Browse All CVEs
36,280 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-13321 |
high | 8.6 | 0.0022 | 2026-10-29 | The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field p | |
CVE-2026-14985 |
high | 7.8 | 0.0017 | 2026-10-29 | The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege es | |
CVE-2026-2395 |
critical | 9.8 | 0.0047 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-48029 |
high | 7.1 | 0.0036 | 2026-10-29 | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 | |
CVE-2026-40712 |
high | 7.2 | 0.0050 | 2026-10-29 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input V | |
CVE-2026-40714 |
high | 7.2 | 0.0050 | 2026-10-29 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input V | |
CVE-2026-44276 |
medium | 4.4 | 0.0015 | 2026-10-29 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sens | |
CVE-2026-46737 |
high | 7.2 | 0.0063 | 2026-10-29 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input V | |
CVE-2026-46738 |
high | 7.2 | 0.0050 | 2026-10-29 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input V | |
CVE-2026-49499 |
high | 8.8 | 0.0042 | 2026-10-29 | Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Inc | |
CVE-2026-64828 |
medium | 5.3 | 0.0037 | 2026-10-29 | Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability tha | |
CVE-2026-64830 |
high | 8.7 | 0.0065 | 2026-10-29 | FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the Vob | |
CVE-2026-64831 |
high | 8.7 | 0.0085 | 2026-10-29 | FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vu | |
CVE-2026-65011 |
medium | 5.3 | 0.0038 | 2026-10-29 | Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in th | |
CVE-2026-65012 |
medium | 6.3 | 0.0044 | 2026-10-29 | InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in | |
CVE-2026-65013 |
high | 8.7 | 0.0052 | 2026-10-29 | Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorizati | |
CVE-2026-7328 |
medium | 6.8 | 0.0013 | 2026-10-29 | Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DE | |
CVE-2026-64832 |
high | 8.7 | 0.0034 | 2026-10-29 | FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC | |
CVE-2026-64833 |
high | 7.1 | 0.0040 | 2026-10-29 | FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/P | |
CVE-2026-64834 |
high | 8.7 | 0.0073 | 2026-10-29 | FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF | |
CVE-2026-64835 |
high | 8.7 | 0.0050 | 2026-10-29 | FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in | |
CVE-2026-16624 |
critical | 9.6 | 0.0036 | 2026-10-29 | Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticat | |
CVE-2026-22049 |
high | 8.7 | 0.0053 | 2026-10-29 | ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configure | |
CVE-2026-13055 |
high | 7.1 | 0.0040 | 2026-10-29 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to c | |
CVE-2026-13056 |
high | 7.1 | 0.0040 | 2026-10-29 | Using expressions that generate large arrays it is possible to craft a query that creates | |
CVE-2026-13057 |
medium | 6.0 | 0.0035 | 2026-10-29 | An issue in the server’s Atlas Search integration allows an authenticated user to bypass p | |
CVE-2026-13058 |
high | 7.1 | 0.0040 | 2026-10-29 | An authenticated user with basic write privileges can cause the mongod process to terminat | |
CVE-2026-13059 |
high | 8.6 | 0.0038 | 2026-10-29 | An authenticated user with low privileges may be able to perform unauthorized reads and wr | |
CVE-2026-13060 |
high | 7.1 | 0.0043 | 2026-10-29 | An authenticated user with limited read privileges may be able to access documents from co | |
CVE-2026-13061 |
medium | 5.3 | 0.0028 | 2026-10-29 | An authenticated user may be able to view session metadata belonging to other users on the | |
CVE-2026-13062 |
high | 7.1 | 0.0019 | 2026-10-29 | An authenticated user with write privileges on a Queryable Encryption-enabled collection m | |
CVE-2026-13063 |
medium | 5.3 | 0.0040 | 2026-10-29 | An authenticated user with standard read/write privileges can cause the mongod process to | |
CVE-2026-13064 |
high | 7.1 | 0.0045 | 2026-10-29 | Certain query operations involving deeply nested $jsonSchema constructs can trigger dispro | |
CVE-2026-13065 |
high | 7.1 | 0.0050 | 2026-10-29 | A user with read-only privileges is able to craft an aggregation pipeline using the $linea | |
CVE-2026-13066 |
high | 7.1 | 0.0037 | 2026-10-29 | Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side | |
CVE-2026-13067 |
high | 7.2 | 0.0010 | 2026-10-29 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 cl | |
CVE-2026-13068 |
low | 2.3 | 0.0025 | 2026-10-29 | An authenticated user holding cursor termination privileges on one database may incorrectl | |
CVE-2026-13069 |
high | 7.1 | 0.0029 | 2026-10-29 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a | |
CVE-2026-13070 |
medium | 6.0 | 0.0013 | 2026-10-29 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when proce | |
CVE-2026-13071 |
high | 7.1 | 0.0042 | 2026-10-29 | An authenticated user with read access can cause the mongod process to be terminated throu | |
CVE-2026-13072 |
critical | 9.2 | 0.0040 | 2026-10-29 | When compute mode is enabled on a standalone mongod instance, insufficient validation of e | |
CVE-2026-13073 |
medium | 5.3 | 0.0037 | 2026-10-29 | An authenticated user with read-only privileges can cause the mongod process to terminate | |
CVE-2026-13074 |
medium | 6.9 | 0.0044 | 2026-10-29 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server b | |
CVE-2026-13075 |
high | 7.1 | 0.0042 | 2026-10-29 | An authenticated user can cause the mongod process to be terminated by the operating syste | |
CVE-2026-13076 |
high | 7.1 | 0.0042 | 2026-10-29 | An authenticated user can cause a {{mongod}} process to be terminated by the operating sys | |
CVE-2026-13077 |
high | 7.1 | 0.0042 | 2026-10-29 | A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trig | |
CVE-2026-13078 |
medium | 6.3 | 0.0037 | 2026-10-29 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting eng | |
CVE-2026-14881 |
high | 8.4 | 0.0021 | 2026-10-29 | When importing connections in Compass it is possible to override some connection options t | |
CVE-2026-14899 |
high | 7.5 | 0.0047 | 2026-10-29 | The code to parse MIME headers for display when forwarding a message (if the setting to vi | |
CVE-2026-64829 |
critical | 9.1 | 0.0053 | 2026-10-29 | Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows at |