Browse All CVEs
3,395 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42757 |
critical | 9.9 | 0.0036 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-42758 |
critical | 9.8 | 0.0032 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition w | |
CVE-2026-42761 |
critical | 9.3 | 0.0023 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-35087 |
critical | 9.3 | 0.0066 | 2026-10-29 | Slican telephone exchanges allow administrative protocol authentication bypass. An attacke | |
CVE-2026-35090 |
critical | 9.3 | 0.0063 | 2026-10-29 | In Slican telephone exchanges it is possible to manage the control panel remotely. An unau | |
CVE-2026-7524 |
critical | 9.8 | 0.0079 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper val | |
CVE-2026-45087 |
critical | 10.0 | 0.0873 | 2026-10-29 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2 | |
CVE-2026-44590 |
critical | 9.3 | 0.0114 | 2026-10-29 | Sherlock hunts down social media accounts by username across social networks. Prior to 0.1 | |
CVE-2026-44887 |
critical | 9.8 | 0.0054 | 2026-10-29 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-0 | |
CVE-2026-44888 |
critical | 9.8 | 0.0039 | 2026-10-29 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-0 | |
CVE-2026-8362 |
critical | 9.8 | 0.0039 | 2026-10-29 | A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing | |
CVE-2026-8363 |
critical | 9.8 | 0.0040 | 2026-10-29 | A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing | |
CVE-2026-8364 |
critical | 9.8 | 0.0038 | 2026-10-29 | Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on | |
CVE-2026-45083 |
critical | 9.8 | 0.0041 | 2026-10-29 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-9739 |
critical | 9.4 | 0.0028 | 2026-10-29 | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta p | |
CVE-2026-32998 |
critical | 9.4 | 0.0052 | 2026-10-29 | This vulnerability in Veeam Service Provider Console allows for remote code execution. | |
CVE-2026-32999 |
critical | 9.0 | 0.0031 | 2026-10-29 | Insufficient character filtering in backup agent signing module on Comet Backup server all | |
CVE-2026-4408 |
critical | 9.8 | 0.0250 | 2026-10-29 | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file | |
CVE-2026-8979 |
critical | 9.3 | 0.0078 | 2026-10-29 | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication | |
CVE-2026-8980 |
critical | 9.3 | 0.0052 | 2026-10-29 | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalat | |
CVE-2026-24444 |
critical | 9.3 | 0.0053 | 2026-10-29 | SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a har | |
CVE-2026-45261 |
critical | 9.3 | 0.0052 | 2026-10-29 | GitButler is a modern Git-based version control interface for AI-powered workflows. Prior | |
CVE-2026-45311 |
critical | 9.6 | 0.0057 | 2026-10-29 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tes | |
CVE-2026-45323 |
critical | 9.6 | 0.0032 | 2026-10-29 | MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore | |
CVE-2026-45374 |
critical | 9.6 | 0.0039 | 2026-10-29 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create | |
CVE-2026-9037 |
critical | 9.3 | 0.0025 | 2026-10-29 | A firmware update mechanism in the affected charging controller fails to validate the auth | |
CVE-2026-10879 |
critical | 9.8 | 0.0049 | 2026-10-29 | DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements wit | |
CVE-2026-11362 |
critical | 9.8 | 0.0045 | 2026-10-29 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. | |
CVE-2026-9270 |
critical | 9.1 | 0.0033 | 2026-10-29 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogSt | |
CVE-2026-45744 |
critical | 9.9 | 0.0201 | 2026-10-29 | Termix is a web-based server management platform with SSH terminal, tunneling, and file ed | |
CVE-2026-45746 |
critical | 9.0 | 0.0039 | 2026-10-29 | Termix is a web-based server management platform with SSH terminal, tunneling, and file ed | |
CVE-2026-45748 |
critical | 9.8 | 0.0173 | 2026-10-29 | Termix is a web-based server management platform with SSH terminal, tunneling, and file ed | |
CVE-2026-45750 |
critical | 9.0 | 0.0029 | 2026-10-29 | Termix is a web-based server management platform with SSH terminal, tunneling, and file ed | |
CVE-2026-46389 |
critical | 9.8 | 0.0034 | 2026-10-29 | UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, trusts | |
CVE-2026-46395 |
critical | 9.3 | 0.0029 | 2026-10-29 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0 | |
CVE-2026-11414 |
critical | 10.0 | 0.0048 | 2026-10-29 | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download U | |
CVE-2026-50638 |
critical | 9.1 | 0.0034 | 2026-10-29 | Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against me | |
CVE-2026-4764 |
critical | 9.4 | 0.0021 | 2026-10-29 | A Missing Authorization vulnerability in the playbook import functionality in Dialogflow C | |
CVE-2026-11561 |
critical | 9.8 | 0.0045 | 2026-10-29 | Improper neutralization of special elements used in an expression language statement ('exp | |
CVE-2026-7852 |
critical | 9.8 | 0.0036 | 2026-10-29 | Unrestricted upload of file with dangerous type vulnerability in Limatek System Inc. LimRA | |
CVE-2026-11839 |
critical | 9.9 | 0.0034 | 2026-10-29 | Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Tec | |
CVE-2026-9648 |
critical | 9.1 | 0.0022 | 2026-10-29 | The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowi | |
CVE-2026-49261 |
critical | 9.8 | 0.0158 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6 | |
CVE-2026-45177 |
critical | 9.1 | 0.0050 | 2026-10-29 | Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control with | |
CVE-2026-47172 |
critical | 9.5 | 0.0041 | 2026-10-29 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. | |
CVE-2026-47174 |
critical | 9.5 | 0.0039 | 2026-10-29 | In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after th | |
CVE-2026-49973 |
critical | 9.2 | 0.0054 | 2026-10-29 | Hermes WebUI before version 0.51.358 contains an improper access control vulnerability tha | |
CVE-2026-12027 |
critical | 9.6 | 0.0022 | 2026-10-29 | Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed | |
CVE-2026-39494 |
critical | 9.3 | 0.0039 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-42647 |
critical | 9.3 | 0.0132 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne |