Browse All CVEs
3,373 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-28367 |
critical | 9.1 | 0.0072 | 2026-10-29 | A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending | |
CVE-2026-28368 |
critical | 9.1 | 0.0073 | 2026-10-29 | A flaw was found in Undertow. This vulnerability allows a remote attacker to construct spe | |
CVE-2026-28369 |
critical | 9.1 | 0.0069 | 2026-10-29 | A flaw was found in Undertow. When Undertow receives an HTTP request where the first heade | |
CVE-2026-33867 |
critical | 9.1 | 0.0015 | 2026-10-29 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo | |
CVE-2026-34374 |
critical | 9.1 | 0.0036 | 2026-10-29 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `L | |
CVE-2026-34205 |
critical | 9.6 | 0.0027 | 2026-10-29 | Home Assistant is open source home automation software that puts local control and privacy | |
CVE-2026-34475 |
critical | 9.8 | 0.0021 | 2026-10-29 | Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked r | |
CVE-2026-33875 |
critical | 9.3 | 0.0027 | 2026-10-29 | Gematik Authenticator securely authenticates users for login to digital health application | |
CVE-2026-33896 |
critical | 9.1 | 0.0036 | 2026-10-29 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in | |
CVE-2026-33943 |
critical | 9.8 | 0.0065 | 2026-10-29 | Happy DOM is a JavaScript implementation of a web browser without its graphical user inter | |
CVE-2026-33976 |
critical | 9.6 | 0.0072 | 2026-10-29 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Andro | |
CVE-2026-5288 |
critical | 9.6 | 0.0032 | 2026-10-29 | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a re | |
CVE-2026-5289 |
critical | 9.6 | 0.0035 | 2026-10-29 | Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote att | |
CVE-2026-5290 |
critical | 9.6 | 0.0032 | 2026-10-29 | Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote at | |
CVE-2026-4370 |
critical | 10.0 | 0.0039 | 2026-10-29 | A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4. | |
CVE-2026-20093 |
critical | 9.8 | 0.0101 | 2026-10-29 | A vulnerability in the change password functionality of Cisco Integrated Management Contro | |
CVE-2026-20160 |
critical | 9.8 | 0.0093 | 2026-10-29 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unaut | |
CVE-2026-34072 |
critical | 9.8 | 0.0046 | 2026-10-29 | Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live loggin | |
CVE-2026-34159 |
critical | 9.8 | 0.0162 | 2026-10-29 | llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC | |
CVE-2026-34236 |
critical | 9.8 | 0.0022 | 2026-10-29 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to | |
CVE-2026-34751 |
critical | 9.1 | 0.0031 | 2026-10-29 | Payload is a free and open source headless content management system. Prior to version 3.7 | |
CVE-2026-34456 |
critical | 9.8 | 0.0046 | 2026-10-29 | Reviactyl is an open-source game server management panel built using Laravel, React, Filam | |
CVE-2026-4101 |
critical | 9.8 | 0.0037 | 2026-10-29 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Co | |
CVE-2026-34559 |
critical | 9.0 | 0.0033 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34560 |
critical | 9.0 | 0.0039 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34562 |
critical | 9.0 | 0.0028 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34563 |
critical | 9.0 | 0.0027 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34564 |
critical | 9.0 | 0.0031 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34565 |
critical | 9.0 | 0.0027 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34566 |
critical | 9.0 | 0.0027 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34567 |
critical | 9.0 | 0.0027 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34568 |
critical | 9.0 | 0.0032 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34569 |
critical | 9.0 | 0.0033 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34571 |
critical | 9.0 | 0.0040 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-33615 |
critical | 9.1 | 0.0042 | 2026-10-29 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-2699 |
critical | 9.8 | 0.5839 | 2026-10-29 | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attack | |
CVE-2026-32871 |
critical | 10.0 | 0.0091 | 2026-10-29 | FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the Op | |
CVE-2026-34208 |
critical | 10.0 | 0.0056 | 2026-10-29 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct ass | |
CVE-2026-34950 |
critical | 9.1 | 0.0024 | 2026-10-29 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publ | |
CVE-2026-34841 |
critical | 9.8 | 0.0023 | 2026-10-29 | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affe | |
CVE-2026-34976 |
critical | 10.0 | 0.0207 | 2026-10-29 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant | |
CVE-2026-34977 |
critical | 9.3 | 0.0077 | 2026-10-29 | Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, | |
CVE-2026-34989 |
critical | 9.4 | 0.0030 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-35030 |
critical | 9.4 | 0.0063 | 2026-10-29 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prio | |
CVE-2026-35035 |
critical | 9.0 | 0.0046 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-35039 |
critical | 9.1 | 0.0021 | 2026-10-29 | fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, se | |
CVE-2026-35044 |
critical | 9.6 | 0.0039 | 2026-10-29 | BentoML is a Python library for building online serving systems optimized for AI apps and | |
CVE-2026-35047 |
critical | 9.3 | 0.0055 | 2026-10-29 | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability | |
CVE-2026-0740 |
critical | 9.8 | 0.6290 | 2026-10-29 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file upload | |
CVE-2026-1114 |
critical | 9.8 | 0.0054 | 2026-10-29 | In parisneo/lollms version 2.1.0, the application's session management is vulnerable to im |