Browse All CVEs
3,388 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-2699 |
critical | 9.8 | 0.5839 | 2026-10-29 | Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attack | |
CVE-2026-32871 |
critical | 10.0 | 0.0091 | 2026-10-29 | FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the Op | |
CVE-2026-34208 |
critical | 10.0 | 0.0056 | 2026-10-29 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct ass | |
CVE-2026-34950 |
critical | 9.1 | 0.0024 | 2026-10-29 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publ | |
CVE-2026-34841 |
critical | 9.8 | 0.0023 | 2026-10-29 | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affe | |
CVE-2026-34976 |
critical | 10.0 | 0.0207 | 2026-10-29 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant | |
CVE-2026-34977 |
critical | 9.3 | 0.0077 | 2026-10-29 | Aperi'Solve is an open-source steganalysis web platform. In versions 3.1.3 through 3.2.0, | |
CVE-2026-34989 |
critical | 9.4 | 0.0030 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-35030 |
critical | 9.4 | 0.0063 | 2026-10-29 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prio | |
CVE-2026-35035 |
critical | 9.0 | 0.0046 | 2026-10-29 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-35039 |
critical | 9.1 | 0.0021 | 2026-10-29 | fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, se | |
CVE-2026-35044 |
critical | 9.6 | 0.0039 | 2026-10-29 | BentoML is a Python library for building online serving systems optimized for AI apps and | |
CVE-2026-35047 |
critical | 9.3 | 0.0055 | 2026-10-29 | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability | |
CVE-2026-0740 |
critical | 9.8 | 0.6290 | 2026-10-29 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file upload | |
CVE-2026-1114 |
critical | 9.8 | 0.0054 | 2026-10-29 | In parisneo/lollms version 2.1.0, the application's session management is vulnerable to im | |
CVE-2026-22679 |
critical | 9.3 | 0.2036 | 2026-10-29 | Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote | |
CVE-2026-23818 |
critical | 9.6 | 0.0032 | 2026-10-29 | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Net | |
CVE-2026-5734 |
critical | 9.8 | 0.0033 | 2026-10-29 | Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0. | |
CVE-2026-5735 |
critical | 9.8 | 0.0026 | 2026-10-29 | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs | |
CVE-2025-62818 |
critical | 9.8 | 0.0046 | 2026-10-29 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos | |
CVE-2026-4277 |
critical | 9.8 | 0.0046 | 2026-10-29 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add | |
CVE-2026-35490 |
critical | 9.8 | 0.0054 | 2026-10-29 | changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, | |
CVE-2026-23696 |
critical | 9.4 | 0.1358 | 2026-10-29 | Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability | |
CVE-2026-35580 |
critical | 9.1 | 0.0057 | 2026-10-29 | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workf | |
CVE-2026-35615 |
critical | 9.2 | 0.0042 | 2026-10-29 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path. | |
CVE-2026-39305 |
critical | 10.0 | 0.0031 | 2026-10-29 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature | |
CVE-2026-35573 |
critical | 9.1 | 0.0076 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vul | |
CVE-2026-39324 |
critical | 9.3 | 0.0027 | 2026-10-29 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, | |
CVE-2026-39337 |
critical | 10.0 | 0.0072 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authent | |
CVE-2026-39339 |
critical | 9.1 | 0.0135 | 2026-10-29 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authenti | |
CVE-2026-5300 |
critical | 9.1 | 0.0022 | 2026-10-29 | Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticat | |
CVE-2026-34177 |
critical | 9.1 | 0.0036 | 2026-10-29 | Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOpti | |
CVE-2026-34178 |
critical | 9.1 | 0.0042 | 2026-10-29 | In Canonical LXD before 6.8, the backup import path validates project restrictions against | |
CVE-2026-34179 |
critical | 9.1 | 0.0027 | 2026-10-29 | In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certif | |
CVE-2026-5442 |
critical | 9.8 | 0.0060 | 2026-10-29 | A heap buffer overflow vulnerability exists in the DICOM image decoder. Dimension fields a | |
CVE-2026-5443 |
critical | 9.8 | 0.0057 | 2026-10-29 | A heap buffer overflow vulnerability exists during the decoding of `PALETTE COLOR` DICOM i | |
CVE-2026-5445 |
critical | 9.1 | 0.0067 | 2026-10-29 | An out-of-bounds read vulnerability exists in the `DecodeLookupTable` function within `Dic | |
CVE-2026-34971 |
critical | 9.0 | 0.0032 | 2026-10-29 | Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, W | |
CVE-2026-34987 |
critical | 9.0 | 0.0028 | 2026-10-29 | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, W | |
CVE-2026-39912 |
critical | 9.1 | 0.0060 | 2026-10-29 | V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP | |
CVE-2026-29145 |
critical | 9.1 | 0.0072 | 2026-10-29 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is | |
CVE-2026-40088 |
critical | 9.6 | 0.0042 | 2026-10-29 | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function an | |
CVE-2026-40089 |
critical | 9.9 | 0.0023 | 2026-10-29 | Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse | |
CVE-2026-33771 |
critical | 9.1 | 0.0026 | 2026-10-29 | A Weak Password Requirements vulnerability in the password management function of Juniper | |
CVE-2026-33784 |
critical | 9.3 | 0.0046 | 2026-10-29 | A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) | |
CVE-2026-40111 |
critical | 9.3 | 0.0023 | 2026-10-29 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor | |
CVE-2026-40114 |
critical | 10.0 | 0.0024 | 2026-10-29 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accep | |
CVE-2026-40154 |
critical | 9.6 | 0.0030 | 2026-10-29 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetch | |
CVE-2026-1115 |
critical | 9.6 | 0.0126 | 2026-10-29 | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of | |
CVE-2026-6057 |
critical | 9.8 | 0.0093 | 2026-10-29 | FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the fil |