Browse All CVEs
33,256 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42857 |
medium | 5.4 | 0.0018 | 2026-10-29 | Open edX Platform enables the authoring and delivery of online learning at any scale. The | |
CVE-2026-42858 |
critical | 9.9 | 0.0037 | 2026-10-29 | Open edX Platform enables the authoring and delivery of online learning at any scale. The | |
CVE-2026-42859 |
high | 8.1 | 0.0063 | 2026-10-29 | Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overfl | |
CVE-2026-42860 |
high | 8.5 | 0.0030 | 2026-10-29 | The Open edx Enterprise Service app provides enterprise features to the Open edX platform. | |
CVE-2026-42865 |
low | 2.3 | 0.0023 | 2026-10-29 | Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email strea | |
CVE-2026-43638 |
medium | 5.3 | 0.0019 | 2026-10-29 | Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that al | |
CVE-2026-43639 |
high | 8.9 | 0.0060 | 2026-10-29 | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that al | |
CVE-2026-43640 |
high | 8.6 | 0.0050 | 2026-10-29 | Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication whe | |
CVE-2026-43894 |
medium | 5.5 | 0.0016 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is giv | |
CVE-2026-43895 |
medium | 4.4 | 0.0016 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes i | |
CVE-2026-43896 |
medium | 5.5 | 0.0015 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_objec | |
CVE-2026-43995 |
medium | 5.3 | 0.0040 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-44413 |
high | 7.5 | 0.0027 | 2026-10-29 | In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API | |
CVE-2026-44658 |
low | 2.4 | 0.0016 | 2026-10-29 | Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are v | |
CVE-2026-44659 |
medium | 4.7 | 0.0016 | 2026-10-29 | Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates l | |
CVE-2026-44777 |
medium | 5.4 | 0.0016 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader r | |
CVE-2026-5266 |
low | 2.3 | 0.0025 | 2026-10-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foun | |
CVE-2026-7210 |
medium | 6.3 | 0.0067 | 2026-10-29 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-fl | |
CVE-2026-7308 |
medium | 5.1 | 0.0026 | 2026-10-29 | An authenticated user with upload permission to a hosted repository can store content that | |
CVE-2026-42864 |
critical | 9.9 | 0.0027 | 2026-10-29 | FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firef | |
CVE-2026-42866 |
medium | 6.7 | 0.0021 | 2026-10-29 | Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py | |
CVE-2026-42871 |
medium | 6.9 | 0.0025 | 2026-10-29 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/f | |
CVE-2026-43968 |
medium | 6.3 | 0.0027 | 2026-10-29 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines co | |
CVE-2026-43969 |
low | 2.1 | 0.0015 | 2026-10-29 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines co | |
CVE-2026-45222 |
medium | 6.9 | 0.0015 | 2026-10-29 | Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configurati | |
CVE-2026-45223 |
high | 7.7 | 0.0038 | 2026-10-29 | Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator us | |
CVE-2026-45224 |
medium | 6.8 | 0.0014 | 2026-10-29 | Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's worksp | |
CVE-2026-7790 |
high | 8.7 | 0.0043 | 2026-10-29 | Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) a | |
CVE-2026-8318 |
medium | 5.5 | 0.0037 | 2026-10-29 | A security flaw has been discovered in VectifyAI PageIndex up to f50e52975313c6716c02b20a1 | |
CVE-2026-42565 |
medium | 4.3 | 0.0019 | 2026-10-29 | @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. P | |
CVE-2026-42869 |
critical | 10.0 | 0.0056 | 2026-10-29 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security oper | |
CVE-2026-42870 |
medium | 6.4 | 0.0035 | 2026-10-29 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored C | |
CVE-2026-42872 |
medium | 6.1 | 0.0021 | 2026-10-29 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflecte | |
CVE-2026-42873 |
none | — | 0.0023 | 2026-10-29 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when atte | |
CVE-2026-42874 |
low | 3.7 | 0.0022 | 2026-10-29 | Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() | |
CVE-2026-42882 |
critical | 9.4 | 0.0055 | 2026-10-29 | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an | |
CVE-2026-42883 |
medium | 6.5 | 0.0026 | 2026-10-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /ap | |
CVE-2026-42884 |
medium | 4.3 | 0.0020 | 2026-10-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /ap | |
CVE-2026-42885 |
medium | 4.3 | 0.0028 | 2026-10-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /a | |
CVE-2026-42886 |
medium | 4.9 | 0.0031 | 2026-10-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /a | |
CVE-2026-42887 |
medium | 4.5 | 0.0026 | 2026-10-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cr | |
CVE-2026-45025 |
medium | 6.8 | 0.0029 | 2026-10-29 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored C | |
CVE-2026-45026 |
medium | 6.8 | 0.0029 | 2026-10-29 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored C | |
CVE-2026-6146 |
medium | 5.3 | 0.0017 | 2026-10-29 | Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys. | |
CVE-2026-8319 |
medium | 5.5 | 0.0038 | 2026-10-29 | A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c9709 | |
CVE-2026-8320 |
low | 2.0 | 0.0022 | 2026-10-29 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects th | |
CVE-2026-8321 |
medium | 5.5 | 0.0041 | 2026-10-29 | A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the func | |
CVE-2026-20696 |
medium | 5.5 | 0.0012 | 2026-10-29 | An authorization issue was addressed with improved state management. This issue is fixed i | |
CVE-2026-28819 |
medium | 5.4 | 0.0650 | 2026-10-29 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fi | |
CVE-2026-28830 |
medium | 4.7 | 0.0008 | 2026-10-29 | A race condition was addressed with additional validation. This issue is fixed in macOS Ta |