Browse All CVEs
3,393 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-6885 |
critical | 9.3 | 0.0050 | 2026-10-29 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitr | |
CVE-2026-6886 |
critical | 9.3 | 0.0045 | 2026-10-29 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authent | |
CVE-2026-6887 |
critical | 9.3 | 0.0036 | 2026-10-29 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Inj | |
CVE-2026-39440 |
critical | 9.9 | 0.0036 | 2026-10-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC | |
CVE-2025-50229 |
critical | 9.8 | 0.0036 | 2026-10-29 | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. | |
CVE-2026-23751 |
critical | 9.3 | 0.0088 | 2026-10-29 | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be | |
CVE-2026-6919 |
critical | 9.6 | 0.0029 | 2026-10-29 | Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attac | |
CVE-2026-6920 |
critical | 9.6 | 0.0021 | 2026-10-29 | Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a re | |
CVE-2026-6074 |
critical | 9.3 | 0.0055 | 2026-10-29 | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerabili | |
CVE-2026-25874 |
critical | 9.3 | 0.1555 | 2026-10-29 | LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async infere | |
CVE-2026-41137 |
critical | 9.4 | 0.0145 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-41264 |
critical | 9.2 | 0.0179 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-41265 |
critical | 9.2 | 0.0057 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-41267 |
critical | 9.8 | 0.0033 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-41268 |
critical | 9.8 | 0.1744 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-6942 |
critical | 9.3 | 0.0192 | 2026-10-29 | radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that | |
CVE-2026-24303 |
critical | 9.6 | 0.0039 | 2026-10-29 | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacke | |
CVE-2026-26150 |
critical | 10.0 | 0.0057 | 2026-10-29 | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to | |
CVE-2026-26210 |
critical | 9.3 | 0.0070 | 2026-10-29 | KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balanc | |
CVE-2026-33102 |
critical | 9.3 | 0.0040 | 2026-10-29 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized | |
CVE-2026-33819 |
critical | 9.8 | 0.0084 | 2026-10-29 | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to exe | |
CVE-2026-35431 |
critical | 10.0 | 0.0051 | 2026-10-29 | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an | |
CVE-2026-41274 |
critical | 9.3 | 0.0050 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-25775 |
critical | 9.3 | 0.0040 | 2026-10-29 | A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval a | |
CVE-2026-27843 |
critical | 9.2 | 0.0052 | 2026-10-29 | A vulnerability exists in SenseLive X3050's web management interface that allows critical | |
CVE-2026-35503 |
critical | 9.3 | 0.0055 | 2026-10-29 | A vulnerability in SenseLive X3050’s web management interface allows authentication logic | |
CVE-2026-39462 |
critical | 9.3 | 0.0039 | 2026-10-29 | A vulnerability exists in SenseLive X3050’s web management interface in which password upd | |
CVE-2026-40620 |
critical | 9.3 | 0.0055 | 2026-10-29 | A vulnerability in SenseLive X3050’s embedded management service allows full administrativ | |
CVE-2026-40630 |
critical | 9.3 | 0.0073 | 2026-10-29 | A vulnerability in SenseLive X3050’s web management interface allows unauthorized acces | |
CVE-2026-1949 |
critical | 9.8 | 0.0061 | 2026-10-29 | Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the | |
CVE-2026-1950 |
critical | 9.8 | 0.0031 | 2026-10-29 | Delta Electronics AS320T has No checking of the length of the buffer with the file name v | |
CVE-2026-1951 |
critical | 9.8 | 0.0061 | 2026-10-29 | Delta Electronics AS320T has no checking of the length of the buffer with the directory na | |
CVE-2026-21515 |
critical | 9.9 | 0.0070 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an | |
CVE-2026-25660 |
critical | 9.3 | 0.0045 | 2026-10-29 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Sta | |
CVE-2026-39920 |
critical | 9.3 | 0.0054 | 2026-10-29 | BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis | |
CVE-2026-6911 |
critical | 9.3 | 0.0025 | 2026-10-29 | Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to fo | |
CVE-2026-41492 |
critical | 9.8 | 0.0308 | 2026-10-29 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes th | |
CVE-2026-41248 |
critical | 9.1 | 0.0032 | 2026-10-29 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRou | |
CVE-2026-42363 |
critical | 9.3 | 0.0019 | 2026-10-29 | An insufficient encryption vulnerability exists in the Device Authentication functionality | |
CVE-2026-41635 |
critical | 9.8 | 0.0062 | 2026-10-29 | Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for stat | |
CVE-2026-41409 |
critical | 9.8 | 0.0043 | 2026-10-29 | The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The | |
CVE-2026-22337 |
critical | 9.8 | 0.0032 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allow | |
CVE-2026-5779 |
critical | 9.4 | 0.0025 | 2026-10-29 | An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specif | |
CVE-2026-7321 |
critical | 9.6 | 0.0026 | 2026-10-29 | Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. T | |
CVE-2026-41873 |
critical | 9.8 | 0.0044 | 2026-10-29 | ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Reques | |
CVE-2026-24178 |
critical | 9.8 | 0.0057 | 2026-10-29 | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authenticatio | |
CVE-2026-3893 |
critical | 9.4 | 0.0037 | 2026-10-29 | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker | |
CVE-2026-3325 |
critical | 10.0 | 0.0027 | 2026-10-29 | SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of | |
CVE-2026-42523 |
critical | 9.0 | 0.0028 | 2026-10-29 | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part | |
CVE-2026-41940 |
critical | 9.3 | 0.9853 | 2026-10-29 | KEV | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authenticati |