Browse All CVEs
33,316 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-56384 |
medium | 5.3 | 0.0033 | 2026-10-29 | Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpo | |
CVE-2026-56385 |
medium | 5.3 | 0.0036 | 2026-10-29 | Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authoriz | |
CVE-2026-56393 |
medium | 4.6 | 0.0022 | 2026-10-29 | Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) conta | |
CVE-2026-56394 |
high | 7.1 | 0.0049 | 2026-10-29 | Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the ass | |
CVE-2026-56403 |
medium | 6.9 | 0.0017 | 2026-10-29 | libexpat before 2.8.2 has an integer overflow in storeAtts. | |
CVE-2026-56404 |
medium | 6.9 | 0.0013 | 2026-10-29 | libexpat before 2.8.2 has an integer overflow in addBinding. | |
CVE-2026-56405 |
medium | 6.9 | 0.0013 | 2026-10-29 | libexpat before 2.8.2 has an integer overflow in getAttributeId. | |
CVE-2026-56406 |
medium | 6.9 | 0.0017 | 2026-10-29 | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check | |
CVE-2026-56407 |
medium | 6.9 | 0.0017 | 2026-10-29 | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityVa | |
CVE-2026-56408 |
medium | 6.9 | 0.0013 | 2026-10-29 | libexpat before 2.8.2 has an integer overflow in copyString. | |
CVE-2026-56409 |
medium | 6.5 | 0.0012 | 2026-10-29 | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d out | |
CVE-2026-56410 |
medium | 6.9 | 0.0013 | 2026-10-29 | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | |
CVE-2026-56411 |
medium | 6.9 | 0.0013 | 2026-10-29 | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION decl | |
CVE-2026-56412 |
medium | 5.9 | 0.0018 | 2026-10-29 | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lack | |
CVE-2026-12805 |
low | 2.1 | 0.0047 | 2026-10-29 | A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XML | |
CVE-2026-12806 |
high | 7.4 | 0.0080 | 2026-10-29 | A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element is the fu | |
CVE-2026-12807 |
low | 2.1 | 0.0238 | 2026-10-29 | A vulnerability was found in Edimax BR-6478AC V2 1.23. This affects the function setWAN of | |
CVE-2026-12808 |
low | 2.1 | 0.0238 | 2026-10-29 | A vulnerability was determined in Edimax BR-6478AC V2 1.23. This impacts the function stai | |
CVE-2026-12809 |
low | 2.1 | 0.0238 | 2026-10-29 | A vulnerability was identified in Edimax BR-6478AC V2 1.23. Affected is the function wiz_5 | |
CVE-2026-12810 |
low | 2.1 | 0.0238 | 2026-10-29 | A security flaw has been discovered in Edimax BR-6478AC V2 1.23. Affected by this vulnerab | |
CVE-2026-12811 |
low | 2.1 | 0.0050 | 2026-10-29 | A weakness has been identified in kortix-ai suna up to 0.8.38. Affected by this issue is t | |
CVE-2026-12812 |
low | 2.0 | 0.0033 | 2026-10-29 | A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This | |
CVE-2026-12814 |
low | 2.1 | 0.0238 | 2026-10-29 | A flaw has been found in Comfast CF-WR631AX V3 up to 2.7.0.8. This issue affects the funct | |
CVE-2026-12815 |
low | 2.1 | 0.0170 | 2026-10-29 | A vulnerability has been found in coollabsio coolify 4.0.0. Impacted is an unknown functio | |
CVE-2026-12821 |
low | 2.1 | 0.0049 | 2026-10-29 | A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is a | |
CVE-2026-12822 |
low | 1.9 | 0.0028 | 2026-10-29 | A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknow | |
CVE-2026-12823 |
low | 1.9 | 0.0016 | 2026-10-29 | A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an | |
CVE-2026-11745 |
high | 8.8 | 0.0022 | 2026-10-29 | A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0. | |
CVE-2026-11746 |
critical | 9.4 | 0.0023 | 2026-10-29 | A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where | |
CVE-2026-11748 |
medium | 6.9 | 0.0048 | 2026-10-29 | A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0. | |
CVE-2026-8918 |
high | 7.1 | 0.0028 | 2026-10-29 | A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to | |
CVE-2026-6645 |
high | 7.3 | 0.0018 | 2026-10-29 | An insecure process execution vulnerability exists in the pc-printer-updater.exe component | |
CVE-2026-44911 |
low | 2.3 | 0.0052 | 2026-10-29 | Authorization handling for component configuration verification requests in Apache NiFi 1. | |
CVE-2026-44913 |
medium | 5.2 | 0.0065 | 2026-10-29 | Improper escaping of database table names in the CaptureChangeMySQL Processor included wit | |
CVE-2026-44914 |
high | 7.5 | 0.0066 | 2026-10-29 | Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups t | |
CVE-2026-54665 |
medium | 6.3 | 0.0033 | 2026-10-29 | Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP r | |
CVE-2026-12580 |
medium | 5.1 | 0.0028 | 2026-10-29 | EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowi | |
CVE-2026-12581 |
high | 7.7 | 0.0045 | 2026-10-29 | EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticate | |
CVE-2026-12862 |
medium | 5.1 | 0.0038 | 2026-10-29 | Untrusted user data was passed verbatim to Excel exports for administrators. This allowed | |
CVE-2026-12863 |
medium | 5.1 | 0.0035 | 2026-10-29 | An unvalidated redirect was contained in Venueless' social login functionality and could b | |
CVE-2026-11373 |
critical | 9.1 | 0.0057 | 2026-10-29 | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Stats | |
CVE-2026-10561 |
critical | 10.0 | 0.0082 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of | |
CVE-2026-10601 |
medium | 4.3 | 0.0029 | 2026-10-29 | A user with Viewer permissions can use specially crafted requests to the Tempo and Loki da | |
CVE-2026-12602 |
high | 8.8 | 0.0018 | 2026-10-29 | Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulner | |
CVE-2026-12888 |
low | 2.0 | 0.0044 | 2026-10-29 | An HTML injection vulnerability exists in the Google Chat webhook notification sent by Th | |
CVE-2026-28381 |
high | 8.1 | 0.0035 | 2026-10-29 | The Snowflake datasource allows for GET/PUT commands, which can allow any user with access | |
CVE-2026-42129 |
high | 7.7 | 0.0044 | 2026-10-29 | A user with Viewer permissions can use a path traversal in the Loki data source plugin to | |
CVE-2026-56448 |
high | 8.3 | 0.0044 | 2026-10-29 | A path traversal vulnerability exists in AIL Framework before the release containing commi | |
CVE-2026-56450 |
medium | 5.1 | 0.0058 | 2026-10-29 | AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) | |
CVE-2026-6653 |
high | 7.0 | 0.0036 | 2026-10-29 | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2. |