Browse All CVEs
3,400 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42869 |
critical | 10.0 | 0.0056 | 2026-10-29 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security oper | |
CVE-2026-42882 |
critical | 9.4 | 0.0055 | 2026-10-29 | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an | |
CVE-2026-43899 |
critical | 9.6 | 0.0040 | 2026-10-29 | DeepChat is an open-source artificial intelligence agent platform that unifies models, too | |
CVE-2026-43900 |
critical | 9.3 | 0.0037 | 2026-10-29 | DeepChat is an open-source artificial intelligence agent platform that unifies models, too | |
CVE-2026-43914 |
critical | 9.8 | 0.0029 | 2026-10-29 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a | |
CVE-2026-45321 |
critical | 9.6 | 0.0328 | 2026-10-29 | KEV | TanStack contains an unspecified vulnerability that allowed malicious versions of the prod |
CVE-2026-34260 |
critical | 9.6 | 0.0047 | 2026-10-29 | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that a | |
CVE-2026-34263 |
critical | 9.6 | 0.0061 | 2026-10-29 | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticate | |
CVE-2026-41872 |
critical | 9.1 | 0.0016 | 2026-10-29 | "Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate vali | |
CVE-2026-41551 |
critical | 9.3 | 0.0049 | 2026-10-29 | A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions con | |
CVE-2026-7428 |
critical | 9.2 | 0.0024 | 2026-10-29 | Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB | |
CVE-2026-8072 |
critical | 9.2 | 0.0015 | 2026-10-29 | Insecure generation of credentials in the local SAT (Technical Support) access functionali | |
CVE-2026-27851 |
critical | 9.1 | 0.0041 | 2026-10-29 | When safe filter is used with variable expansion, all following pipelines on the same stri | |
CVE-2026-45091 |
critical | 9.1 | 0.0033 | 2026-10-29 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spr | |
CVE-2026-8043 |
critical | 9.6 | 0.0087 | 2026-10-29 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote | |
CVE-2026-41293 |
critical | 9.8 | 0.0170 | 2026-10-29 | Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomca | |
CVE-2026-43512 |
critical | 9.8 | 0.0133 | 2026-10-29 | DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache | |
CVE-2026-43515 |
critical | 9.1 | 0.0122 | 2026-10-29 | Improper Authorization vulnerability when multiple method constraints define an HTTP metho | |
CVE-2025-65719 |
critical | 9.8 | 0.0058 | 2026-10-29 | An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary co | |
CVE-2026-43992 |
critical | 9.8 | 0.0022 | 2026-10-29 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every | |
CVE-2026-26083 |
critical | 9.8 | 0.0073 | 2026-10-29 | A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiS | |
CVE-2026-29204 |
critical | 9.1 | 0.0032 | 2026-10-29 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user | |
CVE-2026-33117 |
critical | 9.1 | 0.0048 | 2026-10-29 | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local c | |
CVE-2026-33821 |
critical | 9.9 | 0.0066 | 2026-10-29 | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an author | |
CVE-2026-41089 |
critical | 9.8 | 0.7962 | 2026-10-29 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute | |
CVE-2026-41103 |
critical | 9.1 | 0.0538 | 2026-10-29 | Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & | |
CVE-2026-42300 |
critical | 9.3 | 0.0026 | 2026-10-29 | DevGuard provides vulnerability management for the full software supply chain. Prior to 1. | |
CVE-2026-42823 |
critical | 9.9 | 0.0060 | 2026-10-29 | Improper access control in Azure Logic Apps allows an authorized attacker to elevate privi | |
CVE-2026-42833 |
critical | 9.1 | 0.0075 | 2026-10-29 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-pr | |
CVE-2026-42898 |
critical | 9.9 | 0.0119 | 2026-10-29 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-pr | |
CVE-2026-44196 |
critical | 9.1 | 0.0030 | 2026-10-29 | Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.1 | |
CVE-2026-44277 |
critical | 9.8 | 0.0055 | 2026-10-29 | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthent | |
CVE-2026-34659 |
critical | 9.6 | 0.0063 | 2026-10-29 | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization | |
CVE-2026-34660 |
critical | 9.3 | 0.0044 | 2026-10-29 | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Auth | |
CVE-2026-8431 |
critical | 9.4 | 0.0037 | 2026-10-29 | An administrative user with access to configure webhooks can execute arbitrary commands by | |
CVE-2026-42889 |
critical | 9.1 | 0.0037 | 2026-10-29 | Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 | |
CVE-2026-44221 |
critical | 9.0 | 0.0034 | 2026-10-29 | ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, a | |
CVE-2026-44225 |
critical | 9.3 | 0.0154 | 2026-10-29 | Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to | |
CVE-2026-42196 |
critical | 9.9 | 0.0056 | 2026-10-29 | django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, | |
CVE-2026-42854 |
critical | 9.8 | 0.0057 | 2026-10-29 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and | |
CVE-2026-44015 |
critical | 9.9 | 0.0032 | 2026-10-29 | Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authen | |
CVE-2026-44257 |
critical | 9.3 | 0.0039 | 2026-10-29 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip w | |
CVE-2026-44258 |
critical | 9.3 | 0.0036 | 2026-10-29 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_checkRisk funct | |
CVE-2026-44262 |
critical | 9.4 | 0.0586 | 2026-10-29 | Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, w | |
CVE-2026-42288 |
critical | 10.0 | 0.0072 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026 | |
CVE-2026-44547 |
critical | 9.6 | 0.0026 | 2026-10-29 | ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE | |
CVE-2026-32661 |
critical | 9.3 | 0.0047 | 2026-10-29 | Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWAL | |
CVE-2026-41050 |
critical | 9.9 | 0.0039 | 2026-10-29 | Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, | |
CVE-2026-40621 |
critical | 9.3 | 0.0049 | 2026-10-29 | ELECOM wireless LAN access point devices do not require authentication to access some spec | |
CVE-2026-42062 |
critical | 9.3 | 0.0163 | 2026-10-29 | ELECOM wireless LAN access point devices contain an OS command injection in processing of |