Browse All CVEs
3,395 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-49060 |
critical | 9.8 | 0.0184 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows P | |
CVE-2026-42846 |
critical | 9.8 | 0.0073 | 2026-10-29 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, Cli | |
CVE-2026-45060 |
critical | 9.8 | 0.0044 | 2026-10-29 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the | |
CVE-2026-47365 |
critical | 9.9 | 0.0041 | 2026-10-29 | Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WH | |
CVE-2026-47367 |
critical | 9.9 | 0.0083 | 2026-10-29 | A malicious actor with access to the network and low privileges could exploit an Improper | |
CVE-2026-11535 |
critical | 9.4 | 0.0015 | 2026-10-29 | An unauthorized access vulnerability exists in the PcSuite APP. The vulnerability can be e | |
CVE-2026-49875 |
critical | 9.8 | 0.0052 | 2026-10-29 | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParse | |
CVE-2026-50627 |
critical | 9.1 | 0.0452 | 2026-10-29 | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) cla | |
CVE-2026-50628 |
critical | 9.8 | 0.0071 | 2026-10-29 | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound | |
CVE-2026-11849 |
critical | 9.3 | 0.0035 | 2026-10-29 | The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentia | |
CVE-2026-47131 |
critical | 10.0 | 0.0076 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer | |
CVE-2026-47137 |
critical | 10.0 | 0.0038 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8h | |
CVE-2026-47140 |
critical | 10.0 | 0.0098 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks sever | |
CVE-2026-47208 |
critical | 10.0 | 0.0104 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a | |
CVE-2026-47210 |
critical | 9.8 | 0.0172 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vu | |
CVE-2026-53787 |
critical | 9.3 | 0.0564 | 2026-10-29 | Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arb | |
CVE-2026-54133 |
critical | 9.8 | 0.0044 | 2026-10-29 | jmespath.php allows users to use JMESPath, software for declaratively specifying how to ex | |
CVE-2026-6853 |
critical | 9.8 | 0.0035 | 2026-10-29 | Improper restriction of excessive authentication attempts vulnerability in Başbelen Group | |
CVE-2026-45833 |
critical | 9.4 | 0.0034 | 2026-10-29 | A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project a | |
CVE-2026-50083 |
critical | 9.8 | 0.0036 | 2026-10-29 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, | |
CVE-2026-50085 |
critical | 9.8 | 0.0041 | 2026-10-29 | The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and f | |
CVE-2026-50086 |
critical | 9.8 | 0.0029 | 2026-10-29 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups aga | |
CVE-2026-53407 |
critical | 9.8 | 0.0023 | 2026-10-29 | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7 | |
CVE-2026-1555 |
critical | 9.8 | 0.0098 | 2026-10-29 | The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing fi | |
CVE-2026-33807 |
critical | 9.1 | 0.0043 | 2026-10-29 | @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister functio | |
CVE-2026-33808 |
critical | 9.1 | 0.0048 | 2026-10-29 | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to E | |
CVE-2026-33805 |
critical | 9.0 | 0.0044 | 2026-10-29 | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier proces | |
CVE-2026-5387 |
critical | 9.3 | 0.0039 | 2026-10-29 | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform opera | |
CVE-2026-20147 |
critical | 9.9 | 0.1038 | 2026-10-29 | A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attack | |
CVE-2026-20180 |
critical | 9.9 | 0.0602 | 2026-10-29 | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remo | |
CVE-2026-20184 |
critical | 9.8 | 0.0052 | 2026-10-29 | A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex | |
CVE-2026-20186 |
critical | 9.9 | 0.0560 | 2026-10-29 | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remo | |
CVE-2026-30993 |
critical | 9.8 | 0.0052 | 2026-10-29 | Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerab | |
CVE-2026-6290 |
critical | 9.1 | 0.0022 | 2026-10-29 | Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which | |
CVE-2026-5189 |
critical | 9.2 | 0.0053 | 2026-10-29 | CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 | |
CVE-2026-6296 |
critical | 9.6 | 0.0056 | 2026-10-29 | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote at | |
CVE-2026-40504 |
critical | 9.3 | 0.0064 | 2026-10-29 | Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity | |
CVE-2026-6348 |
critical | 9.3 | 0.0018 | 2026-10-29 | WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability | |
CVE-2026-6349 |
critical | 9.3 | 0.0203 | 2026-10-29 | The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing una | |
CVE-2026-6350 |
critical | 9.3 | 0.0076 | 2026-10-29 | MailGates/MailAudit developed by Openfind has a Stack-based Buffer Overflow vulnerability, | |
CVE-2026-22619 |
critical | 9.9 | 0.0032 | 2026-10-29 | Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its exe | |
CVE-2026-31843 |
critical | 10.0 | 0.0138 | 2026-10-29 | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the | |
CVE-2026-5426 |
critical | 9.1 | 0.0101 | 2026-10-29 | Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments | |
CVE-2026-6443 |
critical | 9.8 | 0.0050 | 2026-10-29 | All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in var | |
CVE-2026-41153 |
critical | 9.8 | 0.0026 | 2026-10-29 | In JetBrains Junie before 252.549.29 command execution was possible via malicious project | |
CVE-2026-6284 |
critical | 9.3 | 0.0045 | 2026-10-29 | An attacker with network access to the PLC is able to brute force discover passwords to ga | |
CVE-2026-40525 |
critical | 9.1 | 0.0057 | 2026-10-29 | OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the V | |
CVE-2026-32105 |
critical | 9.3 | 0.0017 | 2026-10-29 | xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement ver | |
CVE-2026-35546 |
critical | 9.8 | 0.0059 | 2026-10-29 | Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes cra | |
CVE-2026-40342 |
critical | 9.9 | 0.0069 | 2026-10-29 | Firebird is an open-source relational database management system. In versions prior to 5.0 |