Browse All CVEs
33,306 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44727 |
critical | 9.3 | 0.0044 | 2026-10-29 | Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert H | |
CVE-2026-45034 |
critical | 9.2 | 0.0046 | 2026-10-29 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1 | |
CVE-2026-47240 |
medium | 5.8 | 0.0083 | 2026-10-29 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. | |
CVE-2026-47241 |
low | 2.1 | 0.0038 | 2026-10-29 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. | |
CVE-2026-47242 |
medium | 5.8 | 0.0018 | 2026-10-29 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. | |
CVE-2026-49460 |
medium | 5.1 | 0.0017 | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who | |
CVE-2026-49461 |
medium | 6.9 | 0.0017 | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who | |
CVE-2026-49468 |
critical | 9.5 | 0.0303 | 2026-10-29 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prio | |
CVE-2026-54530 |
medium | 6.9 | 0.0017 | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who | |
CVE-2026-54531 |
medium | 6.9 | 0.0017 | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who | |
CVE-2026-54651 |
medium | 6.9 | 0.0016 | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who | |
CVE-2026-55603 |
high | 7.5 | 0.0029 | 2026-10-29 | http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, | |
CVE-2026-44311 |
medium | 6.1 | 0.0027 | 2026-10-29 | Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scr | |
CVE-2026-44889 |
medium | 6.1 | 0.0027 | 2026-10-29 | WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization | |
CVE-2026-48067 |
medium | 6.5 | 0.0030 | 2026-10-29 | Filament is a collection of full-stack components for accelerated Laravel development. Fro | |
CVE-2026-48166 |
medium | 5.3 | 0.0034 | 2026-10-29 | Filament is a collection of full-stack components for accelerated Laravel development. Fro | |
CVE-2026-48167 |
medium | 6.4 | 0.0025 | 2026-10-29 | Filament is a collection of full-stack components for accelerated Laravel development. Fro | |
CVE-2026-48500 |
medium | 6.5 | 0.0034 | 2026-10-29 | Filament is a collection of full-stack components for accelerated Laravel development. Fro | |
CVE-2026-48505 |
high | 7.4 | 0.0030 | 2026-10-29 | Filament is a collection of full-stack components for accelerated Laravel development. Fro | |
CVE-2026-54281 |
high | 8.7 | 0.0050 | 2026-10-29 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1. | |
CVE-2026-55409 |
high | 7.6 | 0.0028 | 2026-10-29 | Filament is a collection of full-stack components for accelerated Laravel development. Fro | |
CVE-2026-56221 |
high | 7.1 | 0.0034 | 2026-10-29 | Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts wh | |
CVE-2026-56266 |
critical | 9.2 | 0.0048 | 2026-10-29 | Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, | |
CVE-2026-56268 |
medium | 5.3 | 0.0039 | 2026-10-29 | Flowise before 3.1.2 contains an information disclosure vulnerability in the /api/v1/chatf | |
CVE-2026-56280 |
high | 7.1 | 0.0032 | 2026-10-29 | Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jo | |
CVE-2026-56306 |
medium | 5.3 | 0.0030 | 2026-10-29 | Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header | |
CVE-2026-56324 |
high | 8.8 | 0.0033 | 2026-10-29 | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpo | |
CVE-2026-56326 |
medium | 5.3 | 0.0036 | 2026-10-29 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect | |
CVE-2026-41523 |
— | — | 0.0091 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, | |
CVE-2026-47155 |
medium | 6.5 | 0.0025 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, | |
CVE-2026-48746 |
— | — | 0.0115 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until | |
CVE-2026-53923 |
medium | 5.3 | 0.0048 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until | |
CVE-2026-54232 |
high | 8.8 | 0.0056 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, | |
CVE-2026-54233 |
medium | 6.5 | 0.0042 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1r | |
CVE-2026-54235 |
medium | 6.9 | 0.0045 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1r | |
CVE-2026-54236 |
medium | 5.3 | 0.0093 | 2026-10-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1r | |
CVE-2026-10645 |
medium | 5.5 | 0.0016 | 2026-10-29 | The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fie | |
CVE-2026-10651 |
medium | 6.5 | 0.0030 | 2026-10-29 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SD | |
CVE-2026-10658 |
high | 7.1 | 0.0028 | 2026-10-29 | bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when | |
CVE-2026-55653 |
medium | 6.5 | 0.0053 | 2026-10-29 | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerabilit | |
CVE-2026-55655 |
medium | 6.1 | 0.0012 | 2026-10-29 | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hija | |
CVE-2026-9733 |
critical | 9.1 | 0.0052 | 2026-10-29 | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure def | |
CVE-2026-4983 |
medium | 5.4 | 0.0031 | 2026-10-29 | Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage | |
CVE-2026-10711 |
high | 8.8 | 0.0037 | 2026-10-29 | Missing authentication for critical function vulnerability in AKIN Software Computer Impor | |
CVE-2026-10857 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-44089 |
critical | 9.4 | 0.0031 | 2026-10-29 | Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi | |
CVE-2026-54892 |
high | 8.7 | 0.0089 | 2026-10-29 | Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenti | |
CVE-2026-56225 |
high | 8.7 | 0.0037 | 2026-10-29 | Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key | |
CVE-2026-56243 |
high | 8.6 | 0.0035 | 2026-10-29 | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST | |
CVE-2026-56248 |
high | 8.7 | 0.0043 | 2026-10-29 | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-servic |