Browse All CVEs
33,313 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-9029 |
medium | 5.4 | 0.0025 | 2026-10-29 | A user with Editor permissions can place a malicious script in the attribution field of a | |
CVE-2026-10845 |
high | 7.3 | 0.0047 | 2026-10-29 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authe | |
CVE-2026-11372 |
medium | 5.4 | 0.0023 | 2026-10-29 | IBM TRIRIGA Application Platform 5.0.2 through 5.0.3 is vulnerable to cross-site scripting | |
CVE-2026-12479 |
medium | 6.1 | 0.0036 | 2026-10-29 | A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in | |
CVE-2026-41045 |
high | 7.0 | 0.0016 | 2026-10-29 | A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allo | |
CVE-2026-41046 |
high | 7.3 | 0.0019 | 2026-10-29 | A path traversal attack when using a "configName" parameter in qSnapper before version 1.3 | |
CVE-2026-41047 |
medium | 6.9 | 0.0020 | 2026-10-29 | Lack of authentication when using the "snapshot diff" functions in qSnapper before version | |
CVE-2026-41048 |
high | 8.4 | 0.0018 | 2026-10-29 | Incorrect caching of authentication between different polkit methods in qSnapper before ve | |
CVE-2026-41049 |
high | 8.4 | 0.0018 | 2026-10-29 | Incorrect caching of authentication between different users of the qSnapper dbus service | |
CVE-2026-53550 |
medium | 5.3 | 0.0042 | 2026-10-29 | js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML | |
CVE-2026-53655 |
medium | 6.9 | 0.0016 | 2026-10-29 | node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX | |
CVE-2026-7664 |
critical | 9.8 | 0.0050 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access prote | |
CVE-2026-8858 |
high | 8.8 | 0.0041 | 2026-10-29 | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerab | |
CVE-2026-8934 |
medium | 6.9 | 0.0051 | 2026-10-29 | A Missing Authorization vulnerability in a GraphQL private API operation of the Google App | |
CVE-2026-9006 |
critical | 9.1 | 0.0039 | 2026-10-29 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery | |
CVE-2026-9072 |
critical | 9.8 | 0.0072 | 2026-10-29 | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using | |
CVE-2026-10789 |
critical | 9.6 | 0.0070 | 2026-10-29 | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running | |
CVE-2026-48712 |
high | 7.5 | 0.0046 | 2026-10-29 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 an | |
CVE-2026-50269 |
low | 2.7 | 0.0053 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-53537 |
medium | 5.3 | 0.0029 | 2026-10-29 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_option | |
CVE-2026-53538 |
low | 3.7 | 0.0026 | 2026-10-29 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringP | |
CVE-2026-53539 |
high | 7.5 | 0.0046 | 2026-10-29 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing | |
CVE-2026-53540 |
low | 3.7 | 0.0034 | 2026-10-29 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() | |
CVE-2026-53571 |
high | 8.2 | 0.0058 | 2026-10-29 | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, th | |
CVE-2026-54269 |
medium | 5.3 | 0.0040 | 2026-10-29 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 an | |
CVE-2026-54270 |
medium | 5.3 | 0.0040 | 2026-10-29 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4 | |
CVE-2026-54271 |
high | 8.2 | 0.0030 | 2026-10-29 | protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a pre | |
CVE-2026-54273 |
medium | 6.6 | 0.0049 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-54274 |
medium | 6.6 | 0.0054 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-54275 |
low | 2.7 | 0.0047 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-54276 |
medium | 6.3 | 0.0031 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-54277 |
medium | 6.6 | 0.0056 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-54278 |
medium | 6.6 | 0.0049 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-54279 |
low | 1.3 | 0.0049 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-54280 |
low | 1.7 | 0.0046 | 2026-10-29 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3 | |
CVE-2026-54282 |
medium | 5.3 | 0.0027 | 2026-10-29 | Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path i | |
CVE-2026-54283 |
high | 7.5 | 0.0048 | 2026-10-29 | Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() | |
CVE-2026-54285 |
medium | 5.3 | 0.0040 | 2026-10-29 | opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropaga | |
CVE-2026-54286 |
medium | 5.9 | 0.0043 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. Prio | |
CVE-2026-54287 |
medium | 5.3 | 0.0031 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. Prio | |
CVE-2026-54289 |
medium | 4.8 | 0.0018 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. Prio | |
CVE-2026-54290 |
high | 7.1 | 0.0033 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. Prio | |
CVE-2026-55388 |
high | 8.1 | 0.0048 | 2026-10-29 | piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, pi | |
CVE-2026-55602 |
medium | 6.9 | 0.0038 | 2026-10-29 | http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, a | |
CVE-2026-56109 |
high | 7.0 | 0.0014 | 2026-10-29 | The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-fre | |
CVE-2026-50146 |
medium | 6.1 | 0.0027 | 2026-10-29 | Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astr | |
CVE-2026-53779 |
high | 8.7 | 0.0059 | 2026-10-29 | WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allo | |
CVE-2026-54288 |
medium | 6.5 | 0.0015 | 2026-10-29 | Hono is a Web application framework that provides support for any JavaScript runtime. Prio | |
CVE-2026-54298 |
medium | 6.1 | 0.0023 | 2026-10-29 | Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server- | |
CVE-2026-54299 |
high | 7.5 | 0.0033 | 2026-10-29 | Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/40 |