Browse All CVEs
33,297 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54512 |
high | 8.1 | 0.0094 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54513 |
— | — | 0.0123 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54514 |
medium | 5.3 | 0.0037 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54515 |
medium | 5.3 | 0.0044 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54516 |
medium | 5.3 | 0.0045 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54517 |
medium | 5.3 | 0.0038 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54518 |
medium | 6.5 | 0.0035 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-11972 |
high | 8.2 | 0.0072 | 2026-10-29 | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tar | |
CVE-2026-12163 |
medium | 4.8 | 0.0024 | 2026-10-29 | Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9. | |
CVE-2026-12164 |
medium | 4.4 | 0.0014 | 2026-10-29 | Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9. | |
CVE-2026-48493 |
medium | 5.5 | 0.0031 | 2026-10-29 | Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with | |
CVE-2026-5818 |
high | 7.2 | 0.0024 | 2026-10-29 | Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwa | |
CVE-2026-6458 |
medium | 5.1 | 0.0020 | 2026-10-29 | Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results i | |
CVE-2026-7574 |
high | 8.7 | 0.0011 | 2026-10-29 | Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2 | |
CVE-2026-54639 |
high | 8.8 | 0.0036 | 2026-10-29 | Style Dictionary, a build system for creating cross-platform styles, has a prototype pollu | |
CVE-2026-12681 |
high | 8.9 | 0.0027 | 2026-10-29 | Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Goog | |
CVE-2026-12485 |
critical | 10.0 | 0.0060 | 2026-10-29 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be cont | |
CVE-2026-12486 |
critical | 9.1 | 0.0270 | 2026-10-29 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-12488 |
medium | 6.2 | 0.0034 | 2026-10-29 | A memory corruption vulnerability exists in the GV-Cloud functionality of GeoVision GV-VMS | |
CVE-2026-12846 |
critical | 10.0 | 0.0060 | 2026-10-29 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be cont | |
CVE-2026-12847 |
critical | 10.0 | 0.0060 | 2026-10-29 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be cont | |
CVE-2026-12848 |
critical | 10.0 | 0.0060 | 2026-10-29 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be cont | |
CVE-2026-12849 |
critical | 9.1 | 0.0270 | 2026-10-29 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-12850 |
critical | 9.1 | 0.0270 | 2026-10-29 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-12851 |
critical | 9.1 | 0.0270 | 2026-10-29 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-9539 |
medium | 6.5 | 0.0022 | 2026-10-29 | An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoo | |
CVE-2026-10735 |
high | 7.5 | 0.0043 | 2026-10-29 | Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro Wo | |
CVE-2026-13006 |
high | 7.0 | 0.0018 | 2026-10-29 | ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up | |
CVE-2026-52936 |
medium | 5.5 | 0.0011 | 2026-10-29 | In the Linux kernel, the following vulnerability has been resolved: crypto: jitterentropy | |
CVE-2026-56052 |
high | 7.6 | 0.0038 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-10745 |
high | 7.9 | 0.0043 | 2026-10-29 | Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Insta | |
CVE-2026-11968 |
medium | 5.5 | 0.0018 | 2026-10-29 | Argument Injection in TortoiseGitBlame via Malicious Git History Filenames Leads to Arbitr | |
CVE-2026-13140 |
low | 1.1 | 0.0029 | 2026-10-29 | Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research C | |
CVE-2026-13163 |
medium | 5.3 | 0.0051 | 2026-10-29 | Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking | |
CVE-2026-56223 |
critical | 9.3 | 0.0040 | 2026-10-29 | Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the pr | |
CVE-2026-56232 |
high | 8.7 | 0.0034 | 2026-10-29 | Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on | |
CVE-2026-56244 |
high | 7.1 | 0.0024 | 2026-10-29 | Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supaba | |
CVE-2026-56245 |
high | 8.8 | 0.0034 | 2026-10-29 | Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECUR | |
CVE-2026-56256 |
high | 7.1 | 0.0030 | 2026-10-29 | Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. S | |
CVE-2026-56269 |
medium | 4.3 | 0.0013 | 2026-10-29 | Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardco | |
CVE-2026-56272 |
medium | 5.6 | 0.0010 | 2026-10-29 | Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterati | |
CVE-2026-56302 |
medium | 6.9 | 0.0035 | 2026-10-29 | Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security c | |
CVE-2026-56310 |
medium | 5.3 | 0.0023 | 2026-10-29 | Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organiza | |
CVE-2026-56368 |
medium | 6.3 | 0.0046 | 2026-10-29 | ImageMagick before 7.1.2-15 contains a memory leak vulnerability in multiple coders that w | |
CVE-2026-56761 |
medium | 5.3 | 0.0029 | 2026-10-29 | hono before 4.12.14 contains an html injection vulnerability in jsx server-side rendering | |
CVE-2026-35025 |
high | 8.6 | 0.0050 | 2026-10-29 | ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that | |
CVE-2026-42450 |
high | 8.4 | 0.0018 | 2026-10-29 | OpenColorIO is a color management framework for visual effects and animation. Prior to ver | |
CVE-2026-57280 |
high | 8.8 | 0.0051 | 2026-10-29 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the impli | |
CVE-2026-57281 |
— | — | 0.0092 | 2026-10-29 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST t | |
CVE-2026-57282 |
medium | 5.0 | 0.0025 | 2026-10-29 | Jenkins Git client Plugin 6.6.0 and earlier does not correctly escape the workspace direct |