Browse All CVEs
33,202 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44870 |
high | 8.8 | 0.0090 | 2026-10-29 | Command injection vulnerabilities exist in the command line interface (CLI) service access | |
CVE-2026-44872 |
high | 7.2 | 0.0081 | 2026-10-29 | A command injection vulnerability exists in the web-based management interface of AOS-8 an | |
CVE-2026-44873 |
medium | 5.4 | 0.0014 | 2026-10-29 | A session management vulnerability in AOS-8 allows previously authenticated users to retai | |
CVE-2026-44874 |
medium | 4.9 | 0.0031 | 2026-10-29 | A vulnerability exists in the web-based management interface of an AOS-10 Gateway that cou | |
CVE-2026-6959 |
medium | 6.0 | 0.0017 | 2026-10-29 | HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read | |
CVE-2026-7474 |
high | 8.8 | 0.0816 | 2026-10-29 | HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on th | |
CVE-2026-8052 |
medium | 6.0 | 0.0013 | 2026-10-29 | HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read an | |
CVE-2026-35504 |
medium | 5.1 | 0.0027 | 2026-10-29 | PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerabilit | |
CVE-2026-44010 |
high | 7.1 | 0.0041 | 2026-10-29 | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, t | |
CVE-2026-44011 |
high | 8.6 | 0.0062 | 2026-10-29 | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, C | |
CVE-2026-44012 |
high | 7.1 | 0.0034 | 2026-10-29 | Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsCon | |
CVE-2026-44224 |
high | 8.6 | 0.0038 | 2026-10-29 | Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update Gr | |
CVE-2026-44232 |
high | 8.7 | 0.0041 | 2026-10-29 | DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defen | |
CVE-2026-44240 |
high | 7.5 | 0.0051 | 2026-10-29 | basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client- | |
CVE-2026-44246 |
high | 7.2 | 0.0029 | 2026-10-29 | nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a d | |
CVE-2026-26289 |
high | 8.4 | 0.0014 | 2026-10-29 | PowerSYSTEM Center REST API endpoint for device account export allows an authenticated use | |
CVE-2026-33570 |
medium | 6.9 | 0.0016 | 2026-10-29 | PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user | |
CVE-2026-35555 |
high | 7.0 | 0.0015 | 2026-10-29 | PowerSYSTEM Center feature for device project groups allows an authenticated user with lim | |
CVE-2026-40863 |
high | 7.5 | 0.0040 | 2026-10-29 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1 | |
CVE-2026-40902 |
high | 7.5 | 0.0040 | 2026-10-29 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1 | |
CVE-2026-42196 |
critical | 9.9 | 0.0056 | 2026-10-29 | django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, | |
CVE-2026-42268 |
high | 8.2 | 0.0040 | 2026-10-29 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Ap | |
CVE-2026-42544 |
high | 7.5 | 0.0039 | 2026-10-29 | Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts | |
CVE-2026-42545 |
medium | 5.9 | 0.0027 | 2026-10-29 | Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts | |
CVE-2026-42844 |
high | 8.7 | 0.0034 | 2026-10-29 | Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated AP | |
CVE-2026-42854 |
critical | 9.8 | 0.0057 | 2026-10-29 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and | |
CVE-2026-42855 |
high | 7.5 | 0.0035 | 2026-10-29 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and | |
CVE-2026-44015 |
critical | 9.9 | 0.0032 | 2026-10-29 | Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authen | |
CVE-2026-44241 |
high | 7.5 | 0.0064 | 2026-10-29 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular | |
CVE-2026-44242 |
low | 3.7 | 0.0026 | 2026-10-29 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular | |
CVE-2026-44257 |
critical | 9.3 | 0.0039 | 2026-10-29 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip w | |
CVE-2026-44258 |
critical | 9.3 | 0.0036 | 2026-10-29 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk funct | |
CVE-2026-44259 |
medium | 4.6 | 0.0017 | 2026-10-29 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves fi | |
CVE-2026-44260 |
high | 8.1 | 0.0035 | 2026-10-29 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the | |
CVE-2026-44262 |
critical | 9.4 | 0.0586 | 2026-10-29 | Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, w | |
CVE-2026-44301 |
medium | 6.2 | 0.0027 | 2026-10-29 | Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site th | |
CVE-2026-44302 |
high | 7.5 | 0.0032 | 2026-10-29 | Snappier is a high performance C# implementation of the Snappy compression algorithm. Prio | |
CVE-2026-44304 |
high | 8.1 | 0.0022 | 2026-10-29 | Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module | |
CVE-2026-44305 |
medium | 6.8 | 0.0014 | 2026-10-29 | Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE | |
CVE-2026-44306 |
medium | 5.3 | 0.0021 | 2026-10-29 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.21 an | |
CVE-2026-44307 |
high | 8.7 | 0.0074 | 2026-10-29 | Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using bac | |
CVE-2026-44871 |
high | 8.8 | 0.0123 | 2026-10-29 | Command injection vulnerabilities exist in the command line interface (CLI) service access | |
CVE-2026-45225 |
high | 7.2 | 0.0036 | 2026-10-29 | Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint tha | |
CVE-2026-45226 |
high | 7.6 | 0.0029 | 2026-10-29 | Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution th | |
CVE-2026-45227 |
high | 8.7 | 0.0029 | 2026-10-29 | Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool execu | |
CVE-2026-42156 |
high | 7.1 | 0.0035 | 2026-10-29 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investi | |
CVE-2026-42157 |
medium | 5.1 | 0.0034 | 2026-10-29 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investi | |
CVE-2026-42158 |
low | 2.3 | 0.0021 | 2026-10-29 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investi | |
CVE-2026-42288 |
critical | 10.0 | 0.0072 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026 | |
CVE-2026-42289 |
high | 8.8 | 0.0015 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php proce |