Browse All CVEs
3,393 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-5166 |
critical | 9.6 | 0.0033 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-26015 |
critical | 10.0 | 0.0117 | 2026-10-29 | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.1 | |
CVE-2026-7381 |
critical | 9.1 | 0.0044 | 2026-10-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled | |
CVE-2026-22070 |
critical | 9.8 | 0.0021 | 2026-10-29 | ColorOS Assistant has an unauthenticated start-download channel, leading to file path trav | |
CVE-2026-42799 |
critical | 9.8 | 0.0028 | 2026-10-29 | Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. | |
CVE-2026-4670 |
critical | 9.8 | 0.0504 | 2026-10-29 | Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automa | |
CVE-2026-33845 |
critical | 9.1 | 0.0207 | 2026-10-29 | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and no | |
CVE-2026-2311 |
critical | 9.8 | 0.0020 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invali | |
CVE-2026-42996 |
critical | 10.0 | 0.0057 | 2026-10-29 | JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow v | |
CVE-2026-42778 |
critical | 9.8 | 0.0066 | 2026-10-29 | The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the o | |
CVE-2026-42779 |
critical | 9.8 | 0.0123 | 2026-10-29 | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the o | |
CVE-2026-42368 |
critical | 9.9 | 0.0036 | 2026-10-29 | A privilege escalation vulnerability exists in the Web Interface functionality of GeoVisio | |
CVE-2026-42369 |
critical | 10.0 | 0.0054 | 2026-10-29 | GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance ca | |
CVE-2026-42370 |
critical | 9.8 | 0.0055 | 2026-10-29 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVisio | |
CVE-2026-7161 |
critical | 9.3 | 0.0022 | 2026-10-29 | An insufficient encryption vulnerability exists in the Device Authentication functionality | |
CVE-2026-7372 |
critical | 9.0 | 0.0047 | 2026-10-29 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVisio | |
CVE-2026-29200 |
critical | 9.9 | 0.0030 | 2026-10-29 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions f | |
CVE-2026-25293 |
critical | 9.8 | 0.0018 | 2026-10-29 | Buffer overflow due to incorrect authorization in PLC FW | |
CVE-2026-26332 |
critical | 10.0 | 0.0071 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError all | |
CVE-2026-42076 |
critical | 9.8 | 0.0170 | 2026-10-29 | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a co | |
CVE-2026-42090 |
critical | 9.6 | 0.0048 | 2026-10-29 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook W | |
CVE-2026-42376 |
critical | 9.8 | 0.0046 | 2026-10-29 | D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdo | |
CVE-2026-42809 |
critical | 9.4 | 0.0036 | 2026-10-29 | Apache Polaris can issue broad temporary ("vended") storage credentials during staged tabl | |
CVE-2026-42810 |
critical | 9.4 | 0.0043 | 2026-10-29 | Apache Polaris accepts literal `*` characters in namespace and table names. When it later | |
CVE-2026-42811 |
critical | 9.4 | 0.0043 | 2026-10-29 | In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only | |
CVE-2026-42812 |
critical | 9.4 | 0.0037 | 2026-10-29 | In Apache Iceberg, the table's metadata files are control files: they tell readers which d | |
CVE-2026-41571 |
critical | 9.4 | 0.0037 | 2026-10-29 | Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in | |
CVE-2026-42087 |
critical | 9.6 | 0.0032 | 2026-10-29 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from | |
CVE-2026-41922 |
critical | 9.3 | 0.0498 | 2026-10-29 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-41923 |
critical | 9.3 | 0.0309 | 2026-10-29 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-41924 |
critical | 9.3 | 0.0320 | 2026-10-29 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-41925 |
critical | 9.3 | 0.0400 | 2026-10-29 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-41926 |
critical | 9.3 | 0.0123 | 2026-10-29 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-42221 |
critical | 9.8 | 0.0134 | 2026-10-29 | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before ve | |
CVE-2026-42222 |
critical | 9.8 | 0.0034 | 2026-10-29 | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenti | |
CVE-2026-42238 |
critical | 9.0 | 0.0097 | 2026-10-29 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-u | |
CVE-2026-40797 |
critical | 9.3 | 0.0035 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2023-54342 |
critical | 9.3 | 0.0046 | 2026-10-29 | Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerabili | |
CVE-2023-54344 |
critical | 9.3 | 0.0055 | 2026-10-29 | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that | |
CVE-2026-34000 |
critical | 9.1 | 0.0049 | 2026-10-29 | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB g | |
CVE-2026-34002 |
critical | 9.1 | 0.0049 | 2026-10-29 | A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects | |
CVE-2026-7411 |
critical | 10.0 | 0.0368 | 2026-10-29 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path nor | |
CVE-2026-40010 |
critical | 9.1 | 0.0038 | 2026-10-29 | Missing invocation of Servlet http web request method changeSessionId after session bindin | |
CVE-2026-7875 |
critical | 9.3 | 0.0015 | 2026-10-29 | NanoClaw version 1.2.0 and prior contains a host/container filesystem boundary vulnerabili | |
CVE-2026-0300 |
critical | 9.3 | 0.4171 | 2026-10-29 | KEV | Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Aut |
CVE-2026-41930 |
critical | 9.2 | 0.0035 | 2026-10-29 | Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker | |
CVE-2026-7908 |
critical | 9.6 | 0.0022 | 2026-10-29 | Use after free in Fullscreen in Google Chrome prior to 148.0.7778.96 allowed a remote atta | |
CVE-2026-7910 |
critical | 9.6 | 0.0022 | 2026-10-29 | Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker | |
CVE-2026-40076 |
critical | 9.4 | 0.0085 | 2026-10-29 | OpenMRS Core is an open source electronic medical record system platform. In versions 2.7. | |
CVE-2026-44597 |
critical | 9.1 | 0.0045 | 2026-10-29 | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell |