Browse All CVEs
34,512 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57340 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions. | |
CVE-2026-57341 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes | |
CVE-2026-13437 |
medium | 6.5 | 0.0044 | 2026-10-29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions P | |
CVE-2026-13580 |
high | 7.4 | 0.0080 | 2026-10-29 | A security vulnerability has been detected in Edimax EW-7478APC 1.04. This affects the fun | |
CVE-2026-13581 |
low | 2.1 | 0.0238 | 2026-10-29 | A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerability affects the fun | |
CVE-2026-13582 |
high | 7.4 | 0.0080 | 2026-10-29 | A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAc | |
CVE-2026-13583 |
high | 7.4 | 0.0080 | 2026-10-29 | A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the function formUSB | |
CVE-2026-13587 |
low | 2.9 | 0.0042 | 2026-10-29 | A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the functi | |
CVE-2026-13742 |
medium | 5.9 | 0.0012 | 2026-10-29 | Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an impro | |
CVE-2026-13744 |
high | 8.8 | 0.0046 | 2026-10-29 | Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to | |
CVE-2026-13746 |
medium | 5.4 | 0.0022 | 2026-10-29 | Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 al | |
CVE-2026-13748 |
medium | 6.3 | 0.0019 | 2026-10-29 | Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allow | |
CVE-2026-13749 |
high | 8.8 | 0.0054 | 2026-10-29 | Improper neutralization in the Snowpark annotation processor callback template in Snowflak | |
CVE-2026-13750 |
medium | 5.5 | 0.0015 | 2026-10-29 | Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 | |
CVE-2026-41052 |
critical | 9.4 | 0.0042 | 2026-10-29 | Improper privilege handling could be used by users with Project Owner role to escalate pri | |
CVE-2026-9105 |
medium | 6.8 | 0.0112 | 2026-10-29 | An authenticated stack-based buffer overflow vulnerability exists in the web management in | |
CVE-2026-13588 |
low | 2.9 | 0.0038 | 2026-10-29 | A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the f | |
CVE-2026-13589 |
low | 2.9 | 0.0039 | 2026-10-29 | A vulnerability was identified in seladb PcapPlusPlus 25.05. This affects the function pcp | |
CVE-2026-13590 |
low | 2.9 | 0.0047 | 2026-10-29 | A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the functio | |
CVE-2026-13591 |
low | 1.3 | 0.0032 | 2026-10-29 | A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTracke | |
CVE-2026-13751 |
critical | 9.6 | 0.0020 | 2026-10-29 | Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 a | |
CVE-2026-13752 |
high | 8.0 | 0.0033 | 2026-10-29 | Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unin | |
CVE-2026-11720 |
critical | 9.3 | 0.0053 | 2026-10-29 | A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolb | |
CVE-2026-13592 |
medium | 5.5 | 0.0064 | 2026-10-29 | A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6 | |
CVE-2026-56285 |
high | 7.7 | 0.0046 | 2026-10-29 | Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domai | |
CVE-2026-56781 |
medium | 6.9 | 0.0040 | 2026-10-29 | Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability | |
CVE-2026-56782 |
critical | 9.3 | 0.0356 | 2026-10-29 | Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and / | |
CVE-2026-56783 |
high | 7.1 | 0.0035 | 2026-10-29 | Parseable before 2.9.2 contains an information disclosure vulnerability in the notificatio | |
CVE-2026-57942 |
medium | 6.9 | 0.0023 | 2026-10-29 | LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerabili | |
CVE-2026-57946 |
medium | 6.3 | 0.0035 | 2026-10-29 | Invidious before version 2.20260626.0 contains a broken access control vulnerability that | |
CVE-2026-57947 |
medium | 6.3 | 0.0033 | 2026-10-29 | Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook | |
CVE-2026-57948 |
high | 7.6 | 0.0016 | 2026-10-29 | Pinpoint through version 3.1.0 contains an insecure session management vulnerability that | |
CVE-2026-57949 |
high | 7.1 | 0.0029 | 2026-10-29 | ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization v | |
CVE-2026-57950 |
high | 8.6 | 0.0037 | 2026-10-29 | ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vu | |
CVE-2026-57951 |
high | 7.1 | 0.0043 | 2026-10-29 | Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_ste | |
CVE-2026-57952 |
medium | 6.0 | 0.0029 | 2026-10-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoin | |
CVE-2026-57953 |
medium | 5.3 | 0.0044 | 2026-10-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenti | |
CVE-2026-57954 |
medium | 5.3 | 0.0021 | 2026-10-29 | Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions | |
CVE-2026-57958 |
medium | 5.1 | 0.0021 | 2026-10-29 | Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows | |
CVE-2026-57959 |
high | 8.2 | 0.0026 | 2026-10-29 | Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation v | |
CVE-2026-57960 |
high | 8.3 | 0.0042 | 2026-10-29 | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control | |
CVE-2026-53427 |
low | 2.3 | 0.0069 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-57999 |
high | 7.7 | 0.0147 | 2026-10-29 | luci-app-tailscale-community contains a command injection vulnerability in the tailscale.d | |
CVE-2026-58000 |
high | 8.7 | 0.0172 | 2026-10-29 | luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection v | |
CVE-2026-13593 |
medium | 6.5 | 0.0029 | 2026-10-29 | CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire documen | |
CVE-2026-13762 |
high | 7.9 | 0.0063 | 2026-10-29 | Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled m | |
CVE-2026-13763 |
high | 7.9 | 0.0068 | 2026-10-29 | Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS W | |
CVE-2026-31016 |
medium | 6.5 | 0.0022 | 2026-10-29 | Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before all | |
CVE-2026-37637 |
critical | 9.1 | 0.0060 | 2026-10-29 | An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code | |
CVE-2026-43715 |
high | 8.8 | 0.0126 | 2026-10-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed |