Browse All CVEs
34,450 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-27882 |
medium | 4.8 | 0.0023 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-27883 |
medium | 5.0 | 0.0026 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-27955 |
medium | 6.6 | 0.0027 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-27956 |
medium | 4.3 | 0.0029 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-27957 |
high | 8.8 | 0.0081 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-44947 |
medium | 6.9 | 0.0039 | 2026-10-29 | A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Ranch | |
CVE-2026-44949 |
high | 7.0 | 0.0039 | 2026-10-29 | A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webh | |
CVE-2026-48192 |
medium | 6.8 | 0.0032 | 2026-10-29 | A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Stud | |
CVE-2026-4360 |
low | 2.0 | 0.0048 | 2026-10-29 | In the Tarfile.extract() function, the filter parameter is not passed properly when extrac | |
CVE-2026-13455 |
medium | 4.3 | 0.0019 | 2026-10-29 | PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to re | |
CVE-2026-44948 |
medium | 5.3 | 0.0049 | 2026-10-29 | A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0 | |
CVE-2026-48276 |
critical | 10.0 | 0.0126 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of | |
CVE-2026-48277 |
critical | 10.0 | 0.0129 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-48281 |
critical | 10.0 | 0.0142 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-48282 |
critical | 10.0 | 0.4239 | 2026-10-29 | KEV | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code |
CVE-2026-48283 |
critical | 10.0 | 0.0126 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of | |
CVE-2026-48285 |
high | 8.6 | 0.0083 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forg | |
CVE-2026-48286 |
critical | 10.0 | 0.0117 | 2026-10-29 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Inco | |
CVE-2026-48307 |
high | 8.8 | 0.0055 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scr | |
CVE-2026-48313 |
critical | 9.3 | 0.0295 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of | |
CVE-2026-48314 |
medium | 6.5 | 0.0062 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of | |
CVE-2026-48315 |
critical | 9.3 | 0.0103 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-10652 |
high | 7.4 | 0.0042 | 2026-10-29 | Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in d | |
CVE-2026-10653 |
high | 8.1 | 0.0042 | 2026-10-29 | The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- | |
CVE-2026-10654 |
low | 3.1 | 0.0017 | 2026-10-29 | A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/ | |
CVE-2026-10655 |
medium | 5.9 | 0.0038 | 2026-10-29 | The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) clos | |
CVE-2026-49451 |
high | 7.5 | 0.0075 | 2026-10-29 | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along wit | |
CVE-2026-58165 |
high | 8.7 | 0.0034 | 2026-10-29 | OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerabi | |
CVE-2026-58166 |
high | 8.8 | 0.0085 | 2026-10-29 | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerab | |
CVE-2026-58167 |
high | 7.1 | 0.0042 | 2026-10-29 | Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including pl | |
CVE-2026-58168 |
high | 7.7 | 0.0041 | 2026-10-29 | DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows | |
CVE-2026-58169 |
high | 7.7 | 0.0042 | 2026-10-29 | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability th | |
CVE-2026-58170 |
high | 7.2 | 0.0055 | 2026-10-29 | Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied prop | |
CVE-2026-58171 |
low | 2.3 | 0.0034 | 2026-10-29 | Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied | |
CVE-2026-58172 |
critical | 9.3 | 0.0056 | 2026-10-29 | Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnera | |
CVE-2026-58173 |
medium | 6.0 | 0.0045 | 2026-10-29 | Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers t | |
CVE-2026-58174 |
medium | 6.0 | 0.0045 | 2026-10-29 | Hermes WebUI before 0.51.521 validates the workspace of an imported session under the acti | |
CVE-2026-58176 |
high | 7.1 | 0.0032 | 2026-10-29 | RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management en | |
CVE-2026-58369 |
medium | 6.9 | 0.0064 | 2026-10-29 | Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without au | |
CVE-2026-58370 |
critical | 9.2 | 0.0072 | 2026-10-29 | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Aut | |
CVE-2026-58373 |
medium | 5.3 | 0.0034 | 2026-10-29 | CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSe | |
CVE-2026-58375 |
high | 8.7 | 0.0063 | 2026-10-29 | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentic | |
CVE-2026-8864 |
high | 7.3 | 0.0014 | 2026-10-29 | The HP Fan Control App might allow local escalation of privileges. An updated version of H | |
CVE-2026-9263 |
high | 8.1 | 0.0033 | 2026-10-29 | The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/is | |
CVE-2026-58138 |
critical | 9.3 | 0.0914 | 2026-10-29 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vu | |
CVE-2026-10109 |
critical | 9.8 | 0.0086 | 2026-10-29 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code exec | |
CVE-2026-10129 |
high | 8.5 | 0.0031 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protect | |
CVE-2026-10134 |
critical | 10.0 | 0.0232 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to | |
CVE-2026-10140 |
critical | 9.6 | 0.0035 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling t | |
CVE-2026-10546 |
medium | 6.5 | 0.0025 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnera |