Browse All CVEs
36,068 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-65759 |
high | 8.7 | 0.0043 | 2026-10-29 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store ex | |
CVE-2026-65760 |
critical | 9.2 | 0.0042 | 2026-10-29 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosu | |
CVE-2026-65761 |
critical | 9.3 | 0.0104 | 2026-10-29 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension | |
CVE-2026-47743 |
high | 8.7 | 0.0038 | 2026-10-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on adm | |
CVE-2026-47752 |
critical | 9.9 | 0.0044 | 2026-10-29 | Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior | |
CVE-2026-47755 |
medium | 6.5 | 0.0035 | 2026-10-29 | ITFlow provides an IT documentation, ticketing and accounting system for small managed ser | |
CVE-2026-47769 |
medium | 5.3 | 0.0047 | 2026-10-29 | APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production | |
CVE-2026-65699 |
low | 2.3 | 0.0028 | 2026-10-29 | AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulner | |
CVE-2026-65700 |
critical | 9.3 | 0.0152 | 2026-10-29 | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible file | |
CVE-2026-65701 |
critical | 9.3 | 0.0069 | 2026-10-29 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vuln | |
CVE-2026-65702 |
high | 8.8 | 0.0058 | 2026-10-29 | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationS | |
CVE-2026-65762 |
medium | 5.1 | 0.0044 | 2026-10-29 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - | |
CVE-2026-65763 |
medium | 5.1 | 0.0044 | 2026-10-29 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Impr | |
CVE-2026-65918 |
high | 7.1 | 0.0044 | 2026-10-29 | PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds hea | |
CVE-2026-65920 |
medium | 5.3 | 0.0040 | 2026-10-29 | Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability | |
CVE-2026-6516 |
critical | 10.0 | 0.0473 | 2026-10-29 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Re | |
CVE-2026-15687 |
low | 2.4 | 0.0038 | 2026-10-29 | A security issue was discovered in the Kubernetes Java client library where a compromised | |
CVE-2026-16756 |
high | 8.7 | 0.0075 | 2026-10-29 | Missing connection and header-read timeouts and the absence of a concurrent-connection cap | |
CVE-2026-65010 |
medium | 4.4 | 0.0017 | 2026-10-29 | Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability | |
CVE-2026-25800 |
high | 7.5 | 0.0084 | 2026-10-29 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. | |
CVE-2026-47722 |
high | 8.7 | 0.0047 | 2026-10-29 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. | |
CVE-2026-63359 |
critical | 9.3 | 0.0075 | 2026-10-29 | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) application | |
CVE-2026-64785 |
medium | 5.3 | 0.0029 | 2026-10-29 | SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP | |
CVE-2026-65703 |
high | 8.5 | 0.0033 | 2026-10-29 | FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC | |
CVE-2026-65705 |
high | 7.3 | 0.0019 | 2026-10-29 | FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_f | |
CVE-2026-65706 |
high | 8.5 | 0.0019 | 2026-10-29 | FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_s | |
CVE-2026-10697 |
critical | 9.8 | 0.0060 | 2026-10-29 | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOV | |
CVE-2026-15966 |
critical | 9.8 | 0.0037 | 2026-10-29 | Permissive cross-domain security policy with untrusted domains vulnerability in Progress M | |
CVE-2026-15967 |
critical | 9.8 | 0.0037 | 2026-10-29 | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue aff | |
CVE-2026-15968 |
medium | 5.4 | 0.0033 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-16002 |
high | 8.8 | 0.0043 | 2026-10-29 | The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker t | |
CVE-2026-16796 |
high | 8.4 | 0.0073 | 2026-10-29 | Improper neutralization of argument delimiters in the install_packages() method in AWS Bed | |
CVE-2026-21653 |
high | 7.2 | 0.0039 | 2026-10-29 | Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server all | |
CVE-2026-21655 |
high | 8.7 | 0.0049 | 2026-10-29 | Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, John | |
CVE-2026-34496 |
high | 7.1 | 0.0033 | 2026-10-29 | Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This is | |
CVE-2026-47723 |
high | 7.1 | 0.0053 | 2026-10-29 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. | |
CVE-2026-47724 |
critical | 9.9 | 0.0048 | 2026-10-29 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. | |
CVE-2026-49035 |
critical | 9.2 | 0.0061 | 2026-10-29 | The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initi | |
CVE-2026-50032 |
high | 8.7 | 0.0046 | 2026-10-29 | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a | |
CVE-2026-50039 |
high | 8.7 | 0.0046 | 2026-10-29 | The affected product is vulnerable to a stack-based buffer overflow, which may allow an at | |
CVE-2026-50103 |
high | 7.1 | 0.0027 | 2026-10-29 | A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a ne | |
CVE-2026-52439 |
critical | 9.8 | 0.0068 | 2026-10-29 | An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via t | |
CVE-2026-6924 |
high | 8.7 | 0.0044 | 2026-10-29 | A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. | |
CVE-2026-16763 |
low | 1.9 | 0.0122 | 2026-10-29 | A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affect | |
CVE-2026-16764 |
low | 2.1 | 0.0041 | 2026-10-29 | A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function | |
CVE-2026-16765 |
medium | 5.5 | 0.0043 | 2026-10-29 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue i | |
CVE-2026-16804 |
high | 8.3 | 0.0030 | 2026-10-29 | Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker | |
CVE-2026-16805 |
high | 8.8 | 0.0041 | 2026-10-29 | Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker | |
CVE-2026-16806 |
high | 8.8 | 0.0052 | 2026-10-29 | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacke | |
CVE-2026-16807 |
high | 8.8 | 0.0034 | 2026-10-29 | Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote at |