Browse All CVEs
35,092 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-14971 |
high | 7.0 | 0.0013 | 2026-10-29 | IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misco | |
CVE-2026-14979 |
high | 7.5 | 0.0055 | 2026-10-29 | IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7. | |
CVE-2026-15069 |
medium | 5.4 | 0.0030 | 2026-10-29 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute ar | |
CVE-2026-15091 |
critical | 9.3 | 0.0057 | 2026-10-29 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute ar | |
CVE-2026-15093 |
medium | 4.3 | 0.0037 | 2026-10-29 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect u | |
CVE-2026-15322 |
high | 7.5 | 0.0052 | 2026-10-29 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sen | |
CVE-2026-15415 |
medium | 6.8 | 0.0035 | 2026-10-29 | AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and w | |
CVE-2026-15995 |
medium | 4.2 | 0.0017 | 2026-10-29 | IBM Cognos Analytics 12.1.3 GA Version with build number through 12.1.3-2606251736 could a | |
CVE-2026-36669 |
critical | 9.8 | 0.0066 | 2026-10-29 | An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Of | |
CVE-2026-44974 |
high | 7.7 | 0.0047 | 2026-10-29 | @hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition | |
CVE-2026-45799 |
high | 7.5 | 0.0073 | 2026-10-29 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3 | |
CVE-2026-46420 |
critical | 9.8 | 0.0201 | 2026-10-29 | setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverag | |
CVE-2026-48373 |
high | 7.8 | 0.0034 | 2026-10-29 | Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result | |
CVE-2026-48504 |
medium | 5.3 | 0.0042 | 2026-10-29 | OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, Baggag | |
CVE-2026-48819 |
medium | 4.8 | 0.0027 | 2026-10-29 | Hey API is an ecosystem for turning API specifications into production-ready code. Prior t | |
CVE-2026-48978 |
low | 2.1 | 0.0021 | 2026-10-29 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows th | |
CVE-2026-49834 |
high | 7.5 | 0.0018 | 2026-10-29 | sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verif | |
CVE-2026-49852 |
high | 8.7 | 0.0017 | 2026-10-29 | joserfc is a Python library that provides an implementation of several JSON Object Signing | |
CVE-2026-4942 |
high | 7.5 | 0.0043 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted | |
CVE-2026-50151 |
high | 7.5 | 0.0038 | 2026-10-29 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/reposi | |
CVE-2026-50162 |
medium | 6.9 | 0.0044 | 2026-10-29 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in | |
CVE-2026-50163 |
high | 7.1 | 0.0040 | 2026-10-29 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in cont | |
CVE-2026-50197 |
high | 7.8 | 0.0051 | 2026-10-29 | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zal | |
CVE-2026-50289 |
high | 8.7 | 0.0218 | 2026-10-29 | systeminformation is a System and OS information library for node.js. Prior to 5.31.7, net | |
CVE-2026-52199 |
critical | 9.1 | 0.0066 | 2026-10-29 | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execut | |
CVE-2026-54463 |
medium | 6.9 | 0.0049 | 2026-10-29 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft | |
CVE-2026-54464 |
medium | 6.3 | 0.0044 | 2026-10-29 | ### Impact If this library is used in tandem with the `permessage-deflate` extension, a W | |
CVE-2026-54465 |
medium | 6.3 | 0.0049 | 2026-10-29 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when | |
CVE-2026-7667 |
high | 8.8 | 0.0056 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicio | |
CVE-2026-7754 |
medium | 6.5 | 0.0034 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forge | |
CVE-2026-7755 |
high | 8.8 | 0.0075 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to in | |
CVE-2026-7771 |
medium | 5.5 | 0.0015 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when comp | |
CVE-2026-7872 |
high | 8.1 | 0.0062 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary f | |
CVE-2026-8056 |
high | 8.8 | 0.0053 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component par | |
CVE-2026-8476 |
critical | 9.9 | 0.0097 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerabili | |
CVE-2026-8481 |
critical | 9.9 | 0.0088 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerabili | |
CVE-2026-8505 |
critical | 9.8 | 0.0087 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentica | |
CVE-2026-8635 |
critical | 9.9 | 0.0059 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to | |
CVE-2026-8859 |
critical | 9.9 | 0.0056 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary | |
CVE-2026-13445 |
high | 8.1 | 0.0035 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the S | |
CVE-2026-13446 |
critical | 9.8 | 0.0038 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password | |
CVE-2026-16074 |
low | 2.1 | 0.0035 | 2026-10-29 | A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the functio | |
CVE-2026-49977 |
medium | 4.3 | 0.0035 | 2026-10-29 | tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitr | |
CVE-2026-50271 |
high | 7.5 | 0.0079 | 2026-10-29 | Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libr | |
CVE-2026-50272 |
high | 7.5 | 0.0079 | 2026-10-29 | dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation | |
CVE-2026-50274 |
high | 7.5 | 0.0079 | 2026-10-29 | Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, | |
CVE-2026-53727 |
high | 8.9 | 0.0051 | 2026-10-29 | css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_fil | |
CVE-2026-54159 |
critical | 10.0 | 0.0075 | 2026-10-29 | PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 u | |
CVE-2026-54163 |
medium | 4.7 | 0.0021 | 2026-10-29 | secure_headers manages application of security headers with many safe defaults. Prior to 7 | |
CVE-2026-54242 |
medium | 4.9 | 0.0023 | 2026-10-29 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 an |