026-10-29 | Event Schedule is an open-source platform to share events, sell tickets and bring communit | |
CVE-2026-55422 |
medium | 4.6 | 0.0016 | 2026-10-29 | conda-forge is a GitHub organization containing repositories of conda recipes. In commits | |
CVE-2026-114623 |
medium | 6.5 | 0.0065 | 2026-10-29 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 befo | |
CVE-2026-115479 |
medium | 5.3 | 0.0030 | 2026-10-29 | baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 befo | |
CVE-2026-115480 |
medium | 5.3 | 0.0032 | 2026-10-29 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 befo | |
CVE-2026-115785 |
medium | 4.3 | 0.0073 | 2026-10-29 | An SMTP command injection vulnerability in the data-source testing functionality of Zimbra | |
CVE-2026-115786 |
medium | 6.5 | 0.0037 | 2026-10-29 | A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an aut | |
CVE-2026-55606 |
medium | 6.5 | 0.0047 | 2026-10-29 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions | |
CVE-2026-57207 |
medium | 5.9 | 0.0040 | 2026-10-29 | NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to | |
CVE-2026-57208 |
medium | 6.2 | 0.0038 | 2026-10-29 | Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, | |
CVE-2026-93627 |
medium | 5.3 | 0.0027 | 2026-10-29 | An organizer authentication vulnerability in the email calendar processing of Zimbra Colla | |
CVE-2026-93628 |
medium | 5.3 | 0.0027 | 2026-10-29 | An attendee authentication vulnerability in the email calendar processing of Zimbra Collab | |
CVE-2026-93629 |
medium | 5.3 | 0.0027 | 2026-10-29 | An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an un | |
CVE-2026-93630 |
medium | 4.3 | 0.0029 | 2026-10-29 | A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collabora | |
CVE-2026-93633 |
medium | 5.4 | 0.0023 | 2026-10-29 | A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticat | |
CVE-2026-93634 |
medium | 4.3 | 0.0027 | 2026-10-29 | A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an | |
CVE-2026-93636 |
medium | 4.3 | 0.0034 | 2026-10-29 | An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authe | |
CVE-2026-93638 |
medium | 6.1 | 0.0030 | 2026-10-29 | A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration S | |
CVE-2026-112333 |
medium | 5.1 | 0.0014 | 2026-10-29 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Mail | |
CVE-2026-46346 |
medium | 6.5 | 0.0033 | 2026-10-29 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-46347 |
medium | 6.8 | 0.0025 | 2026-10-29 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-46531 |
medium | 5.5 | 0.0030 | 2026-10-29 | Cacti is an open source performance and fault management framework. From version 1.2.27 to | |
CVE-2026-49442 |
medium | 5.3 | 0.0024 | 2026-10-29 | Cacti is an open source performance and fault management framework. Prior to version 1.2.3 | |
CVE-2026-55222 |
medium | 5.1 | 0.0013 | 2026-10-29 | Isar is an integration system for automated root filesystem generation. In versions 0.11 a | |
CVE-2026-55442 |
medium | 5.3 | 0.0026 | 2026-10-29 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-55444 |
medium | 5.3 | 0.0025 | 2026-10-29 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-55463 |
medium | 6.5 | 0.0014 | 2026-10-29 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-55465 |
medium | 5.3 | 0.0026 | 2026-10-29 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-105481 |
medium | 6.5 | 0.0032 | 2026-10-29 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a resp | |
CVE-2026-106072 |
medium | 6.7 | 0.0062 | 2026-10-29 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to au | |
CVE-2026-106074 |
medium | 4.8 | 0.0033 | 2026-10-29 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID() | |
CVE-2026-115810 |
medium | 6.3 | 0.0039 | 2026-10-29 | Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the P | |
CVE-2026-115567 |
medium | 5.8 | 0.0011 | 2026-10-29 | Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between | |
CVE-2026-115813 |
medium | 6.9 | 0.0036 | 2026-10-29 | Server-side request forgery in the model download path in Amazon Web Services Multi Model | |
CVE-2026-115845 |
medium | 5.3 | 0.0031 | 2026-10-29 | An incomplete list of disallowed inputs in the Python code validator of the run_script too | |
CVE-2026-79980 |
medium | 5.6 | 0.0017 | 2026-10-29 | The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier | |
CVE-2026-79981 |
medium | 6.5 | 0.0012 | 2026-10-29 | The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured | |
CVE-2026-115774 |
medium | 4.9 | 0.0052 | 2026-10-29 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Pri | |
CVE-2026-115800 |
medium | 4.8 | 0.0014 | 2026-10-29 | A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected elemen | |
CVE-2026-115877 |
medium | 5.4 | 0.0026 | 2026-10-29 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Pri |