Browse All CVEs
3,388 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-34727 |
critical | 9.1 | 0.0028 | 2026-10-29 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC c | |
CVE-2026-40157 |
critical | 9.4 | 0.0038 | 2026-10-29 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI ex | |
CVE-2026-5483 |
critical | 9.9 | 0.0049 | 2026-10-29 | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh- | |
CVE-2026-33698 |
critical | 9.3 | 0.0032 | 2026-10-29 | Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable | |
CVE-2026-33707 |
critical | 9.8 | 0.0043 | 2026-10-29 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default | |
CVE-2026-40189 |
critical | 9.3 | 0.0064 | 2026-10-29 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the docum | |
CVE-2026-40190 |
critical | 9.8 | 0.0031 | 2026-10-29 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to | |
CVE-2026-4149 |
critical | 9.8 | 0.0100 | 2026-10-29 | Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability. This | |
CVE-2026-31845 |
critical | 9.3 | 0.0043 | 2026-10-29 | A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6 | |
CVE-2026-40393 |
critical | 9.8 | 0.0043 | 2026-10-29 | In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGP | |
CVE-2026-25205 |
critical | 9.8 | 0.0019 | 2026-10-29 | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bou | |
CVE-2026-25206 |
critical | 9.1 | 0.0018 | 2026-10-29 | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Expo | |
CVE-2026-25207 |
critical | 9.8 | 0.0019 | 2026-10-29 | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. | |
CVE-2026-25208 |
critical | 9.8 | 0.0025 | 2026-10-29 | Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.Thi | |
CVE-2026-25209 |
critical | 9.1 | 0.0025 | 2026-10-29 | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Expo | |
CVE-2026-40446 |
critical | 9.8 | 0.0023 | 2026-10-29 | Access of resource using incompatible type ('type confusion') vulnerability in Samsung Ope | |
CVE-2026-34865 |
critical | 10.0 | 0.0021 | 2026-10-29 | Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of thi | |
CVE-2026-5085 |
critical | 9.1 | 0.0034 | 2026-10-29 | Solstice::Session versions through 1440 for Perl generates session ids insecurely. The _g | |
CVE-2026-5936 |
critical | 9.8 | 0.0019 | 2026-10-29 | An attacker can control a server-side HTTP request by supplying a crafted URL, causing the | |
CVE-2026-4810 |
critical | 9.3 | 0.0182 | 2026-10-29 | A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit | |
CVE-2026-6100 |
critical | 9.1 | 0.0058 | 2026-10-29 | Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, a | |
CVE-2026-40042 |
critical | 9.3 | 0.0037 | 2026-10-29 | Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthent | |
CVE-2026-40044 |
critical | 9.3 | 0.0048 | 2026-10-29 | Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attacker | |
CVE-2026-27681 |
critical | 9.9 | 0.0050 | 2026-10-29 | Due to insufficient authorization checks in SAP Business Planning and Consolidation and SA | |
CVE-2026-6264 |
critical | 9.8 | 0.0074 | 2026-10-29 | A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated | |
CVE-2026-40288 |
critical | 9.8 | 0.0061 | 2026-10-29 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.14 | |
CVE-2026-40289 |
critical | 9.1 | 0.0042 | 2026-10-29 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.14 | |
CVE-2026-40313 |
critical | 9.1 | 0.0031 | 2026-10-29 | PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions | |
CVE-2026-31908 |
critical | 9.1 | 0.0052 | 2026-10-29 | Header injection vulnerability in Apache APISIX. The attacker can take advantage of certa | |
CVE-2026-2332 |
critical | 9.1 | 0.0131 | 2026-10-29 | In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extens | |
CVE-2026-2449 |
critical | 9.0 | 0.0033 | 2026-10-29 | Improper neutralization of argument delimiters in a command ('argument injection') vulnera | |
CVE-2026-39808 |
critical | 9.8 | 0.9319 | 2026-10-29 | KEV | Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an u |
CVE-2026-39813 |
critical | 9.8 | 0.2222 | 2026-10-29 | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, | |
CVE-2026-26149 |
critical | 9.0 | 0.0056 | 2026-10-29 | Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allo | |
CVE-2026-27243 |
critical | 9.3 | 0.0030 | 2026-10-29 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Sc | |
CVE-2026-27245 |
critical | 9.3 | 0.0030 | 2026-10-29 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Sc | |
CVE-2026-27246 |
critical | 9.3 | 0.0030 | 2026-10-29 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Sc | |
CVE-2026-27303 |
critical | 9.6 | 0.0061 | 2026-10-29 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untr |