Browse All CVEs
3,587 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-59147 |
critical | 9.8 | 0.0055 | 2026-10-29 | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writ | |
CVE-2026-64878 |
critical | 9.4 | 0.0080 | 2026-10-29 | Unvalidated input in asset filter parameters allows shell metacharacters to escape command | |
CVE-2026-64879 |
critical | 9.4 | 0.0226 | 2026-10-29 | A filename supplied during file upload is not properly sanitized before being used in syst | |
CVE-2026-33646 |
critical | 9.6 | 0.0046 | 2026-10-29 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise p | |
CVE-2026-46386 |
critical | 9.9 | 0.0049 | 2026-10-29 | OpenProject is open-source, web-based project management software. Prior to , the official | |
CVE-2026-52780 |
critical | 9.6 | 0.0039 | 2026-10-29 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17. | |
CVE-2026-52782 |
critical | 9.9 | 0.0045 | 2026-10-29 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17. | |
CVE-2026-52785 |
critical | 9.9 | 0.0038 | 2026-10-29 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17. | |
CVE-2026-49869 |
critical | 10.0 | 0.0209 | 2026-10-29 | KEV | Kestra OSS contains an OS command injection vulnerability that could allow an unauthentica |
CVE-2026-53576 |
critical | 10.0 | 0.0330 | 2026-10-29 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, | |
CVE-2026-58053 |
critical | 9.4 | 0.0044 | 2026-10-29 | Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's contain | |
CVE-2026-56290 |
critical | 10.0 | 0.3087 | 2026-10-29 | KEV | Joomlack Page Builder contains an improper access control vulnerability that could allow f |
CVE-2026-57331 |
critical | 9.9 | 0.0055 | 2026-10-29 | Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions. | |
CVE-2026-41052 |
critical | 9.4 | 0.0042 | 2026-10-29 | Improper privilege handling could be used by users with Project Owner role to escalate pri | |
CVE-2026-13751 |
critical | 9.6 | 0.0020 | 2026-10-29 | Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 a | |
CVE-2026-11720 |
critical | 9.3 | 0.0053 | 2026-10-29 | A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolb | |
CVE-2026-56782 |
critical | 9.3 | 0.0356 | 2026-10-29 | Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and / | |
CVE-2026-37637 |
critical | 9.1 | 0.0060 | 2026-10-29 | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code | |
CVE-2026-57498 |
critical | 9.6 | 0.0032 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-53434 |
critical | 9.1 | 0.0059 | 2026-10-29 | Detection of Error Condition Without Action vulnerability in Apache Tomcat when configurin | |
CVE-2026-55276 |
critical | 9.1 | 0.0061 | 2026-10-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that spe | |
CVE-2026-12818 |
critical | 9.3 | 0.0043 | 2026-10-29 | Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability with | |
CVE-2026-12819 |
critical | 9.3 | 0.0054 | 2026-10-29 | Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without a | |
CVE-2026-9711 |
critical | 9.8 | 0.0054 | 2026-10-29 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulne | |
CVE-2026-13766 |
critical | 9.8 | 0.0055 | 2026-10-29 | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL iden | |
CVE-2026-14162 |
critical | 9.3 | 0.0063 | 2026-10-29 | Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerabi | |
CVE-2026-53690 |
critical | 9.3 | 0.0051 | 2026-10-29 | An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" para | |
CVE-2026-8402 |
critical | 9.8 | 0.0047 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-58116 |
critical | 9.3 | 0.0090 | 2026-10-29 | LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows att | |
CVE-2026-14241 |
critical | 9.8 | 0.0043 | 2026-10-29 | Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memor | |
CVE-2026-48276 |
critical | 10.0 | 0.0126 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of | |
CVE-2026-48277 |
critical | 10.0 | 0.0129 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-48281 |
critical | 10.0 | 0.0142 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-48282 |
critical | 10.0 | 0.4239 | 2026-10-29 | KEV | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code |
CVE-2026-48283 |
critical | 10.0 | 0.0126 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of | |
CVE-2026-48286 |
critical | 10.0 | 0.0117 | 2026-10-29 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Inco | |
CVE-2026-48313 |
critical | 9.3 | 0.0295 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of | |
CVE-2026-48315 |
critical | 9.3 | 0.0103 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-58172 |
critical | 9.3 | 0.0056 | 2026-10-29 | Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnera | |
CVE-2026-58370 |
critical | 9.2 | 0.0072 | 2026-10-29 | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Aut | |
CVE-2026-58138 |
critical | 9.3 | 0.0914 | 2026-10-29 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vu | |
CVE-2026-10109 |
critical | 9.8 | 0.0086 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code exec | |
CVE-2026-10134 |
critical | 10.0 | 0.0232 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to | |
CVE-2026-10140 |
critical | 9.6 | 0.0035 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling t | |
CVE-2026-10560 |
critical | 9.1 | 0.0048 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /a | |
CVE-2026-11546 |
critical | 9.8 | 0.0040 | 2026-10-29 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a serv | |
CVE-2026-11708 |
critical | 9.3 | 0.0038 | 2026-10-29 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulner | |
CVE-2026-11712 |
critical | 9.3 | 0.0038 | 2026-10-29 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulner | |
CVE-2026-11714 |
critical | 9.8 | 0.0037 | 2026-10-29 | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vuln | |
CVE-2026-13449 |
critical | 9.1 | 0.0041 | 2026-10-29 | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML |