Browse All CVEs
3,474 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54819 |
critical | 9.3 | 0.0023 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-42530 |
critical | 9.2 | 0.0645 | 2026-10-29 | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open So | |
CVE-2026-47103 |
critical | 9.3 | 0.0136 | 2026-10-29 | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerabi | |
CVE-2026-54812 |
critical | 9.3 | 0.0028 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-55743 |
critical | 9.4 | 0.0039 | 2026-10-29 | The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through | |
CVE-2026-3490 |
critical | 10.0 | 0.0082 | 2026-10-29 | picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass | |
CVE-2026-20266 |
critical | 9.1 | 0.0063 | 2026-10-29 | In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could | |
CVE-2026-2467 |
critical | 9.2 | 0.0019 | 2026-10-29 | Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allo | |
CVE-2026-3894 |
critical | 9.2 | 0.0020 | 2026-10-29 | Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overr | |
CVE-2026-53805 |
critical | 9.3 | 0.0087 | 2026-10-29 | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code exec | |
CVE-2026-48814 |
critical | 9.1 | 0.0044 | 2026-10-29 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier | |
CVE-2026-55200 |
critical | 9.2 | 0.0388 | 2026-10-29 | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in | |
CVE-2026-48768 |
critical | 9.3 | 0.0033 | 2026-10-29 | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-i | |
CVE-2026-55740 |
critical | 9.3 | 0.0028 | 2026-10-29 | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30 | |
CVE-2026-28573 |
critical | 10.0 | 0.0014 | 2026-10-29 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing | |
CVE-2026-11717 |
critical | 9.3 | 0.0018 | 2026-10-29 | An authentication bypass vulnerability exists in the generic opaque token validation path | |
CVE-2026-11718 |
critical | 9.3 | 0.0019 | 2026-10-29 | An authentication bypass vulnerability exists in the generic opaque token validation path | |
CVE-2026-54419 |
critical | 9.3 | 0.0044 | 2026-10-29 | claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, la | |
CVE-2026-55203 |
critical | 9.0 | 0.0033 | 2026-10-29 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability | |
CVE-2026-54390 |
critical | 9.3 | 0.0060 | 2026-10-29 | 1 PoC | JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerabil |
CVE-2026-47846 |
critical | 9.8 | 0.0048 | 2026-10-29 | Bitnami Cassandra container images are affected by a retained default superuser vulnerabil | |
CVE-2026-49252 |
critical | 9.9 | 0.0047 | 2026-10-29 | deepstream is a server that allows clients and backend services to sync data, send message | |
CVE-2026-49257 |
critical | 10.0 | 0.0062 | 2026-10-29 | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apach | |
CVE-2026-49454 |
critical | 9.1 | 0.0023 | 2026-10-29 | Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Ve | |
CVE-2026-47647 |
critical | 9.9 | 0.0078 | 2026-10-29 | Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate | |
CVE-2026-12045 |
critical | 9.4 | 0.0066 | 2026-10-29 | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can infl | |
CVE-2026-12046 |
critical | 9.5 | 0.0104 | 2026-10-29 | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/clos | |
CVE-2026-12048 |
critical | 9.3 | 0.0027 | 2026-10-29 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. | |
CVE-2026-54414 |
critical | 9.3 | 0.0066 | 2026-10-29 | FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoin | |
CVE-2026-44939 |
critical | 9.4 | 0.0128 | 2026-10-29 | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endp | |
CVE-2026-50242 |
critical | 9.8 | 0.0061 | 2026-10-29 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3. | |
CVE-2026-56141 |
critical | 9.8 | 0.0052 | 2026-10-29 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3. | |
CVE-2026-48772 |
critical | 10.0 | 0.0023 | 2026-10-29 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 thro | |
CVE-2026-48773 |
critical | 9.8 | 0.0069 | 2026-10-29 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 throug | |
CVE-2026-45480 |
critical | 10.0 | 0.0090 | 2026-10-29 | Improper authentication in Azure Active Directory allows an unauthorized attacker to eleva | |
CVE-2026-48582 |
critical | 9.6 | 0.0069 | 2026-10-29 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevat | |
CVE-2026-56073 |
critical | 9.3 | 0.0023 | 2026-10-29 | Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification | |
CVE-2026-56081 |
critical | 9.3 | 0.0043 | 2026-10-29 | Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker registe | |
CVE-2026-9265 |
critical | 9.1 | 0.0063 | 2026-10-29 | Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attr | |
CVE-2026-48908 |
critical | 10.0 | 0.8851 | 2026-10-29 | KEV | JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vul |
CVE-2026-48909 |
critical | 9.5 | 0.0494 | 2026-10-29 | SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without | |
CVE-2026-48939 |
critical | 10.0 | 0.2007 | 2026-10-29 | KEV | iCagenda contains an unrestricted upload of file with dangerous type vulnerability that al |
CVE-2024-58351 |
critical | 9.3 | 0.0093 | 2026-10-29 | Flowise before 2.1.4 allows configuration to be injected into the Chainflow during executi | |
CVE-2026-5366 |
critical | 9.9 | 0.0103 | 2026-10-29 | Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of | |
CVE-2026-11746 |
critical | 9.4 | 0.0023 | 2026-10-29 | A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where | |
CVE-2026-11373 |
critical | 9.1 | 0.0057 | 2026-10-29 | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Stats | |
CVE-2026-10561 |
critical | 10.0 | 0.0082 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of | |
CVE-2026-7165 |
critical | 9.4 | 0.0048 | 2026-10-29 | The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'key | |
CVE-2026-7166 |
critical | 9.2 | 0.0054 | 2026-10-29 | Vulnerability involving the exposure of sensitive data provided without adequate protectio | |
CVE-2026-7664 |
critical | 9.8 | 0.0050 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access prote |