Browse All CVEs
34,023 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-7380 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerabilit | |
CVE-2026-8306 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-8309 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-8377 |
high | 8.2 | 0.0034 | 2026-10-29 | Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Con | |
CVE-2026-13199 |
medium | 5.1 | 0.0016 | 2026-10-29 | EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR a | |
CVE-2026-14867 |
medium | 6.8 | 0.0013 | 2026-10-29 | Credentials of built-in users are insecurely stored in the User directory of PcVue project | |
CVE-2026-14868 |
high | 8.4 | 0.0006 | 2026-10-29 | The encryption algorithm used to protect the configuration of user accounts, stored in the | |
CVE-2026-33264 |
critical | 9.8 | 0.0165 | 2026-10-29 | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attac | |
CVE-2026-48828 |
medium | 6.5 | 0.0066 | 2026-10-29 | The Bulk Variables API in Apache Airflow called the redactor without passing the variable' | |
CVE-2026-48891 |
medium | 4.3 | 0.0064 | 2026-10-29 | A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint applied the caller' | |
CVE-2026-48892 |
medium | 6.5 | 0.0066 | 2026-10-29 | The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment v | |
CVE-2026-49296 |
medium | 6.5 | 0.0060 | 2026-10-29 | Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source o | |
CVE-2026-49487 |
medium | 6.5 | 0.0066 | 2026-10-29 | In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints retur | |
CVE-2026-11340 |
high | 8.3 | 0.0035 | 2026-10-29 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functional | |
CVE-2026-11348 |
high | 8.1 | 0.0025 | 2026-10-29 | Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS | |
CVE-2026-13696 |
high | 8.8 | 0.0052 | 2026-10-29 | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulne | |
CVE-2026-10659 |
medium | 4.7 | 0.0013 | 2026-10-29 | The Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) implemented the d | |
CVE-2026-53481 |
critical | 9.8 | 0.0063 | 2026-10-29 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1 | |
CVE-2026-53483 |
critical | 9.8 | 0.0063 | 2026-10-29 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1 | |
CVE-2026-44938 |
high | 8.8 | 0.0044 | 2026-10-29 | A vulnerability has been identified in Fleet's agent-side deployer, which did not filter s | |
CVE-2026-53479 |
high | 7.2 | 0.0197 | 2026-10-29 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1 | |
CVE-2026-48588 |
low | 2.3 | 0.0043 | 2026-10-29 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `UpdateCacheMidd | |
CVE-2026-53877 |
medium | 6.3 | 0.0053 | 2026-10-29 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib. | |
CVE-2026-53878 |
medium | 5.3 | 0.0033 | 2026-10-29 | An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `DomainNameValid | |
CVE-2026-59709 |
medium | 5.3 | 0.0034 | 2026-10-29 | Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to veri | |
CVE-2026-56811 |
high | 8.7 | 0.0077 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework pho | |
CVE-2026-56812 |
medium | 6.3 | 0.0080 | 2026-10-29 | Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework pho | |
CVE-2026-13019 |
critical | 9.8 | 0.0085 | 2026-10-29 | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a m | |
CVE-2026-13020 |
critical | 9.8 | 0.0047 | 2026-10-29 | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS | |
CVE-2026-14904 |
high | 7.1 | 0.0057 | 2026-10-29 | AWS Research and Engineering Studio (RES) is an open-source solution that enables research | |
CVE-2026-23697 |
high | 8.7 | 0.0100 | 2026-10-29 | Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows lo | |
CVE-2026-23698 |
high | 8.6 | 0.0123 | 2026-10-29 | Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in | |
CVE-2026-57851 |
high | 8.5 | 0.0017 | 2026-10-29 | MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib | |
CVE-2026-48947 |
medium | 6.4 | 0.0033 | 2026-10-29 | An improper access check allows privileged users to overwrite media files without editing | |
CVE-2026-48948 |
medium | 6.4 | 0.0042 | 2026-10-29 | An improper access check allows user to download vcard exports of com_contact contacts tha | |
CVE-2026-48949 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of validation leads to an XSS vulnerability in the MFA management views. | |
CVE-2026-48950 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of escaping leads to an XSS vulnerability in the file management view of com_template | |
CVE-2026-48951 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components | |
CVE-2026-48952 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | |
CVE-2026-48953 |
medium | 5.9 | 0.0024 | 2026-10-29 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | |
CVE-2026-48954 |
medium | 5.9 | 0.0024 | 2026-10-29 | Improper validation leads to a generic XSS vector in the language override feature. | |
CVE-2026-48955 |
medium | 6.4 | 0.0034 | 2026-10-29 | An improper access check allows unauthorized users to access workflow stage and transition | |
CVE-2026-48956 |
medium | 6.4 | 0.0027 | 2026-10-29 | An improper access check allows users to display a list of modules in the frontend. | |
CVE-2026-48957 |
medium | 6.4 | 0.0042 | 2026-10-29 | An improper access check allows unauthorized users to access com_privacy datasets. | |
CVE-2026-48958 |
medium | 6.4 | 0.0046 | 2026-10-29 | An improper access check allows unauthorized users to create custom fields via webservices | |
CVE-2026-59708 |
high | 8.7 | 0.0059 | 2026-10-29 | The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access I | |
CVE-2026-59800 |
critical | 9.2 | 0.0208 | 2026-10-29 | 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticate | |
CVE-2026-7017 |
high | 7.1 | 0.0035 | 2026-10-29 | HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redir | |
CVE-2026-44877 |
medium | 6.5 | 0.0046 | 2026-10-29 | An unauthenticated remote disclosure vulnerability has been identified in HPE Networking I | |
CVE-2026-46672 |
medium | 4.6 | 0.0018 | 2026-10-29 | Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a han |