Browse All CVEs
3,540 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-14425 |
critical | 9.6 | 0.0023 | 2026-10-29 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker | |
CVE-2026-27419 |
critical | 9.9 | 0.0048 | 2026-10-29 | Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions. | |
CVE-2026-27436 |
critical | 9.1 | 0.0066 | 2026-10-29 | Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 version | |
CVE-2026-57621 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. | |
CVE-2026-57623 |
critical | 9.0 | 0.0053 | 2026-10-29 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. | |
CVE-2026-57624 |
critical | 10.0 | 0.0086 | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions. | |
CVE-2026-57625 |
critical | 9.6 | 0.0045 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8 | |
CVE-2026-57677 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10. | |
CVE-2026-57679 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions. | |
CVE-2026-57683 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions. | |
CVE-2026-5524 |
critical | 9.8 | 0.0348 | 2026-10-29 | The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading | |
CVE-2026-4767 |
critical | 9.8 | 0.0061 | 2026-10-29 | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF | |
CVE-2026-50746 |
critical | 10.0 | 0.0169 | 2026-10-29 | A malicious actor with access to the network could exploit an Improper Access Control vuln | |
CVE-2026-50747 |
critical | 9.9 | 0.0049 | 2026-10-29 | A malicious actor with access to the network and low privileges could exploit a series of | |
CVE-2026-50748 |
critical | 9.9 | 0.0163 | 2026-10-29 | A malicious actor with access to the network and low privileges could exploit an Improper | |
CVE-2026-54400 |
critical | 9.1 | 0.0052 | 2026-10-29 | A malicious actor with access to the network and high privileges could exploit an Improper | |
CVE-2026-54408 |
critical | 9.8 | 0.0057 | 2026-10-29 | A malicious actor with access to the network could exploit an Improper Access Control vuln | |
CVE-2026-55115 |
critical | 9.9 | 0.0047 | 2026-10-29 | A malicious actor with access to the network and low privileges could exploit a Server-Sid | |
CVE-2026-56004 |
critical | 10.0 | 0.0066 | 2026-10-29 | A shellcode injection in the mercurial handler of the obs tar_scm source service before ve | |
CVE-2026-58455 |
critical | 9.2 | 0.0804 | 2026-10-29 | Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability t | |
CVE-2026-44935 |
critical | 9.9 | 0.0049 | 2026-10-29 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 | |
CVE-2026-58466 |
critical | 9.3 | 0.0080 | 2026-10-29 | AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allo | |
CVE-2026-59099 |
critical | 9.3 | 0.0055 | 2026-10-29 | Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remot | |
CVE-2026-52830 |
critical | 9.4 | 0.0065 | 2026-10-29 | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates H | |
CVE-2026-41106 |
critical | 9.3 | 0.0072 | 2026-10-29 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized | |
CVE-2026-45499 |
critical | 9.9 | 0.0078 | 2026-10-29 | Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevat | |
CVE-2026-57100 |
critical | 9.9 | 0.0078 | 2026-10-29 | Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) al | |
CVE-2026-13368 |
critical | 9.2 | 0.0094 | 2026-10-29 | WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability | |
CVE-2026-4321 |
critical | 9.8 | 0.0047 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-56015 |
critical | 9.1 | 0.0065 | 2026-10-29 | Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounde | |
CVE-2026-12481 |
critical | 9.8 | 0.0072 | 2026-10-29 | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due | |
CVE-2026-20706 |
critical | 9.1 | 0.0059 | 2026-10-29 | Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass tok | |
CVE-2026-20896 |
critical | 9.8 | 0.0276 | 2026-10-29 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* | |
CVE-2026-22547 |
critical | 9.1 | 0.0052 | 2026-10-29 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, i | |
CVE-2026-22874 |
critical | 9.6 | 0.0046 | 2026-10-29 | Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and m | |
CVE-2026-25718 |
critical | 9.1 | 0.0056 | 2026-10-29 | Gitea versions before 1.25.5 mishandle path resolution during template repository generati | |
CVE-2026-26232 |
critical | 9.1 | 0.0050 | 2026-10-29 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry | |
CVE-2026-26247 |
critical | 9.1 | 0.0050 | 2026-10-29 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctl | |
CVE-2026-26292 |
critical | 9.8 | 0.0065 | 2026-10-29 | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync | |
CVE-2026-27780 |
critical | 9.8 | 0.0064 | 2026-10-29 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing p | |
CVE-2026-58289 |
critical | 9.0 | 0.0199 | 2026-10-29 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium- | |
CVE-2026-58422 |
critical | 9.8 | 0.0043 | 2026-10-29 | Improper authorization on OAuth sign-in callback silently re-enables administrator-disable | |
CVE-2026-58426 |
critical | 9.6 | 0.0023 | 2026-10-29 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read | |
CVE-2026-14535 |
critical | 9.8 | 0.0056 | 2026-10-29 | In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysi | |
CVE-2026-24013 |
critical | 9.1 | 0.0063 | 2026-10-29 | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query | |
CVE-2026-24014 |
critical | 9.8 | 0.0069 | 2026-10-29 | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the upl | |
CVE-2026-40047 |
critical | 9.1 | 0.0243 | 2026-10-29 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnera | |
CVE-2026-43867 |
critical | 9.8 | 0.0093 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel- | |
CVE-2026-46454 |
critical | 9.8 | 0.0083 | 2026-10-29 | Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-comet | |
CVE-2026-46455 |
critical | 9.8 | 0.0069 | 2026-10-29 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The cam |