Browse All CVEs
33,146 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-46721 |
medium | 6.9 | 0.0036 | 2026-10-29 | The create and edit flows do not restrict which user properties may be submitted and do no | |
CVE-2026-46722 |
medium | 5.9 | 0.0030 | 2026-10-29 | The OOXML parsing of the file indexer does not disable external entity resolution. A craft | |
CVE-2026-46723 |
medium | 5.9 | 0.0032 | 2026-10-29 | The additional_tables configuration of the page and tt_content indexers accepts arbitrary | |
CVE-2026-46724 |
medium | 5.9 | 0.0040 | 2026-10-29 | The file indexer does not normalize the configured directory path. A backend user with per | |
CVE-2026-46725 |
critical | 9.2 | 0.0262 | 2026-10-29 | The extension passes an attacker-controlled cookie directly to PHP's unserialize() without | |
CVE-2026-8726 |
high | 8.2 | 0.0044 | 2026-10-29 | The extension fails to properly sanitize user input before using it in a database query. A | |
CVE-2026-8727 |
high | 7.1 | 0.0039 | 2026-10-29 | The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs direct | |
CVE-2026-8827 |
high | 8.2 | 0.0033 | 2026-10-29 | The AddressRepository::getSqlQuery() method constructs a database query without properly s | |
CVE-2026-37978 |
medium | 4.9 | 0.0043 | 2026-10-29 | A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role c | |
CVE-2026-37979 |
medium | 6.5 | 0.0037 | 2026-10-29 | A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Conne | |
CVE-2026-37981 |
medium | 4.3 | 0.0037 | 2026-10-29 | A flaw was found in Keycloak. A broken access control vulnerability in the Account Resourc | |
CVE-2026-37982 |
medium | 6.8 | 0.0044 | 2026-10-29 | A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker t | |
CVE-2026-45442 |
medium | 4.3 | 0.0024 | 2026-10-29 | Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting In | |
CVE-2026-4630 |
medium | 6.8 | 0.0030 | 2026-10-29 | A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Obj | |
CVE-2026-7307 |
— | — | 0.0088 | 2026-10-29 | A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially craf | |
CVE-2026-7504 |
— | — | 0.0050 | 2026-10-29 | A flaw was found in Keycloak's URL validation logic during redirect operations. By craftin | |
CVE-2026-7507 |
— | — | 0.0084 | 2026-10-29 | A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unaut | |
CVE-2026-7571 |
high | 7.1 | 0.0042 | 2026-10-29 | A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and | |
CVE-2026-7860 |
low | 1.6 | 0.0012 | 2026-10-29 | A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaad | |
CVE-2026-42096 |
high | 8.7 | 0.0060 | 2026-10-29 | Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with th | |
CVE-2026-42097 |
critical | 9.3 | 0.0094 | 2026-10-29 | Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omi | |
CVE-2026-42098 |
high | 8.7 | 0.0040 | 2026-10-29 | Sparx Enterprise Architect software has a security feature that limits user's actions to t | |
CVE-2026-42099 |
high | 7.7 | 0.0072 | 2026-10-29 | Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_arti | |
CVE-2026-42100 |
high | 7.1 | 0.0068 | 2026-10-29 | Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Deni | |
CVE-2026-47323 |
— | — | 0.1956 | 2026-10-29 | Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CX | |
CVE-2026-48225 |
medium | 5.1 | 0.0021 | 2026-10-29 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-48230 |
medium | 5.1 | 0.0021 | 2026-10-29 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in | |
CVE-2026-48236 |
high | 7.1 | 0.0021 | 2026-10-29 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php wh | |
CVE-2026-48242 |
critical | 9.2 | 0.0030 | 2026-10-29 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials ( | |
CVE-2026-48244 |
medium | 6.9 | 0.0022 | 2026-10-29 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php | |
CVE-2026-48245 |
medium | 6.9 | 0.0022 | 2026-10-29 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that | |
CVE-2026-48246 |
high | 8.2 | 0.0017 | 2026-10-29 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php | |
CVE-2026-46300 |
high | 7.8 | 0.1613 | 2026-10-29 | KEV 16 PoC | Linux Kernel contains a missing initialization of a variable vulnerability that could allo |
CVE-2026-5260 |
high | 8.2 | 0.0077 | 2026-10-29 | A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster | |
CVE-2026-40810 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40811 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40812 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40813 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40814 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40815 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40816 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40817 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40818 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40819 |
high | 8.7 | 0.0032 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-40821 |
medium | 6.9 | 0.0028 | 2026-10-29 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerabili | |
CVE-2026-40822 |
medium | 6.9 | 0.0028 | 2026-10-29 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerabili | |
CVE-2026-40823 |
high | 7.0 | 0.0024 | 2026-10-29 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerabili | |
CVE-2026-40824 |
high | 7.0 | 0.0024 | 2026-10-29 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerabili | |
CVE-2026-40825 |
high | 7.0 | 0.0024 | 2026-10-29 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerabili | |
CVE-2026-40826 |
medium | 6.9 | 0.0028 | 2026-10-29 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerabili |