Browse All CVEs
3,394 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-118332 |
critical | 9.6 | 0.0027 | 2026-10-29 | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a | |
CVE-2026-118340 |
critical | 9.6 | 0.0033 | 2026-10-29 | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacke | |
CVE-2026-118342 |
critical | 9.6 | 0.0027 | 2026-10-29 | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote at | |
CVE-2026-118355 |
critical | 9.6 | 0.0027 | 2026-10-29 | Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a rem | |
CVE-2026-58256 |
critical | 9.1 | 0.0057 | 2026-10-29 | GRR is a resource management and reservation application. Prior to the advisory-reported f | |
CVE-2026-110879 |
critical | 9.8 | 0.0120 | 2026-10-29 | jackson-databind validates the outer class of a class-name type ID but accepts attacker-se | |
CVE-2026-106013 |
critical | 9.8 | 0.0055 | 2026-10-29 | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twi | |
CVE-2026-118375 |
critical | 9.2 | 0.0037 | 2026-10-29 | llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rp | |
CVE-2026-84999 |
critical | 9.8 | 0.0048 | 2026-10-29 | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Uplo | |
CVE-2026-104383 |
critical | 9.4 | 0.0037 | 2026-10-29 | Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions | |
CVE-2026-103688 |
critical | 9.8 | 0.0061 | 2026-10-29 | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate | |
CVE-2026-109218 |
critical | 9.8 | 0.0064 | 2026-10-29 | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all ver | |
CVE-2026-86397 |
critical | 9.8 | 0.0034 | 2026-10-29 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 relea | |
CVE-2026-86400 |
critical | 9.8 | 0.0090 | 2026-10-29 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 relea | |
CVE-2026-90717 |
critical | 9.1 | 0.0023 | 2026-10-29 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-14571 |
critical | 9.1 | 0.0025 | 2026-10-29 | A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a | |
CVE-2026-86384 |
critical | 9.8 | 0.0047 | 2026-10-29 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 relea | |
CVE-2026-103780 |
critical | 9.8 | 0.0083 | 2026-10-29 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 relea | |
CVE-2026-103792 |
critical | 9.6 | 0.0037 | 2026-10-29 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-103799 |
critical | 9.6 | 0.0034 | 2026-10-29 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-112197 |
critical | 9.4 | 0.0038 | 2026-10-29 | Vulnerability due to a lack of authentication in critical functions of the NoviGest Deskto | |
CVE-2026-114278 |
critical | 9.8 | 0.0090 | 2026-10-29 | The che-machine-exec service constructs a shell command by concatenating user-controlled i | |
CVE-2026-111411 |
critical | 9.3 | 0.0034 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-115607 |
critical | 9.3 | 0.0024 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-115904 |
critical | 9.6 | 0.0074 | 2026-10-29 | Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Lin | |
CVE-2026-67074 |
critical | 9.1 | 0.0046 | 2026-10-29 | HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attacke | |
CVE-2026-105420 |
critical | 9.4 | 0.0052 | 2026-10-29 | Wing FTP Server does not verify user's base folder. An attacker with admin privileges can | |
CVE-2026-115968 |
critical | 9.8 | 0.0041 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimat | |
CVE-2026-44179 |
critical | 9.9 | 0.0069 | 2026-10-29 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content | |
CVE-2026-103406 |
critical | 9.8 | 0.0052 | 2026-10-29 | An Improper Neutralization of Special Elements used in an OS Command vulnerability in the | |
CVE-2026-103409 |
critical | 9.8 | 0.0035 | 2026-10-29 | A Missing authentication for critical function vulnerability in Juniper Networks Session S | |
CVE-2026-118264 |
critical | 9.1 | 0.0043 | 2026-10-29 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware sel | |
CVE-2026-118633 |
critical | 9.2 | 0.0060 | 2026-10-29 | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitra | |
CVE-2026-117574 |
critical | 9.1 | 0.0024 | 2026-10-29 | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can ex | |
CVE-2026-63190 |
critical | 9.4 | 0.0054 | 2026-10-29 | FearlessCMS is a flat-file `content` management system centered on simplicity and open sou | |
CVE-2026-118690 |
critical | 9.3 | 0.0069 | 2026-10-29 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows | |
CVE-2026-61564 |
critical | 10.0 | 0.0054 | 2026-10-29 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint | |
CVE-2026-61567 |
critical | 10.0 | 0.0053 | 2026-10-29 | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/vide | |
CVE-2026-55040 |
critical | 9.1 | 0.6954 | 2026-10-29 | KEV 5 PoC | Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthor |
CVE-2026-50522 |
critical | 9.8 | 0.0304 | 2026-10-29 | KEV 5 PoC | Microsoft SharePoint contains a deserialization of untrusted data vulnerability which coul |
CVE-2026-58644 |
critical | 9.8 | 0.1587 | 2026-10-29 | KEV | Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allow |
CVE-2026-114611 |
critical | 9.1 | 0.0032 | 2026-10-29 | OCO-Server is a self-hosted endpoint management application for computer inventory, softwa | |
CVE-2022-51026 |
critical | 9.3 | 0.0061 | 2026-10-29 | Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows u | |
CVE-2025-65200 |
critical | 9.6 | 0.0055 | 2026-10-29 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code v | |
CVE-2026-114612 |
critical | 9.9 | 0.0032 | 2026-10-29 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From | |
CVE-2026-115353 |
critical | 9.2 | 0.0039 | 2026-10-29 | Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive | |
CVE-2026-115372 |
critical | 9.0 | 0.0036 | 2026-10-29 | Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted | |
CVE-2026-115375 |
critical | 9.4 | 0.0040 | 2026-10-29 | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability th | |
CVE-2026-115377 |
critical | 9.4 | 0.0040 | 2026-10-29 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file | |
CVE-2026-115384 |
critical | 9.4 | 0.0031 | 2026-10-29 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vu |