Browse All CVEs
35,852 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-15375 |
low | 2.1 | 0.0028 | 2026-10-29 | A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an un | |
CVE-2026-33382 |
high | 7.5 | 0.0039 | 2026-10-29 | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the | |
CVE-2026-54149 |
high | 8.8 | 0.0049 | 2026-10-29 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool impor | |
CVE-2026-55500 |
critical | 9.9 | 0.0048 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoin | |
CVE-2026-55501 |
high | 7.3 | 0.0038 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter i | |
CVE-2026-56676 |
high | 7.4 | 0.0019 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by res | |
CVE-2026-8595 |
medium | 5.4 | 0.0024 | 2026-10-29 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains | |
CVE-2026-8609 |
high | 7.5 | 0.0040 | 2026-10-29 | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique va | |
CVE-2026-15376 |
low | 2.1 | 0.0035 | 2026-10-29 | A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown | |
CVE-2026-15377 |
low | 2.1 | 0.0035 | 2026-10-29 | A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this v | |
CVE-2026-2398 |
high | 8.8 | 0.0045 | 2026-10-29 | Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation L | |
CVE-2026-39903 |
high | 7.1 | 0.0047 | 2026-10-29 | Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains | |
CVE-2026-3251 |
medium | 6.4 | 0.0025 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-51119 |
critical | 9.1 | 0.0054 | 2026-10-29 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the | |
CVE-2026-53653 |
high | 8.7 | 0.0052 | 2026-10-29 | Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows an unauthen | |
CVE-2026-53657 |
high | 8.2 | 0.0020 | 2026-10-29 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to | |
CVE-2026-54063 |
high | 7.5 | 0.0061 | 2026-10-29 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Pr | |
CVE-2026-54919 |
high | 7.4 | 0.0026 | 2026-10-29 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affec | |
CVE-2026-55638 |
high | 8.6 | 0.0658 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api | |
CVE-2026-55641 |
high | 8.2 | 0.0033 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LL | |
CVE-2026-55687 |
high | 7.5 | 0.0070 | 2026-10-29 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5 | |
CVE-2026-55780 |
low | 2.4 | 0.0056 | 2026-10-29 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1 | |
CVE-2026-55781 |
low | 2.4 | 0.0016 | 2026-10-29 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1 | |
CVE-2026-55782 |
low | 2.4 | 0.0018 | 2026-10-29 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1 | |
CVE-2026-55783 |
low | 2.4 | 0.0017 | 2026-10-29 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. Prior to 6.5.1 | |
CVE-2026-55885 |
medium | 6.8 | 0.0022 | 2026-10-29 | Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with ba | |
CVE-2026-55890 |
medium | 4.8 | 0.0050 | 2026-10-29 | Grav is a file-based Web platform. Prior to 2.0.0-rc.9, Grav's incomplete fix for stored X | |
CVE-2026-56675 |
high | 8.3 | 0.0050 | 2026-10-29 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as | |
CVE-2026-57167 |
medium | 5.1 | 0.0047 | 2026-10-29 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side | |
CVE-2026-58492 |
critical | 9.2 | 0.0053 | 2026-10-29 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableEx | |
CVE-2026-58493 |
medium | 5.1 | 0.0037 | 2026-10-29 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call | |
CVE-2026-59161 |
high | 8.7 | 0.0066 | 2026-10-29 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Pr | |
CVE-2026-59162 |
medium | 6.9 | 0.0066 | 2026-10-29 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Pr | |
CVE-2026-59180 |
low | 3.1 | 0.0030 | 2026-10-29 | Apprise is an open source library which allows you to send a notification to almost all of | |
CVE-2026-59190 |
high | 8.7 | 0.0027 | 2026-10-29 | grav-plugin-admin is an HTML user interface that provides a way to configure Grav and crea | |
CVE-2026-59193 |
medium | 6.9 | 0.0060 | 2026-10-29 | Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can c | |
CVE-2026-2397 |
critical | 9.8 | 0.0048 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-57474 |
medium | 6.9 | 0.0051 | 2026-10-29 | Deloitte AI Assist for Customer disclosed some configuration information through public-fa | |
CVE-2026-57475 |
medium | 6.9 | 0.0060 | 2026-10-29 | Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-faci | |
CVE-2026-57476 |
medium | 6.3 | 0.0044 | 2026-10-29 | Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an atta | |
CVE-2026-15146 |
medium | 5.9 | 0.0017 | 2026-10-29 | GNU Wget versions < 1.25.0+4f85853f64 do not validate the IP address provided by an FTP PA | |
CVE-2026-54329 |
high | 7.7 | 0.0039 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API cre | |
CVE-2026-55460 |
high | 7.1 | 0.0044 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-ad | |
CVE-2026-55464 |
medium | 4.8 | 0.0029 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw | |
CVE-2026-55472 |
medium | 4.3 | 0.0033 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Comp | |
CVE-2026-55474 |
high | 7.1 | 0.0048 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::di | |
CVE-2026-55476 |
medium | 5.3 | 0.0034 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{ | |
CVE-2026-55478 |
medium | 5.3 | 0.0029 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_ | |
CVE-2026-55516 |
high | 7.7 | 0.0038 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/ma | |
CVE-2026-55843 |
high | 7.0 | 0.0054 | 2026-10-29 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update |