Browse All CVEs
3,534 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-48316 |
critical | 10.0 | 0.0112 | 2026-10-29 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-48614 |
critical | 9.9 | 0.0058 | 2026-10-29 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user | |
CVE-2026-11405 |
critical | 9.8 | 0.0076 | 2026-10-29 | The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in th | |
CVE-2026-34038 |
critical | 9.9 | 0.0254 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-57571 |
critical | 9.6 | 0.0081 | 2026-10-29 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the | |
CVE-2026-57572 |
critical | 10.0 | 0.0094 | 2026-10-29 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docke | |
CVE-2026-34037 |
critical | 9.9 | 0.0037 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-34047 |
critical | 9.9 | 0.0055 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-34048 |
critical | 9.9 | 0.0080 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-33264 |
critical | 9.8 | 0.0165 | 2026-10-29 | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attac | |
CVE-2026-53481 |
critical | 9.8 | 0.0063 | 2026-10-29 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1 | |
CVE-2026-53483 |
critical | 9.8 | 0.0063 | 2026-10-29 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1 | |
CVE-2026-13019 |
critical | 9.8 | 0.0085 | 2026-10-29 | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a m | |
CVE-2026-13020 |
critical | 9.8 | 0.0047 | 2026-10-29 | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS | |
CVE-2026-59800 |
critical | 9.2 | 0.0208 | 2026-10-29 | 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticate | |
CVE-2026-58473 |
critical | 9.3 | 0.0051 | 2026-10-29 | Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthen | |
CVE-2026-59707 |
critical | 9.2 | 0.0138 | 2026-10-29 | LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST | |
CVE-2026-14739 |
critical | 9.8 | 0.0041 | 2026-10-29 | DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements wit | |
CVE-2026-14740 |
critical | 9.1 | 0.0066 | 2026-10-29 | DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting a | |
CVE-2026-59705 |
critical | 9.3 | 0.0064 | 2026-10-29 | mem0's openmemory/api component contains an unauthenticated access vulnerability that allo | |
CVE-2026-56843 |
critical | 9.9 | 0.0066 | 2026-10-29 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low- | |
CVE-2026-60002 |
critical | 9.4 | 0.0030 | 2026-10-29 | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key du | |
CVE-2026-9695 |
critical | 9.8 | 0.0061 | 2026-10-29 | An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through | |
CVE-2026-41042 |
critical | 9.1 | 0.0151 | 2026-10-29 | Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, | |
CVE-2026-14454 |
critical | 9.8 | 0.0066 | 2026-10-29 | Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Ima | |
CVE-2026-8307 |
critical | 9.8 | 0.0047 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-54061 |
critical | 9.1 | 0.0047 | 2026-10-29 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alp | |
CVE-2026-58480 |
critical | 9.2 | 0.0357 | 2026-10-29 | Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbit | |
CVE-2026-15062 |
critical | 9.6 | 0.0039 | 2026-10-29 | SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versi | |
CVE-2026-3144 |
critical | 9.8 | 0.0041 | 2026-10-29 | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an at | |
CVE-2026-59702 |
critical | 9.2 | 0.0041 | 2026-10-29 | repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoin | |
CVE-2026-59873 |
critical | 9.2 | 0.0058 | 2026-10-29 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does | |
CVE-2026-9074 |
critical | 9.8 | 0.0051 | 2026-10-29 | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauth | |
CVE-2026-60104 |
critical | 9.3 | 0.0037 | 2026-10-29 | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/a | |
CVE-2026-8649 |
critical | 9.8 | 0.0046 | 2026-10-29 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress | |
CVE-2026-54527 |
critical | 9.3 | 0.0053 | 2026-10-29 | JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTe | |
CVE-2026-44024 |
critical | 9.8 | 0.0109 | 2026-10-29 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, | |
CVE-2026-52200 |
critical | 9.8 | 0.0093 | 2026-10-29 | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execut | |
CVE-2026-15113 |
critical | 9.6 | 0.0034 | 2026-10-29 | Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a r | |
CVE-2026-2342 |
critical | 9.3 | 0.0039 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-5955 |
critical | 9.8 | 0.0047 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-56291 |
critical | 10.0 | 0.1485 | 2026-10-29 | KEV | Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability th |
CVE-2026-12116 |
critical | 9.8 | 0.0070 | 2026-10-29 | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path | |
CVE-2026-14261 |
critical | 9.1 | 0.0103 | 2026-10-29 | A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code | |
CVE-2026-56292 |
critical | 9.2 | 0.0138 | 2026-10-29 | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQ | |
CVE-2026-23556 |
critical | 9.4 | 0.0014 | 2026-10-29 | When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts | |
CVE-2026-23559 |
critical | 9.4 | 0.0017 | 2026-10-29 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul | |
CVE-2026-23560 |
critical | 9.4 | 0.0017 | 2026-10-29 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul | |
CVE-2026-23561 |
critical | 9.4 | 0.0017 | 2026-10-29 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul | |
CVE-2026-23562 |
critical | 9.4 | 0.0017 | 2026-10-29 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul |