Browse All CVEs
33,186 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-0262 |
medium | 6.6 | 0.0036 | 2026-10-29 | Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an | |
CVE-2026-22677 |
medium | 6.0 | 0.0038 | 2026-10-29 | Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session impor | |
CVE-2026-30904 |
medium | 4.3 | 0.0014 | 2026-10-29 | Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an a | |
CVE-2026-30905 |
high | 7.8 | 0.0012 | 2026-10-29 | External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal I | |
CVE-2026-30906 |
high | 7.8 | 0.0012 | 2026-10-29 | Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may | |
CVE-2026-33583 |
high | 8.7 | 0.0021 | 2026-10-29 | Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) a | |
CVE-2026-33584 |
medium | 5.3 | 0.0031 | 2026-10-29 | Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables | |
CVE-2026-33585 |
low | 3.8 | 0.0013 | 2026-10-29 | Improper management of the idle timeout parameter in the Keycloak interface of the Arqit S | |
CVE-2026-42580 |
medium | 6.5 | 0.0038 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42582 |
high | 7.5 | 0.0044 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42583 |
high | 7.5 | 0.0046 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42584 |
critical | 9.1 | 0.0084 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42585 |
high | 7.5 | 0.0027 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42586 |
high | 7.1 | 0.0022 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42587 |
— | — | 0.0099 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-43970 |
high | 8.2 | 0.0051 | 2026-10-29 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenine | |
CVE-2026-44248 |
high | 7.5 | 0.0056 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-8466 |
high | 8.2 | 0.0038 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy all | |
CVE-2026-8496 |
medium | 6.1 | 0.0043 | 2026-10-29 | A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A malic | |
CVE-2026-0243 |
medium | 4.9 | 0.0017 | 2026-10-29 | A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices en | |
CVE-2026-28374 |
medium | 4.3 | 0.0020 | 2026-10-29 | Editors could delete any annotation, even those they do not have read access to. The edito | |
CVE-2026-28376 |
medium | 6.5 | 0.0033 | 2026-10-29 | The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by se | |
CVE-2026-28379 |
medium | 6.5 | 0.0026 | 2026-10-29 | A race condition in Grafana Live allows authenticated users with Viewer role to trigger a | |
CVE-2026-28380 |
medium | 6.5 | 0.0023 | 2026-10-29 | Any Editor could delete any snapshot, even if they have no access to read or write them. | |
CVE-2026-28383 |
medium | 6.5 | 0.0033 | 2026-10-29 | A request to the Grafana plugin resources endpoint can cause unbounded memory allocation b | |
CVE-2026-33376 |
high | 7.4 | 0.0028 | 2026-10-29 | When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Ad | |
CVE-2026-33377 |
high | 7.1 | 0.0023 | 2026-10-29 | An Editor can overwrite a dashboard not owned by them to acquire admin on that specific da | |
CVE-2026-33378 |
medium | 6.5 | 0.0033 | 2026-10-29 | Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requi | |
CVE-2026-33380 |
medium | 6.5 | 0.0037 | 2026-10-29 | A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary file | |
CVE-2026-33381 |
high | 8.1 | 0.0034 | 2026-10-29 | When a user's access to mint tokens for a service account is revoked, it is sometimes stil | |
CVE-2026-42548 |
high | 8.6 | 0.0045 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concaten | |
CVE-2026-42549 |
medium | 4.4 | 0.0020 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI | |
CVE-2026-42550 |
high | 8.8 | 0.0046 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), Sim | |
CVE-2026-42551 |
high | 7.5 | 0.0035 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unc | |
CVE-2026-42552 |
high | 7.5 | 0.0034 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handle | |
CVE-2026-44351 |
critical | 9.1 | 0.0025 | 2026-10-29 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical aut | |
CVE-2026-44363 |
medium | 5.8 | 0.0010 | 2026-10-29 | MISP modules are autonomous modules that can be used to extend MISP for new services. Prio | |
CVE-2026-44364 |
critical | 9.3 | 0.0019 | 2026-10-29 | MISP modules are autonomous modules that can be used to extend MISP for new services. In 3 | |
CVE-2026-21821 |
high | 8.3 | 0.0021 | 2026-10-29 | The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQue | |
CVE-2026-42561 |
— | — | 0.0074 | 2026-10-29 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multi | |
CVE-2026-42602 |
high | 8.1 | 0.0022 | 2026-10-29 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server | |
CVE-2026-44368 |
medium | 6.9 | 0.0031 | 2026-10-29 | PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, | |
CVE-2026-44372 |
medium | 5.3 | 0.0028 | 2026-10-29 | Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could tur | |
CVE-2026-44373 |
medium | 5.3 | 0.0045 | 2026-10-29 | Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could byp | |
CVE-2026-44418 |
high | 8.7 | 0.0029 | 2026-10-29 | EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput | |
CVE-2026-45228 |
medium | 5.1 | 0.0018 | 2026-10-29 | Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the Syste | |
CVE-2026-45229 |
high | 8.7 | 0.0037 | 2026-10-29 | Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endp | |
CVE-2026-8328 |
medium | 5.9 | 0.0046 | 2026-10-29 | The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While | |
CVE-2026-29205 |
high | 8.6 | 0.0837 | 2026-10-29 | Incorrect privileges management and insufficient path filtering allow to read arbitrary fi | |
CVE-2026-32992 |
high | 8.2 | 0.0025 | 2026-10-29 | SSL verification is disabled in the DNS Cluster system. This could allow for a malicious s |