Browse All CVEs
3,394 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40351 |
critical | 9.8 | 0.0063 | 2026-10-29 | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-base | |
CVE-2026-40324 |
critical | 9.1 | 0.0090 | 2026-10-29 | Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1 | |
CVE-2026-40484 |
critical | 9.1 | 0.0087 | 2026-10-29 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the data | |
CVE-2026-40582 |
critical | 9.1 | 0.0050 | 2026-10-29 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api | |
CVE-2026-40317 |
critical | 9.3 | 0.0022 | 2026-10-29 | NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions p | |
CVE-2026-40572 |
critical | 9.0 | 0.0021 | 2026-10-29 | NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions p | |
CVE-2026-40487 |
critical | 9.0 | 0.0022 | 2026-10-29 | Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload valid | |
CVE-2026-40492 |
critical | 9.8 | 0.0041 | 2026-10-29 | SAIL is a cross-platform library for loading and saving images with support for animation, | |
CVE-2026-40493 |
critical | 9.8 | 0.0037 | 2026-10-29 | SAIL is a cross-platform library for loading and saving images with support for animation, | |
CVE-2026-40494 |
critical | 9.8 | 0.0033 | 2026-10-29 | SAIL is a cross-platform library for loading and saving images with support for animation, | |
CVE-2026-32956 |
critical | 9.3 | 0.0052 | 2026-10-29 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer ov | |
CVE-2026-6644 |
critical | 9.4 | 0.0194 | 2026-10-29 | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulner | |
CVE-2026-5963 |
critical | 9.3 | 0.0037 | 2026-10-29 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthentic | |
CVE-2026-5964 |
critical | 9.3 | 0.0037 | 2026-10-29 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthentic | |
CVE-2026-39918 |
critical | 9.2 | 0.0066 | 2026-10-29 | Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoin | |
CVE-2026-32311 |
critical | 9.3 | 0.0051 | 2026-10-29 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investi | |
CVE-2026-6257 |
critical | 9.2 | 0.0063 | 2026-10-29 | Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media manag | |
CVE-2026-5965 |
critical | 9.3 | 0.0164 | 2026-10-29 | NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthe | |
CVE-2026-6760 |
critical | 9.8 | 0.0028 | 2026-10-29 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Fi | |
CVE-2026-6768 |
critical | 9.8 | 0.0029 | 2026-10-29 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Fi | |
CVE-2026-6771 |
critical | 9.8 | 0.0031 | 2026-10-29 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox | |
CVE-2026-21571 |
critical | 9.4 | 0.0135 | 2026-10-29 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0 | |
CVE-2026-40050 |
critical | 9.8 | 0.0060 | 2026-10-29 | CrowdStrike has released security updates to address a critical unauthenticated path trave | |
CVE-2026-5652 |
critical | 9.0 | 0.0044 | 2026-10-29 | An insecure direct object reference vulnerability in the Users API component of Crafty Con | |
CVE-2026-40872 |
critical | 9.3 | 0.0036 | 2026-10-29 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions p | |
CVE-2026-40884 |
critical | 9.8 | 0.0048 | 2026-10-29 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP a | |
CVE-2026-40887 |
critical | 9.1 | 0.0176 | 2026-10-29 | Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior | |
CVE-2026-40903 |
critical | 9.1 | 0.0024 | 2026-10-29 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED | |
CVE-2026-33519 |
critical | 9.8 | 0.0031 | 2026-10-29 | An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 1 | |
CVE-2026-34275 |
critical | 9.8 | 0.0038 | 2026-10-29 | Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite | |
CVE-2026-34279 |
critical | 9.1 | 0.0044 | 2026-10-29 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-34285 |
critical | 9.1 | 0.0041 | 2026-10-29 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware | |
CVE-2026-34286 |
critical | 9.1 | 0.0041 | 2026-10-29 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware | |
CVE-2026-34287 |
critical | 9.1 | 0.0035 | 2026-10-29 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware | |
CVE-2026-40910 |
critical | 9.1 | 0.0027 | 2026-10-29 | frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass | |
CVE-2026-40911 |
critical | 10.0 | 0.0065 | 2026-10-29 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket pl | |
CVE-2026-40933 |
critical | 9.9 | 0.1196 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-41064 |
critical | 9.3 | 0.0034 | 2026-10-29 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an inc | |
CVE-2026-41144 |
critical | 9.8 | 0.0043 | 2026-10-29 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and oth | |
CVE-2026-6023 |
critical | 9.8 | 0.0054 | 2026-10-29 | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter c | |
CVE-2026-33598 |
critical | 9.1 | 0.0107 | 2026-10-29 | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDoma | |
CVE-2026-33608 |
critical | 9.8 | 0.0038 | 2026-10-29 | An attacker can send a notify request that causes a new secondary domain to be added to th | |
CVE-2026-26354 |
critical | 9.8 | 0.0050 | 2026-10-29 | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release vers | |
CVE-2026-34415 |
critical | 9.3 | 0.0357 | 2026-10-29 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vul | |
CVE-2026-41468 |
critical | 9.3 | 0.0039 | 2026-10-29 | Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing kn | |
CVE-2026-33471 |
critical | 9.6 | 0.0022 | 2026-10-29 | nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBloc | |
CVE-2026-41167 |
critical | 9.1 | 0.0064 | 2026-10-29 | Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, | |
CVE-2026-29198 |
critical | 9.8 | 0.0042 | 2026-10-29 | In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a N | |
CVE-2026-5935 |
critical | 9.8 | 0.0034 | 2026-10-29 | IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC cou | |
CVE-2026-41679 |
critical | 10.0 | 0.3167 | 2026-10-29 | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a |