Browse All CVEs
3,373 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2021-25827 |
critical | 9.8 | 0.0150 | 2026-10-29 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-F | |
CVE-2023-34844 |
critical | 9.8 | 0.0095 | 2026-10-29 | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker | |
CVE-2023-29131 |
critical | 10.0 | 0.0042 | 2026-10-29 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected dev | |
CVE-2024-21762 |
critical | 9.8 | 0.8459 | 2026-10-29 | KEV | Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthe |
CVE-2024-26011 |
critical | 9.8 | 0.0060 | 2026-10-29 | A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4. | |
CVE-2024-48884 |
critical | 9.1 | 0.1521 | 2026-10-29 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerabi | |
CVE-2025-49710 |
critical | 9.8 | 0.0074 | 2026-10-29 | An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This | |
CVE-2025-6424 |
critical | 9.8 | 0.0796 | 2026-10-29 | A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerab | |
CVE-2025-34522 |
critical | 9.2 | 0.0056 | 2026-10-29 | A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve U | |
CVE-2025-6519 |
critical | 9.3 | 0.0054 | 2026-10-29 | E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a d | |
CVE-2025-58628 |
critical | 9.3 | 0.0031 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2025-40795 |
critical | 9.3 | 0.0072 | 2026-10-29 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS ne | |
CVE-2025-40765 |
critical | 9.3 | 0.0053 | 2026-10-29 | A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1 | |
CVE-2025-40771 |
critical | 9.3 | 0.0053 | 2026-10-29 | A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versi | |
CVE-2025-11708 |
critical | 9.8 | 0.0051 | 2026-10-29 | Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Fire | |
CVE-2025-11709 |
critical | 9.8 | 0.0042 | 2026-10-29 | A compromised web process was able to trigger out of bounds reads and writes in a more pri | |
CVE-2025-11710 |
critical | 9.8 | 0.0042 | 2026-10-29 | A compromised web process using malicious IPC messages could have caused the privileged br | |
CVE-2025-49901 |
critical | 9.8 | 0.0073 | 2026-10-29 | Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Sim | |
CVE-2025-58963 |
critical | 10.0 | 0.0049 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity al | |
CVE-2025-62025 |
critical | 9.8 | 0.0058 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issu | |
CVE-2025-60553 |
critical | 9.8 | 0.0041 | 2026-10-29 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime p | |
CVE-2025-60355 |
critical | 9.8 | 0.0053 | 2026-10-29 | zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection | |
CVE-2025-52910 |
critical | 9.8 | 0.0039 | 2026-10-29 | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exyn | |
CVE-2025-63334 |
critical | 9.8 | 0.0118 | 2026-10-29 | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execu | |
CVE-2025-48089 |
critical | 9.3 | 0.0036 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2025-58627 |
critical | 9.8 | 0.0045 | 2026-10-29 | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous | |
CVE-2025-62047 |
critical | 9.9 | 0.0045 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons c | |
CVE-2025-11366 |
critical | 9.4 | 0.0060 | 2026-10-29 | N-central < 2025.4 is vulnerable to authentication bypass via path traversal | |
CVE-2025-11367 |
critical | 10.0 | 0.0063 | 2026-10-29 | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deseriali | |
CVE-2025-65358 |
critical | 9.8 | 0.0041 | 2026-10-29 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerabilit | |
CVE-2025-65656 |
critical | 9.8 | 0.0046 | 2026-10-29 | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/Vers | |
CVE-2025-40938 |
critical | 9.2 | 0.0038 | 2026-10-29 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affect | |
CVE-2024-58307 |
critical | 9.3 | 0.0051 | 2026-10-29 | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view fun | |
CVE-2025-66844 |
critical | 9.1 | 0.0029 | 2026-10-29 | In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig t | |
CVE-2023-53969 |
critical | 9.3 | 0.0051 | 2026-10-29 | Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allow | |
CVE-2025-50526 |
critical | 9.8 | 0.0118 | 2026-10-29 | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via | |
CVE-2025-67108 |
critical | 10.0 | 0.0031 | 2026-10-29 | eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation | |
CVE-2024-57521 |
critical | 10.0 | 0.0068 | 2026-10-29 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execut | |
CVE-2025-29229 |
critical | 9.8 | 0.0127 | 2026-10-29 | linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus. | |
CVE-2025-51511 |
critical | 9.8 | 0.0038 | 2026-10-29 | Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content | |
CVE-2024-44065 |
critical | 9.8 | 0.0038 | 2026-10-29 | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.ph | |
CVE-2024-25181 |
critical | 9.1 | 0.0029 | 2026-10-29 | A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Se | |
CVE-2024-25182 |
critical | 9.8 | 0.0039 | 2026-10-29 | givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. | |
CVE-2024-27480 |
critical | 9.8 | 0.0039 | 2026-10-29 | givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. | |
CVE-2023-54203 |
critical | 9.1 | 0.0055 | 2026-10-29 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-o | |
CVE-2023-54223 |
critical | 9.8 | 0.0045 | 2026-10-29 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix i | |
CVE-2026-0625 |
critical | 9.3 | 0.0097 | 2026-10-29 | Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access c | |
CVE-2026-0650 |
critical | 9.3 | 0.0152 | 2026-10-29 | OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerab | |
CVE-2026-22738 |
critical | 9.8 | 0.0111 | 2026-10-29 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-suppl | |
CVE-2026-1496 |
critical | 9.3 | 0.0055 | 2026-10-29 | Vulnerable versions of Coverity Connect lack an error handler in the authentication logic |