Browse All CVEs
33,990 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-15067 |
high | 8.8 | 0.0053 | 2026-10-29 | Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabili | |
CVE-2026-49145 |
high | 7.5 | 0.0049 | 2026-10-29 | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a proje | |
CVE-2026-49146 |
high | 7.5 | 0.0061 | 2026-10-29 | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context | |
CVE-2026-49147 |
high | 7.5 | 0.0049 | 2026-10-29 | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from | |
CVE-2026-54652 |
high | 8.1 | 0.0029 | 2026-10-29 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{se | |
CVE-2026-14966 |
low | 3.1 | 0.0038 | 2026-10-29 | BBOT's unarchive module rejects archives containing symlink entries before extraction, but | |
CVE-2026-14967 |
low | 3.1 | 0.0026 | 2026-10-29 | BBOT's `github_workflows` module could be induced to write a downloaded artifact outside i | |
CVE-2026-15063 |
medium | 6.3 | 0.0028 | 2026-10-29 | A flaw was found in the gorch service template, which is part of the trustyai-service-oper | |
CVE-2026-3144 |
critical | 9.8 | 0.0041 | 2026-10-29 | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an at | |
CVE-2026-53951 |
high | 8.8 | 0.0026 | 2026-10-29 | Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through | |
CVE-2026-57439 |
medium | 5.0 | 0.0014 | 2026-10-29 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to | |
CVE-2026-59262 |
high | 7.1 | 0.0042 | 2026-10-29 | AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing doc | |
CVE-2026-59702 |
critical | 9.2 | 0.0041 | 2026-10-29 | repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoin | |
CVE-2026-59724 |
high | 7.5 | 0.0061 | 2026-10-29 | Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5 | |
CVE-2026-59725 |
high | 7.5 | 0.0064 | 2026-10-29 | Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1 | |
CVE-2026-59868 |
high | 7.5 | 0.0064 | 2026-10-29 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys a | |
CVE-2026-59869 |
high | 7.5 | 0.0059 | 2026-10-29 | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 be | |
CVE-2026-59870 |
high | 7.5 | 0.0074 | 2026-10-29 | js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_ | |
CVE-2026-59871 |
high | 7.5 | 0.0064 | 2026-10-29 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coer | |
CVE-2026-59873 |
critical | 9.2 | 0.0058 | 2026-10-29 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does | |
CVE-2026-59874 |
high | 8.7 | 0.0043 | 2026-10-29 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace a | |
CVE-2026-59875 |
medium | 5.3 | 0.0035 | 2026-10-29 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does | |
CVE-2026-59876 |
medium | 4.8 | 0.0035 | 2026-10-29 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until | |
CVE-2026-59877 |
high | 7.5 | 0.0037 | 2026-10-29 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 an | |
CVE-2026-9074 |
critical | 9.8 | 0.0051 | 2026-10-29 | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauth | |
CVE-2026-29009 |
high | 8.8 | 0.0074 | 2026-10-29 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() | |
CVE-2026-39822 |
high | 7.8 | 0.0023 | 2026-10-29 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations out | |
CVE-2026-42505 |
medium | 5.3 | 0.0038 | 2026-10-29 | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network o | |
CVE-2026-59261 |
high | 8.4 | 0.0027 | 2026-10-29 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dot | |
CVE-2026-59731 |
high | 8.2 | 0.0033 | 2026-10-29 | Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization | |
CVE-2026-59882 |
medium | 6.5 | 0.0032 | 2026-10-29 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Ur | |
CVE-2026-59887 |
high | 7.5 | 0.0047 | 2026-10-29 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the m | |
CVE-2026-59890 |
medium | 6.1 | 0.0040 | 2026-10-29 | setuptools is a package that allows users to download, build, install, upgrade, and uninst | |
CVE-2026-59892 |
high | 7.5 | 0.0056 | 2026-10-29 | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentele | |
CVE-2026-59895 |
medium | 6.1 | 0.0033 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. From | |
CVE-2026-59896 |
medium | 6.5 | 0.0030 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. From | |
CVE-2026-59897 |
medium | 5.3 | 0.0018 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. From | |
CVE-2026-59922 |
high | 7.5 | 0.0064 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of c | |
CVE-2026-59923 |
medium | 6.1 | 0.0035 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRender | |
CVE-2026-59924 |
medium | 5.9 | 0.0046 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.pa | |
CVE-2026-59925 |
high | 7.5 | 0.0064 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long seque | |
CVE-2026-59926 |
medium | 5.3 | 0.0033 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, render_adm | |
CVE-2026-59927 |
medium | 5.3 | 0.0053 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Includ | |
CVE-2026-59928 |
high | 7.5 | 0.0065 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown | |
CVE-2026-59929 |
medium | 6.1 | 0.0034 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_u | |
CVE-2026-59930 |
medium | 4.3 | 0.0019 | 2026-10-29 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc pl | |
CVE-2026-60102 |
high | 7.7 | 0.0327 | 2026-10-29 | Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerab | |
CVE-2026-14362 |
medium | 4.9 | 0.0025 | 2026-10-29 | HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in it | |
CVE-2026-50813 |
— | — | 0.0016 | 2026-10-29 | An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain s | |
CVE-2026-59937 |
medium | 6.9 | 0.0062 | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can |