Browse All CVEs
10,543 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-91654 |
medium | 6.3 | 0.0016 | 2026-10-29 | Vulnerability in Oracle Essbase (component: Security). The supported version that is aff | |
CVE-2026-91657 |
medium | 4.3 | 0.0019 | 2026-10-29 | Vulnerability in Oracle Essbase (component: Security). The supported version that is aff | |
CVE-2026-91660 |
medium | 4.3 | 0.0030 | 2026-10-29 | Vulnerability in Oracle Essbase (component: Security). The supported version that is aff | |
CVE-2026-91662 |
medium | 6.4 | 0.0009 | 2026-10-29 | Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version tha | |
CVE-2026-94402 |
medium | 6.1 | 0.0025 | 2026-10-29 | IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterCh | |
CVE-2026-112202 |
medium | 6.5 | 0.0043 | 2026-10-29 | Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidat | |
CVE-2026-113705 |
medium | 6.9 | 0.0033 | 2026-10-29 | A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some u | |
CVE-2026-109681 |
medium | 4.7 | 0.0020 | 2026-10-29 | The FTP client trusts the server's PASV response IP:port without validation against the co | |
CVE-2026-109682 |
medium | 4.7 | 0.0017 | 2026-10-29 | Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_c | |
CVE-2026-113706 |
medium | 5.1 | 0.0025 | 2026-10-29 | A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown fu | |
CVE-2026-113707 |
medium | 5.3 | 0.0026 | 2026-10-29 | A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element | |
CVE-2020-37288 |
medium | 6.3 | 0.0035 | 2026-10-29 | Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a | |
CVE-2020-37289 |
medium | 6.3 | 0.0026 | 2026-10-29 | Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, | |
CVE-2021-48019 |
medium | 6.3 | 0.0025 | 2026-10-29 | Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to func | |
CVE-2026-111943 |
medium | 6.8 | 0.0040 | 2026-10-29 | On most platforms, Go uses the given system root certificates. However, in some narrower c | |
CVE-2026-113738 |
medium | 5.3 | 0.0041 | 2026-10-29 | A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798 | |
CVE-2026-114038 |
medium | 5.1 | 0.0012 | 2026-10-29 | A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds rea | |
CVE-2026-114041 |
medium | 6.9 | 0.0032 | 2026-10-29 | FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_ | |
CVE-2026-114044 |
medium | 6.9 | 0.0025 | 2026-10-29 | FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android clie | |
CVE-2026-114048 |
medium | 5.1 | 0.0016 | 2026-10-29 | WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endp | |
CVE-2026-114049 |
medium | 6.3 | 0.0027 | 2026-10-29 | vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows | |
CVE-2026-114056 |
medium | 5.3 | 0.0030 | 2026-10-29 | ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that al | |
CVE-2026-114057 |
medium | 5.3 | 0.0029 | 2026-10-29 | ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the | |
CVE-2026-114058 |
medium | 5.3 | 0.0029 | 2026-10-29 | ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the | |
CVE-2026-114062 |
medium | 6.9 | 0.0035 | 2026-10-29 | SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows re | |
CVE-2026-114064 |
medium | 5.1 | 0.0039 | 2026-10-29 | Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook | |
CVE-2026-114072 |
medium | 5.3 | 0.0012 | 2026-10-29 | The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability i | |
CVE-2026-114073 |
medium | 6.8 | 0.0023 | 2026-10-29 | Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes | |
CVE-2026-114074 |
medium | 5.3 | 0.0036 | 2026-10-29 | Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows | |
CVE-2026-114076 |
medium | 5.3 | 0.0033 | 2026-10-29 | Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that a | |
CVE-2026-114077 |
medium | 6.1 | 0.0035 | 2026-10-29 | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymen | |
CVE-2026-114079 |
medium | 5.3 | 0.0030 | 2026-10-29 | Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows hold | |
CVE-2026-114086 |
medium | 6.9 | 0.0038 | 2026-10-29 | Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime s | |
CVE-2026-114091 |
medium | 6.0 | 0.0034 | 2026-10-29 | Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.re | |
CVE-2026-114093 |
medium | 5.3 | 0.0019 | 2026-10-29 | Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows r | |
CVE-2026-114099 |
medium | 6.9 | 0.0029 | 2026-10-29 | Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties i | |
CVE-2026-114100 |
medium | 6.9 | 0.0028 | 2026-10-29 | Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-b | |
CVE-2026-114101 |
medium | 6.3 | 0.0025 | 2026-10-29 | Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, whi | |
CVE-2026-114103 |
medium | 6.9 | 0.0040 | 2026-10-29 | adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to eva | |
CVE-2026-114114 |
medium | 6.0 | 0.0026 | 2026-10-29 | Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based lin | |
CVE-2026-114115 |
medium | 6.3 | 0.0028 | 2026-10-29 | Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfEx | |
CVE-2026-114116 |
medium | 6.0 | 0.0026 | 2026-10-29 | Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with | |
CVE-2026-114118 |
medium | 6.3 | 0.0020 | 2026-10-29 | Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint | |
CVE-2026-92822 |
medium | 6.2 | 0.0021 | 2026-10-29 | A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted | |
CVE-2026-92823 |
medium | 6.2 | 0.0016 | 2026-10-29 | A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd | |
CVE-2026-92824 |
medium | 6.2 | 0.0012 | 2026-10-29 | A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner l | |
CVE-2026-93856 |
medium | 4.3 | 0.0037 | 2026-10-29 | In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the | |
CVE-2026-17557 |
medium | 6.5 | 0.0033 | 2026-10-29 | A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An auth | |
CVE-2026-109125 |
medium | 5.3 | 0.0017 | 2026-10-29 | In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side- | |
CVE-2026-50106 |
medium | 6.5 | 0.0021 | 2026-10-29 | When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root |