Browse All CVEs
3,516 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-8666 |
critical | 9.8 | 0.0120 | 2026-10-29 | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Trace | |
CVE-2026-41566 |
critical | 9.4 | 0.0036 | 2026-10-29 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrock | |
CVE-2026-46752 |
critical | 10.0 | 0.0048 | 2026-10-29 | Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affe | |
CVE-2026-41120 |
critical | 9.8 | 0.0039 | 2026-10-29 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extran | |
CVE-2026-54823 |
critical | 9.9 | 0.0079 | 2026-10-29 | Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions. | |
CVE-2026-54836 |
critical | 9.3 | 0.0134 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-54843 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. | |
CVE-2026-54849 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. | |
CVE-2026-54030 |
critical | 9.3 | 0.0017 | 2026-10-29 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5 | |
CVE-2026-55413 |
critical | 9.4 | 0.0032 | 2026-10-29 | ToolJet is the open-source foundation am AI-native platform for building and deploying int | |
CVE-2026-56786 |
critical | 9.3 | 0.0071 | 2026-10-29 | RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 func | |
CVE-2026-57700 |
critical | 10.0 | 0.0052 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows | |
CVE-2026-40702 |
critical | 9.3 | 0.0065 | 2026-10-29 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersona | |
CVE-2026-9222 |
critical | 9.2 | 0.0041 | 2026-10-29 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only requir | |
CVE-2026-48930 |
critical | 9.8 | 0.0032 | 2026-10-29 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silen | |
CVE-2026-2053 |
critical | 10.0 | 0.0039 | 2026-10-29 | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does | |
CVE-2026-57878 |
critical | 9.8 | 0.0095 | 2026-10-29 | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision | |
CVE-2026-57879 |
critical | 9.8 | 0.0095 | 2026-10-29 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision G | |
CVE-2026-57880 |
critical | 9.8 | 0.0095 | 2026-10-29 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision G | |
CVE-2026-57881 |
critical | 9.8 | 0.0065 | 2026-10-29 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision | |
CVE-2026-53914 |
critical | 9.8 | 0.0033 | 2026-10-29 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization i | |
CVE-2026-57926 |
critical | 9.8 | 0.0034 | 2026-10-29 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a protot | |
CVE-2026-54820 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | |
CVE-2026-54827 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. | |
CVE-2026-54831 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. | |
CVE-2026-56027 |
critical | 9.9 | 0.0048 | 2026-10-29 | Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions. | |
CVE-2026-56030 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions. | |
CVE-2026-56032 |
critical | 9.8 | 0.0056 | 2026-10-29 | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. | |
CVE-2026-56033 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions. | |
CVE-2026-56034 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. | |
CVE-2026-56036 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. | |
CVE-2026-56057 |
critical | 9.8 | 0.0056 | 2026-10-29 | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. | |
CVE-2026-56058 |
critical | 9.9 | 0.0048 | 2026-10-29 | Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions. | |
CVE-2026-56059 |
critical | 9.9 | 0.0048 | 2026-10-29 | Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions. | |
CVE-2026-56062 |
critical | 9.3 | 0.0144 | 2026-10-29 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. | |
CVE-2026-56067 |
critical | 9.3 | 0.0045 | 2026-10-29 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. | |
CVE-2026-56068 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. | |
CVE-2026-56070 |
critical | 9.3 | 0.0144 | 2026-10-29 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. | |
CVE-2026-0685 |
critical | 9.8 | 0.0093 | 2026-10-29 | Server side template inject (SSTI) in the expression evaluation component in Genshi Templa | |
CVE-2026-12411 |
critical | 9.6 | 0.0029 | 2026-10-29 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows | |
CVE-2026-41157 |
critical | 9.8 | 0.0036 | 2026-10-29 | A web page that contains unusual WebGPU content loaded into the GPU GLES render process an | |
CVE-2026-46716 |
critical | 9.9 | 0.0043 | 2026-10-29 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M | |
CVE-2026-53519 |
critical | 9.1 | 0.0193 | 2026-10-29 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M | |
CVE-2026-53609 |
critical | 9.1 | 0.0035 | 2026-10-29 | ApostropheCMS is an open-source Node.js content management system. In versions up to and i | |
CVE-2026-49757 |
critical | 9.2 | 0.0062 | 2026-10-29 | Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows a | |
CVE-2026-5482 |
critical | 9.3 | 0.0044 | 2026-10-29 | Responsive FileManager's allows an unauthenticated attacker to upload files of any type an | |
CVE-2026-52704 |
critical | 10.0 | 0.0031 | 2026-10-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas Woo | |
CVE-2026-9862 |
critical | 9.8 | 0.0099 | 2026-10-29 | Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerabi | |
CVE-2026-48114 |
critical | 9.8 | 0.0037 | 2026-10-29 | Metacat is data repository software that helps researchers preserve, share, and discover d | |
CVE-2026-49952 |
critical | 9.3 | 0.0472 | 2026-10-29 | Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerab |