Browse All CVEs
35,650 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-14504 |
high | 8.2 | 0.0037 | 2026-10-29 | An authorization bypass in Nexus Repository 3's component upload API allowed a user with o | |
CVE-2026-15392 |
high | 7.7 | 0.0020 | 2026-10-29 | DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to | |
CVE-2026-15697 |
low | 2.1 | 0.0045 | 2026-10-29 | A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventT | |
CVE-2026-15698 |
low | 2.1 | 0.0046 | 2026-10-29 | A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function upd | |
CVE-2026-15699 |
low | 2.1 | 0.0045 | 2026-10-29 | A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is th | |
CVE-2026-23573 |
medium | 6.1 | 0.0039 | 2026-10-29 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vu | |
CVE-2026-52838 |
low | 2.6 | 0.0022 | 2026-10-29 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow ad | |
CVE-2026-52839 |
low | 3.3 | 0.0018 | 2026-10-29 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctl | |
CVE-2026-52840 |
low | 2.7 | 0.0023 | 2026-10-29 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Cal | |
CVE-2026-52841 |
low | 3.1 | 0.0021 | 2026-10-29 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Goo | |
CVE-2026-55651 |
high | 7.1 | 0.0023 | 2026-10-29 | Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive D | |
CVE-2026-55954 |
critical | 9.1 | 0.0051 | 2026-10-29 | Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows accoun | |
CVE-2026-59198 |
high | 7.5 | 0.0031 | 2026-10-29 | Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder read | |
CVE-2026-59199 |
high | 7.5 | 0.0039 | 2026-10-29 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs c | |
CVE-2026-59203 |
high | 7.5 | 0.0040 | 2026-10-29 | Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL | |
CVE-2026-59204 |
high | 8.7 | 0.0039 | 2026-10-29 | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode | |
CVE-2026-59205 |
high | 7.5 | 0.0039 | 2026-10-29 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.a | |
CVE-2026-59835 |
high | 8.6 | 0.0040 | 2026-10-29 | A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 throug | |
CVE-2026-59836 |
critical | 9.8 | 0.0022 | 2026-10-29 | A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7 | |
CVE-2026-59837 |
medium | 6.6 | 0.0067 | 2026-10-29 | A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, Forti | |
CVE-2026-59839 |
medium | 5.5 | 0.0025 | 2026-10-29 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerabi | |
CVE-2026-59840 |
medium | 4.3 | 0.0031 | 2026-10-29 | A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 th | |
CVE-2026-59841 |
high | 7.5 | 0.0024 | 2026-10-29 | A improper restriction of communication channel to intended endpoints vulnerability in For | |
CVE-2026-60081 |
high | 7.5 | 0.0063 | 2026-10-29 | DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path ind | |
CVE-2026-60082 |
critical | 9.1 | 0.0065 | 2026-10-29 | DBI versions before 1.651 for Perl do not enforce statement handle consistency with the ro | |
CVE-2026-60118 |
medium | 6.9 | 0.0030 | 2026-10-29 | Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerabilit | |
CVE-2026-60119 |
medium | 5.1 | 0.0030 | 2026-10-29 | Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenti | |
CVE-2026-62641 |
medium | 6.5 | 0.0025 | 2026-10-29 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to | |
CVE-2026-62642 |
medium | 6.5 | 0.0028 | 2026-10-29 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered | |
CVE-2026-62643 |
critical | 10.0 | 0.0029 | 2026-10-29 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sh | |
CVE-2026-62644 |
critical | 9.8 | 0.0026 | 2026-10-29 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roun | |
CVE-2026-7494 |
medium | 5.3 | 0.0019 | 2026-10-29 | Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certifi | |
CVE-2026-9108 |
medium | 5.4 | 0.0018 | 2026-10-29 | A path traversal security issue exists within Studio 5000 Logix Designer® due to improper | |
CVE-2026-9127 |
high | 7.3 | 0.0015 | 2026-10-29 | A remote code execution security issue exists within Studio 5000 Logix Designer® due to in | |
CVE-2026-9128 |
high | 7.3 | 0.0017 | 2026-10-29 | A code execution security issue exists within Studio 5000 Logix Designer® due to an unquot | |
CVE-2026-9292 |
high | 8.4 | 0.0053 | 2026-10-29 | A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Privat | |
CVE-2026-9636 |
high | 8.2 | 0.0022 | 2026-10-29 | A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communicati | |
CVE-2026-14645 |
medium | 5.1 | 0.0036 | 2026-10-29 | Nexus Repository 3 does not validate the destination of the "Webhook: Global" capability's | |
CVE-2026-14646 |
medium | 4.9 | 0.0035 | 2026-10-29 | Nexus Repository 3 did not apply its existing Server-Side Request Forgery (SSRF) protectio | |
CVE-2026-15427 |
high | 8.6 | 0.0084 | 2026-10-29 | An OS command injection vulnerability exists in the TR-069 / CWMP management interface of | |
CVE-2026-15428 |
high | 8.5 | 0.0208 | 2026-10-29 | An OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input | |
CVE-2026-15429 |
medium | 5.1 | 0.0139 | 2026-10-29 | A privilege escalation vulnerability exists in the HTTP authentication component in Archer | |
CVE-2026-15701 |
high | 8.9 | 0.0110 | 2026-10-29 | A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this | |
CVE-2026-15703 |
medium | 5.5 | 0.0043 | 2026-10-29 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. T | |
CVE-2026-45496 |
medium | 5.5 | 0.0047 | 2026-10-29 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual S | |
CVE-2026-47282 |
medium | 6.5 | 0.0087 | 2026-10-29 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an un | |
CVE-2026-47632 |
high | 8.8 | 0.0050 | 2026-10-29 | Improper certificate validation in Azure Connected Machine Agent allows an unauthorized at | |
CVE-2026-49173 |
high | 7.8 | 0.0033 | 2026-10-29 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges local | |
CVE-2026-50338 |
high | 8.2 | 0.0052 | 2026-10-29 | 1 PoC | Improper authentication in Azure Spring Apps allows an authorized attacker to elevate priv |
CVE-2026-50520 |
high | 8.4 | 0.0035 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in Vis |