Browse All CVEs
3,396 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44193 |
critical | 9.1 | 0.0069 | 2026-10-29 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC met | |
CVE-2026-44194 |
critical | 9.1 | 0.0567 | 2026-10-29 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticat | |
CVE-2026-44442 |
critical | 9.9 | 0.0028 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, cert | |
CVE-2026-45158 |
critical | 9.1 | 0.0053 | 2026-10-29 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized us | |
CVE-2026-8500 |
critical | 9.8 | 0.0165 | 2026-10-29 | Web::Passwd versions through 0.03 for Perl is vulnerable to RCE. Web::Passwd is a small C | |
CVE-2026-6510 |
critical | 9.8 | 0.0044 | 2026-10-29 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing | |
CVE-2026-6512 |
critical | 9.1 | 0.0026 | 2026-10-29 | The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versi | |
CVE-2026-2347 |
critical | 9.8 | 0.0043 | 2026-10-29 | Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software | |
CVE-2026-44482 |
critical | 9.6 | 0.0034 | 2026-10-29 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and A | |
CVE-2026-42281 |
critical | 9.2 | 0.0162 | 2026-10-29 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthen | |
CVE-2026-20182 |
critical | 10.0 | 0.9182 | 2026-10-29 | KEV | Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability |
CVE-2026-42555 |
critical | 9.1 | 0.0058 | 2026-10-29 | Valtimo is an open-source business process automation platform. com.ritense.valtimo:docume | |
CVE-2026-44542 |
critical | 9.1 | 0.0052 | 2026-10-29 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable | |
CVE-2026-46470 |
critical | 9.1 | 0.0021 | 2026-10-29 | An issue was discovered in GStreamer gst-plugins-good before 1.28.2. When parsing MP4 audi | |
CVE-2026-22599 |
critical | 9.3 | 0.0118 | 2026-10-29 | Strapi is an open source headless content management system. In versions on the 4.x branch | |
CVE-2026-41315 |
critical | 9.3 | 0.0103 | 2026-10-29 | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end | |
CVE-2026-44523 |
critical | 10.0 | 0.0015 | 2026-10-29 | Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or | |
CVE-2026-44592 |
critical | 9.4 | 0.0016 | 2026-10-29 | Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABL | |
CVE-2026-8511 |
critical | 9.6 | 0.0023 | 2026-10-29 | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to | |
CVE-2026-8580 |
critical | 9.6 | 0.0021 | 2026-10-29 | Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker | |
CVE-2026-8634 |
critical | 9.3 | 0.0095 | 2026-10-29 | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allo | |
CVE-2026-44666 |
critical | 9.3 | 0.0038 | 2026-10-29 | HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Pr | |
CVE-2026-0481 |
critical | 9.2 | 0.0031 | 2026-10-29 | Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could | |
CVE-2026-8398 |
critical | 9.3 | 0.0146 | 2026-10-29 | KEV | Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiali |
CVE-2026-41552 |
critical | 9.2 | 0.0050 | 2026-10-29 | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Trav | |
CVE-2026-41553 |
critical | 10.0 | 0.0065 | 2026-10-29 | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Co | |
CVE-2026-7182 |
critical | 9.2 | 0.0040 | 2026-10-29 | Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HT | |
CVE-2026-2031 |
critical | 10.0 | 0.0053 | 2026-10-29 | An Improper Access Control vulnerability in several internal API endpoints for Google Clou | |
CVE-2026-41258 |
critical | 9.1 | 0.0032 | 2026-10-29 | OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before | |
CVE-2026-42155 |
critical | 9.3 | 0.0037 | 2026-10-29 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alt | |
CVE-2026-44699 |
critical | 9.1 | 0.0026 | 2026-10-29 | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that | |
CVE-2026-44717 |
critical | 9.8 | 0.0048 | 2026-10-29 | MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy | |
CVE-2026-45035 |
critical | 9.4 | 0.0038 | 2026-10-29 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, Ta | |
CVE-2026-45010 |
critical | 9.3 | 0.0043 | 2026-10-29 | phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempt | |
CVE-2026-46364 |
critical | 9.3 | 0.0171 | 2026-10-29 | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCa | |
CVE-2026-8507 |
critical | 9.8 | 0.0065 | 2026-10-29 | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws | |
CVE-2026-8721 |
critical | 9.8 | 0.0045 | 2026-10-29 | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NU | |
CVE-2026-4320 |
critical | 9.3 | 0.0025 | 2026-10-29 | Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to | |
CVE-2026-45829 |
critical | 10.0 | 0.1515 | 2026-10-29 | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the Chroma | |
CVE-2023-24215 |
critical | 9.1 | 0.0024 | 2026-10-29 | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 al | |
CVE-2026-46725 |
critical | 9.2 | 0.0262 | 2026-10-29 | The extension passes an attacker-controlled cookie directly to PHP's unserialize() without | |
CVE-2026-42097 |
critical | 9.3 | 0.0094 | 2026-10-29 | Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omi | |
CVE-2026-48242 |
critical | 9.2 | 0.0030 | 2026-10-29 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials ( | |
CVE-2026-49002 |
critical | 9.1 | 0.0029 | 2026-10-29 | Access control failure means that an application does not effectively check user access pe | |
CVE-2026-8054 |
critical | 10.0 | 0.0158 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in th | |
CVE-2026-42727 |
critical | 9.3 | 0.0029 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-42731 |
critical | 9.8 | 0.0033 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification min | |
CVE-2026-42747 |
critical | 9.3 | 0.0024 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-42748 |
critical | 9.9 | 0.0028 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in WPify WPify Woo Czech wpi | |
CVE-2026-42755 |
critical | 9.3 | 0.0024 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne |