Browse All CVEs
33,178 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44441 |
medium | 4.3 | 0.0016 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and | |
CVE-2026-44442 |
critical | 9.9 | 0.0028 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, cert | |
CVE-2026-44445 |
medium | 5.3 | 0.0022 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and | |
CVE-2026-44446 |
high | 7.5 | 0.0027 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and | |
CVE-2026-44447 |
high | 7.5 | 0.0031 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some | |
CVE-2026-44448 |
medium | 6.5 | 0.0014 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and | |
CVE-2026-44471 |
high | 7.8 | 0.0029 | 2026-10-29 | gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree ca | |
CVE-2026-45158 |
critical | 9.1 | 0.0053 | 2026-10-29 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized us | |
CVE-2026-29206 |
high | 8.1 | 0.0031 | 2026-10-29 | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL I | |
CVE-2026-32991 |
high | 7.1 | 0.0023 | 2026-10-29 | Improper authorization checks of team members privileges allow a team member to escalate p | |
CVE-2026-8500 |
critical | 9.8 | 0.0165 | 2026-10-29 | Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small C | |
CVE-2026-41281 |
medium | 6.3 | 0.0009 | 2026-10-29 | Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmissio | |
CVE-2026-44919 |
medium | 6.5 | 0.0047 | 2026-10-29 | In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop i | |
CVE-2026-46419 |
high | 7.5 | 0.0031 | 2026-10-29 | Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly chec | |
CVE-2026-46445 |
high | 7.1 | 0.0024 | 2026-10-29 | SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. | |
CVE-2026-46446 |
high | 7.1 | 0.0024 | 2026-10-29 | SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored | |
CVE-2026-6506 |
high | 8.8 | 0.0029 | 2026-10-29 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versi | |
CVE-2026-6510 |
critical | 9.8 | 0.0044 | 2026-10-29 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing | |
CVE-2026-6512 |
critical | 9.1 | 0.0026 | 2026-10-29 | The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versi | |
CVE-2026-6514 |
high | 7.5 | 0.0027 | 2026-10-29 | The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versio | |
CVE-2026-2347 |
critical | 9.8 | 0.0043 | 2026-10-29 | Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software | |
CVE-2026-8468 |
high | 8.2 | 0.0062 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug al | |
CVE-2026-45205 |
medium | 5.3 | 0.0047 | 2026-10-29 | Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted conf | |
CVE-2026-43644 |
medium | 5.1 | 0.0019 | 2026-10-29 | podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /ech | |
CVE-2026-6008 |
medium | 6.8 | 0.0022 | 2026-10-29 | Authorization bypass through User-Controlled key vulnerability in Im Park Information Tech | |
CVE-2026-1630 |
medium | 5.1 | 0.0043 | 2026-10-29 | WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" | |
CVE-2026-21730 |
medium | 5.3 | 0.0021 | 2026-10-29 | Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login lo | |
CVE-2026-41932 |
medium | 5.3 | 0.0022 | 2026-10-29 | Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer | |
CVE-2026-41933 |
medium | 6.9 | 0.0025 | 2026-10-29 | Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability tha | |
CVE-2026-41935 |
high | 7.1 | 0.0027 | 2026-10-29 | Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin control | |
CVE-2026-41937 |
high | 8.6 | 0.0040 | 2026-10-29 | Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin uplo | |
CVE-2026-42559 |
high | 8.8 | 0.0027 | 2026-10-29 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the r | |
CVE-2026-42881 |
high | 8.4 | 0.0023 | 2026-10-29 | STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1. | |
CVE-2026-44216 |
medium | 5.9 | 0.0032 | 2026-10-29 | Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime | |
CVE-2026-44308 |
medium | 6.3 | 0.0018 | 2026-10-29 | Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applica | |
CVE-2026-44371 |
medium | 5.3 | 0.0026 | 2026-10-29 | Open OnDemand is an open-source high-performance computing portal. Prior to 4.0.11, 4.1.5, | |
CVE-2026-44374 |
medium | 4.3 | 0.0017 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 0.6.11, the unproc | |
CVE-2026-44375 |
high | 7.5 | 0.0035 | 2026-10-29 | Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to | |
CVE-2026-44482 |
critical | 9.6 | 0.0034 | 2026-10-29 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and A | |
CVE-2026-42159 |
medium | 5.3 | 0.0019 | 2026-10-29 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investi | |
CVE-2026-42281 |
critical | 9.2 | 0.0162 | 2026-10-29 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthen | |
CVE-2026-44503 |
high | 7.0 | 0.0064 | 2026-10-29 | The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiot | |
CVE-2026-20182 |
critical | 10.0 | 0.9182 | 2026-10-29 | KEV | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability |
CVE-2026-20209 |
medium | 5.4 | 0.0019 | 2026-10-29 | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, c | |
CVE-2026-20210 |
medium | 5.4 | 0.0019 | 2026-10-29 | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, c | |
CVE-2026-20224 |
high | 8.6 | 0.0109 | 2026-10-29 | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, c | |
CVE-2026-42555 |
critical | 9.1 | 0.0058 | 2026-10-29 | Valtimo is an open-source business process automation platform. com.ritense.valtimo:docume | |
CVE-2026-44312 |
medium | 5.8 | 0.0015 | 2026-10-29 | css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not va | |
CVE-2026-44511 |
high | 7.4 | 0.0020 | 2026-10-29 | Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5. | |
CVE-2026-44513 |
— | — | 0.0107 | 2026-10-29 | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remo |