Browse All CVEs
35,711 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-59245 |
high | 8.1 | 0.0060 | 2026-10-29 | In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the g | |
CVE-2026-13221 |
critical | 9.1 | 0.0049 | 2026-10-29 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 | |
CVE-2026-57432 |
high | 8.4 | 0.0021 | 2026-10-29 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 | |
CVE-2026-57433 |
critical | 9.8 | 0.0047 | 2026-10-29 | Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a | |
CVE-2026-61462 |
critical | 9.2 | 0.0048 | 2026-10-29 | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index. | |
CVE-2026-61463 |
high | 8.7 | 0.0047 | 2026-10-29 | Shiori contains a privilege escalation vulnerability in the account update endpoint that a | |
CVE-2026-61500 |
critical | 9.3 | 0.0191 | 2026-10-29 | Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-crypto | |
CVE-2026-61501 |
medium | 5.3 | 0.0042 | 2026-10-29 | Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML wi | |
CVE-2026-61502 |
medium | 5.1 | 0.0022 | 2026-10-29 | Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and | |
CVE-2026-61503 |
medium | 6.9 | 0.0044 | 2026-10-29 | Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endp | |
CVE-2026-61504 |
medium | 5.1 | 0.0024 | 2026-10-29 | Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web lis | |
CVE-2026-61505 |
medium | 6.9 | 0.0052 | 2026-10-29 | Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, pe | |
CVE-2026-14906 |
medium | 5.3 | 0.0029 | 2026-10-29 | Pages with malicious titles could potentially allow saved PDF content to overwrite PDF fil | |
CVE-2026-49969 |
medium | 5.3 | 0.0042 | 2026-10-29 | Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that al | |
CVE-2026-49970 |
high | 8.7 | 0.0103 | 2026-10-29 | Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitiz | |
CVE-2026-49971 |
medium | 5.3 | 0.0036 | 2026-10-29 | Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that al | |
CVE-2026-49972 |
high | 7.7 | 0.0108 | 2026-10-29 | Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthentic | |
CVE-2026-55772 |
high | 8.8 | 0.0048 | 2026-10-29 | CedarJava is an open source Java implementation of the Cedar policy language, used for fin | |
CVE-2026-58228 |
medium | 5.1 | 0.0047 | 2026-10-29 | Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacke | |
CVE-2026-6875 |
critical | 9.5 | 0.0143 | 2026-10-29 | ServiceNow has addressed a remote code execution vulnerability that was identified in the | |
CVE-2026-55771 |
high | 8.8 | 0.0057 | 2026-10-29 | CedarJava is an open source Java implementation of the Cedar policy language, used for fin | |
CVE-2026-55773 |
high | 8.8 | 0.0052 | 2026-10-29 | CedarJava is an open source Java implementation of the Cedar policy language, used for fin | |
CVE-2026-58408 |
medium | 6.5 | 0.0036 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privil | |
CVE-2026-15594 |
low | 2.9 | 0.0046 | 2026-10-29 | A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stableP | |
CVE-2026-15595 |
low | 2.1 | 0.0047 | 2026-10-29 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Th | |
CVE-2026-48363 |
high | 8.2 | 0.0027 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Pat | |
CVE-2026-48364 |
high | 8.2 | 0.0027 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Pat | |
CVE-2026-58409 |
critical | 9.1 | 0.0057 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authentic | |
CVE-2026-58410 |
high | 7.1 | 0.0021 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an | |
CVE-2026-15596 |
low | 2.1 | 0.0047 | 2026-10-29 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Th | |
CVE-2026-15597 |
medium | 5.5 | 0.0043 | 2026-10-29 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1. | |
CVE-2026-15598 |
medium | 5.3 | 0.0042 | 2026-10-29 | A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedVa | |
CVE-2026-15680 |
high | 7.5 | 0.0041 | 2026-10-29 | Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution | |
CVE-2026-15683 |
high | 7.5 | 0.0015 | 2026-10-29 | Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Valida | |
CVE-2026-15684 |
high | 7.3 | 0.0019 | 2026-10-29 | Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vu | |
CVE-2026-51821 |
critical | 9.8 | 0.0069 | 2026-10-29 | SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remo | |
CVE-2026-56877 |
medium | 6.3 | 0.0039 | 2026-10-29 | The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does n | |
CVE-2026-58411 |
high | 7.0 | 0.0043 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site S | |
CVE-2026-58500 |
high | 8.2 | 0.0040 | 2026-10-29 | MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app | |
CVE-2026-59801 |
critical | 9.3 | 0.0262 | 2026-10-29 | 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allow | |
CVE-2026-61458 |
high | 8.7 | 0.0038 | 2026-10-29 | PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/acc | |
CVE-2026-62184 |
high | 8.7 | 0.0056 | 2026-10-29 | luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts th | |
CVE-2026-62185 |
high | 8.6 | 0.0046 | 2026-10-29 | Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing an | |
CVE-2026-62186 |
high | 7.2 | 0.0033 | 2026-10-29 | OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI- | |
CVE-2026-62187 |
high | 8.6 | 0.0037 | 2026-10-29 | OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore | |
CVE-2026-62188 |
high | 8.6 | 0.0037 | 2026-10-29 | OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization | |
CVE-2026-62189 |
high | 7.6 | 0.0037 | 2026-10-29 | OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror | |
CVE-2026-62190 |
high | 8.7 | 0.0051 | 2026-10-29 | OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flo | |
CVE-2026-62191 |
high | 7.1 | 0.0036 | 2026-10-29 | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability i | |
CVE-2026-62192 |
high | 7.2 | 0.0042 | 2026-10-29 | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability i |