Browse All CVEs
13,216 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-118260 |
high | 8.2 | 0.0037 | 2026-10-29 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware | |
CVE-2026-118261 |
high | 8.2 | 0.0037 | 2026-10-29 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middlewar | |
CVE-2026-118262 |
high | 8.2 | 0.0030 | 2026-10-29 | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware ca | |
CVE-2026-118645 |
high | 7.0 | 0.0023 | 2026-10-29 | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injecti | |
CVE-2026-118646 |
high | 7.1 | 0.0025 | 2026-10-29 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vu | |
CVE-2026-118648 |
high | 8.4 | 0.0026 | 2026-10-29 | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-s | |
CVE-2026-118649 |
high | 8.7 | 0.0027 | 2026-10-29 | n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and cache | |
CVE-2026-118678 |
high | 7.1 | 0.0029 | 2026-10-29 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability th | |
CVE-2026-118683 |
high | 8.6 | 0.0049 | 2026-10-29 | MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWork | |
CVE-2026-118684 |
high | 8.2 | 0.0019 | 2026-10-29 | MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_ | |
CVE-2026-118686 |
high | 8.7 | 0.0035 | 2026-10-29 | EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in | |
CVE-2026-118687 |
high | 8.3 | 0.0019 | 2026-10-29 | Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, a | |
CVE-2026-118688 |
high | 8.8 | 0.0024 | 2026-10-29 | wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 r | |
CVE-2025-14260 |
high | 8.3 | 0.0028 | 2026-10-29 | Due to the improper implementation of access control rules, the WSO2 product accepts user- | |
CVE-2026-109411 |
high | 8.1 | 0.0065 | 2026-10-29 | An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat | |
CVE-2026-118650 |
high | 7.5 | 0.0040 | 2026-10-29 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Stati | |
CVE-2026-13451 |
high | 7.7 | 0.0021 | 2026-10-29 | A flaw was found in KServe. A namespace-scoped user with create/update permissions on Infe | |
CVE-2026-61542 |
high | 8.6 | 0.0031 | 2026-10-29 | Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an em | |
CVE-2026-6647 |
high | 7.4 | 0.0021 | 2026-10-29 | In deployments of WSO2 Identity Server configured with a case-insensitive user store and a | |
CVE-2026-76418 |
high | 8.6 | 0.0082 | 2026-10-29 | KEV | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked ret |
CVE-2026-78674 |
high | 8.8 | 0.0100 | 2026-10-29 | The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenti | |
CVE-2026-118659 |
high | 7.5 | 0.0039 | 2026-10-29 | Happy DOM is a JavaScript implementation of a web browser without its graphical user inter | |
CVE-2026-118660 |
high | 8.6 | 0.0040 | 2026-10-29 | Happy DOM is a JavaScript implementation of a web browser without its graphical user inter | |
CVE-2026-118664 |
high | 8.2 | 0.0032 | 2026-10-29 | decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0. | |
CVE-2026-118665 |
high | 8.2 | 0.0039 | 2026-10-29 | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Pri | |
CVE-2026-118668 |
high | 8.6 | 0.0037 | 2026-10-29 | langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 u | |
CVE-2026-116641 |
high | 7.6 | 0.0014 | 2026-10-29 | The DB Tools rely on the TLS implementation in Golang’s standard library, which generally | |
CVE-2026-118669 |
high | 8.4 | 0.0031 | 2026-10-29 | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to | |
CVE-2026-118682 |
high | 7.7 | 0.0027 | 2026-10-29 | KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the | |
CVE-2026-118689 |
high | 8.7 | 0.0051 | 2026-10-29 | OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::Lo | |
CVE-2026-118692 |
high | 7.1 | 0.0058 | 2026-10-29 | CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link | |
CVE-2026-118694 |
high | 8.7 | 0.0045 | 2026-10-29 | python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remo | |
CVE-2026-118752 |
high | 8.5 | 0.0014 | 2026-10-29 | FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in t | |
CVE-2026-118753 |
high | 8.5 | 0.0014 | 2026-10-29 | FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in P | |
CVE-2026-118755 |
high | 8.6 | 0.0140 | 2026-10-29 | Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerab | |
CVE-2026-118803 |
high | 7.5 | 0.0037 | 2026-10-29 | Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulne | |
CVE-2026-118804 |
high | 7.5 | 0.0025 | 2026-10-29 | Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows | |
CVE-2026-54453 |
high | 7.2 | 0.0044 | 2026-10-29 | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agen | |
CVE-2026-54455 |
high | 7.6 | 0.0025 | 2026-10-29 | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agen | |
CVE-2026-61546 |
high | 8.8 | 0.0018 | 2026-10-29 | AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact | |
CVE-2026-61569 |
high | 7.5 | 0.0028 | 2026-10-29 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at | |
CVE-2026-61571 |
high | 7.3 | 0.0028 | 2026-10-29 | AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authenticat | |
CVE-2026-61572 |
high | 8.6 | 0.0025 | 2026-10-29 | AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_ | |
CVE-2026-93851 |
high | 8.0 | 0.0027 | 2026-10-29 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate | |
CVE-2026-118579 |
high | 8.9 | 0.0079 | 2026-10-29 | A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the func | |
CVE-2026-85749 |
high | 8.1 | 0.0029 | 2026-10-29 | MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any au | |
CVE-2026-21157 |
high | 8.3 | 0.0011 | 2026-10-29 | Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attac | |
CVE-2026-96951 |
high | 8.8 | 0.0981 | 2026-10-29 | KEV | Microsoft Windows Shell contains a command injection vulnerability that allows an unauthor |
CVE-2026-81963 |
high | 7.8 | 0.0039 | 2026-10-29 | KEV 1 PoC | Microsoft Windows Update Stack contains a link following vulnerability that allows a local |
CVE-2026-85880 |
high | 7.8 | 0.0039 | 2026-10-29 | KEV | Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vuln |