Browse All CVEs
33,735 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-8666 |
critical | 9.8 | 0.0120 | 2026-10-29 | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Trace | |
CVE-2026-8658 |
high | 8.8 | 0.0129 | 2026-10-29 | OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows | |
CVE-2026-8662 |
medium | 4.3 | 0.0029 | 2026-10-29 | Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compr | |
CVE-2026-10086 |
medium | 5.4 | 0.0035 | 2026-10-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11. | |
CVE-2026-13311 |
high | 8.7 | 0.0036 | 2026-10-29 | shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat | |
CVE-2026-12244 |
high | 8.7 | 0.0049 | 2026-10-29 | If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with | |
CVE-2026-12245 |
high | 8.7 | 0.0046 | 2026-10-29 | NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections | |
CVE-2026-12246 |
high | 7.2 | 0.0044 | 2026-10-29 | NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength la | |
CVE-2026-12490 |
high | 8.2 | 0.0022 | 2026-10-29 | When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should | |
CVE-2026-41566 |
critical | 9.4 | 0.0036 | 2026-10-29 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrock | |
CVE-2026-45188 |
low | 2.4 | 0.0015 | 2026-10-29 | Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrock | |
CVE-2026-46751 |
medium | 5.5 | 0.0033 | 2026-10-29 | A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.2.0 through | |
CVE-2026-46752 |
critical | 10.0 | 0.0048 | 2026-10-29 | Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affe | |
CVE-2026-54226 |
medium | 6.4 | 0.0040 | 2026-10-29 | A vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 2.6.0 through | |
CVE-2026-56091 |
high | 8.2 | 0.0067 | 2026-10-29 | When using Apache Shiro with the shiro-guice module in a web servlet context, a specially | |
CVE-2026-56130 |
low | 2.0 | 0.0030 | 2026-10-29 | "Remember me" cookie age is not verified on the server. This potentially allows an attacke | |
CVE-2026-42005 |
medium | 4.3 | 0.0063 | 2026-10-29 | An attacker can send a web request that causes unlimited memory allocation in the interna | |
CVE-2026-33612 |
high | 7.5 | 0.0015 | 2026-10-29 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that | |
CVE-2026-40011 |
low | 3.7 | 0.0022 | 2026-10-29 | An attacker sending a large number of crafted DNS queries might be able to trigger a dynam | |
CVE-2026-40208 |
low | 3.7 | 0.0040 | 2026-10-29 | An attacker might be able to delay the processing of DoH3 queries by sending DoH3 GET quer | |
CVE-2026-40209 |
medium | 5.3 | 0.0070 | 2026-10-29 | An attacker might be able to cause outgoing TCP connections to backend to be stuck until a | |
CVE-2026-40210 |
medium | 4.8 | 0.0074 | 2026-10-29 | An out-of-bounds read might happen when SetMacAddrAction is used, potentially resulting in | |
CVE-2026-40211 |
medium | 5.3 | 0.0070 | 2026-10-29 | An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevent | |
CVE-2026-42004 |
low | 3.7 | 0.0022 | 2026-10-29 | An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering | |
CVE-2026-12755 |
low | 2.7 | 0.0037 | 2026-10-29 | Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2. | |
CVE-2026-27366 |
high | 7.5 | 0.0031 | 2026-10-29 | Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. | |
CVE-2026-2815 |
high | 8.4 | 0.0025 | 2026-10-29 | Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable k | |
CVE-2026-40012 |
medium | 5.3 | 0.0045 | 2026-10-29 | ECS zero scoped answers are stored in the packet cache while they should not. This impacts | |
CVE-2026-41120 |
critical | 9.8 | 0.0039 | 2026-10-29 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extran | |
CVE-2026-42387 |
medium | 5.9 | 0.0048 | 2026-10-29 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that | |
CVE-2026-42388 |
medium | 5.9 | 0.0048 | 2026-10-29 | Incomplete validation of the SOA record present in a catalog zone might lead to a crash. | |
CVE-2026-42389 |
medium | 5.3 | 0.0030 | 2026-10-29 | This fix provides extra hardening for the 5.4.x branch by doing extra validation of incomi | |
CVE-2026-42390 |
medium | 5.3 | 0.0030 | 2026-10-29 | An invalid zone might pass ZONEMD validation while it should not. This is only relevant if | |
CVE-2026-46732 |
high | 7.0 | 0.0010 | 2026-10-29 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurren | |
CVE-2026-46733 |
high | 7.8 | 0.0015 | 2026-10-29 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Impr | |
CVE-2026-46734 |
high | 7.8 | 0.0009 | 2026-10-29 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper | |
CVE-2026-47145 |
high | 7.1 | 0.0044 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that | |
CVE-2026-47146 |
high | 7.1 | 0.0044 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that | |
CVE-2026-47147 |
high | 7.1 | 0.0040 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser in | |
CVE-2026-47148 |
high | 7.1 | 0.0044 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeate | |
CVE-2026-47149 |
high | 7.1 | 0.0044 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can | |
CVE-2026-47150 |
high | 7.1 | 0.0038 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out | |
CVE-2026-47151 |
high | 7.1 | 0.0038 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-o | |
CVE-2026-47152 |
high | 7.1 | 0.0044 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the | |
CVE-2026-47153 |
high | 7.1 | 0.0044 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the | |
CVE-2026-47154 |
high | 7.1 | 0.0044 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of | |
CVE-2026-49506 |
high | 7.2 | 0.0087 | 2026-10-29 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation | |
CVE-2026-4526 |
high | 7.1 | 0.0044 | 2026-10-29 | In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds r | |
CVE-2026-52690 |
medium | 5.9 | 0.0043 | 2026-10-29 | Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting | |
CVE-2026-54821 |
high | 7.4 | 0.0028 | 2026-10-29 | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions. |