Browse All CVEs
10,518 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-3322 |
medium | 5.6 | 0.0018 | 2026-10-29 | Due to improper permission checks in Lobster_pro, attackers are able to interact with endp | |
CVE-2026-77054 |
medium | 6.9 | 0.0016 | 2026-10-29 | boneIO Black stores passwords, including the MQTT broker and web panel passwords, in clear | |
CVE-2026-77058 |
medium | 5.1 | 0.0026 | 2026-10-29 | boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API | |
CVE-2026-77060 |
medium | 6.8 | 0.0013 | 2026-10-29 | boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitt | |
CVE-2026-77061 |
medium | 5.3 | 0.0033 | 2026-10-29 | boneIO Black directly excludes several API endpoints from the authentication. An unauthent | |
CVE-2026-77062 |
medium | 6.9 | 0.0052 | 2026-10-29 | The boneIO Black web interface lacks proper clickjacking protections. A remote attacker ca | |
CVE-2026-92171 |
medium | 6.5 | 0.0029 | 2026-10-29 | A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) | |
CVE-2026-93849 |
medium | 6.5 | 0.0046 | 2026-10-29 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.1 | |
CVE-2026-93850 |
medium | 6.5 | 0.0038 | 2026-10-29 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.1 | |
CVE-2026-94386 |
medium | 4.8 | 0.0034 | 2026-10-29 | Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth componen | |
CVE-2026-107080 |
medium | 6.5 | 0.0035 | 2026-10-29 | OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-b | |
CVE-2026-115678 |
medium | 5.3 | 0.0041 | 2026-10-29 | Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNM | |
CVE-2026-115679 |
medium | 6.5 | 0.0032 | 2026-10-29 | Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server R | |
CVE-2026-115680 |
medium | 6.5 | 0.0034 | 2026-10-29 | Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended | |
CVE-2026-116367 |
medium | 5.3 | 0.0029 | 2026-10-29 | A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects | |
CVE-2026-116368 |
medium | 6.9 | 0.0058 | 2026-10-29 | A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects so | |
CVE-2026-116369 |
medium | 5.3 | 0.0139 | 2026-10-29 | A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Im | |
CVE-2026-116394 |
medium | 5.3 | 0.0030 | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-116542 |
medium | 6.9 | 0.0021 | 2026-10-29 | Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability t | |
CVE-2026-116544 |
medium | 6.3 | 0.0035 | 2026-10-29 | Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_o | |
CVE-2013-10077 |
medium | 5.5 | 0.0043 | 2026-10-29 | A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings o | |
CVE-2026-114710 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-115597 |
medium | 5.4 | 0.0018 | 2026-10-29 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting I | |
CVE-2026-115598 |
medium | 5.3 | 0.0026 | 2026-10-29 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting I | |
CVE-2026-115906 |
medium | 6.5 | 0.0015 | 2026-10-29 | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6 | |
CVE-2026-115910 |
medium | 6.8 | 0.0016 | 2026-10-29 | Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, | |
CVE-2026-115911 |
medium | 6.5 | 0.0031 | 2026-10-29 | vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32. | |
CVE-2026-115913 |
medium | 6.5 | 0.0033 | 2026-10-29 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Ph | |
CVE-2026-116371 |
medium | 5.3 | 0.0040 | 2026-10-29 | A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted e | |
CVE-2026-116384 |
medium | 5.3 | 0.0020 | 2026-10-29 | A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0. This vu | |
CVE-2026-116388 |
medium | 5.3 | 0.0023 | 2026-10-29 | Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrec | |
CVE-2026-116395 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-116396 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-116403 |
medium | 5.9 | 0.0024 | 2026-10-29 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition' | |
CVE-2026-71455 |
medium | 5.3 | 0.0008 | 2026-10-29 | Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kan | |
CVE-2026-81039 |
medium | 4.3 | 0.0021 | 2026-10-29 | The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_con | |
CVE-2026-82388 |
medium | 5.3 | 0.0021 | 2026-10-29 | bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection | |
CVE-2026-82389 |
medium | 6.5 | 0.0023 | 2026-10-29 | In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/ | |
CVE-2026-112839 |
medium | 4.3 | 0.0020 | 2026-10-29 | Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-cus | |
CVE-2026-115804 |
medium | 6.4 | 0.0029 | 2026-10-29 | HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health | |
CVE-2026-115914 |
medium | 6.5 | 0.0040 | 2026-10-29 | vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32. | |
CVE-2026-115916 |
medium | 6.5 | 0.0031 | 2026-10-29 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/t | |
CVE-2026-115917 |
medium | 4.7 | 0.0024 | 2026-10-29 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Op | |
CVE-2026-115918 |
medium | 6.5 | 0.0035 | 2026-10-29 | vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32. | |
CVE-2026-115919 |
medium | 6.2 | 0.0018 | 2026-10-29 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperabil | |
CVE-2026-115920 |
medium | 6.2 | 0.0018 | 2026-10-29 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperabil | |
CVE-2026-115921 |
medium | 6.2 | 0.0013 | 2026-10-29 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperabil | |
CVE-2026-115922 |
medium | 6.2 | 0.0013 | 2026-10-29 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperabil | |
CVE-2026-115923 |
medium | 6.5 | 0.0032 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0 | |
CVE-2026-115966 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne |