Browse All CVEs
1,816 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-114236 |
low | 3.3 | 0.0010 | 2026-10-29 | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or | |
CVE-2026-35501 |
low | 3.7 | 0.0011 | 2026-10-29 | When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a | |
CVE-2026-87096 |
low | 3.3 | 0.0013 | 2026-10-29 | Sensitive information disclosure and manipulation due to improper authorization checks. Th | |
CVE-2026-104949 |
low | 2.3 | 0.0022 | 2026-10-29 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing | |
CVE-2026-113786 |
low | 2.3 | 0.0037 | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can | |
CVE-2026-114252 |
low | 2.1 | 0.0029 | 2026-10-29 | A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff36 | |
CVE-2026-114370 |
low | 3.7 | 0.0032 | 2026-10-29 | A flaw was found in the PathResourceManager component of the Undertow web server. This com | |
CVE-2026-114472 |
low | 3.7 | 0.0021 | 2026-10-29 | Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressive Robot hM | |
CVE-2026-113797 |
low | 3.1 | 0.0059 | 2026-10-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, | |
CVE-2026-114122 |
low | 3.9 | 0.0019 | 2026-10-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, | |
CVE-2026-105927 |
low | 2.3 | 0.0044 | 2026-10-29 | The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter | |
CVE-2026-114124 |
low | 3.9 | 0.0019 | 2026-10-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, | |
CVE-2026-114127 |
low | 2.3 | 0.0039 | 2026-10-29 | Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's serv | |
CVE-2026-114130 |
low | 2.3 | 0.0041 | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete | |
CVE-2026-105931 |
low | 2.3 | 0.0050 | 2026-10-29 | The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/tra | |
CVE-2026-105932 |
low | 2.3 | 0.0050 | 2026-10-29 | The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the top | |
CVE-2026-105933 |
low | 2.3 | 0.0029 | 2026-10-29 | Apache Pulsar allows an administrator to require end-to-end message encryption for all top | |
CVE-2026-105938 |
low | 2.3 | 0.0051 | 2026-10-29 | Apache Pulsar namespaces can restrict which roles may use a subscription, either with the | |
CVE-2026-114266 |
low | 2.1 | 0.0025 | 2026-10-29 | A security vulnerability has been detected in ProjectWorlds Advanced Library Management Sy | |
CVE-2026-18748 |
low | 3.5 | 0.0020 | 2026-10-29 | The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_ | |
CVE-2026-114375 |
low | 2.1 | 0.0036 | 2026-10-29 | A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is th | |
CVE-2026-114378 |
low | 2.1 | 0.0026 | 2026-10-29 | A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects | |
CVE-2026-114381 |
low | 2.1 | 0.0032 | 2026-10-29 | A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affect | |
CVE-2026-114384 |
low | 2.1 | 0.0032 | 2026-10-29 | A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0 | |
CVE-2026-103515 |
low | 2.7 | 0.0023 | 2026-10-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6 | |
CVE-2026-105711 |
low | 3.5 | 0.0022 | 2026-10-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19. | |
CVE-2026-112326 |
low | 3.1 | 0.0018 | 2026-10-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6 | |
CVE-2026-14288 |
low | 3.1 | 0.0024 | 2026-10-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6 | |
CVE-2026-114576 |
low | 2.9 | 0.0050 | 2026-10-29 | A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function str | |
CVE-2026-114719 |
low | 3.7 | 0.0025 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation by | |
CVE-2026-114721 |
low | 3.1 | 0.0030 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configu | |
CVE-2026-114723 |
low | 3.7 | 0.0033 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource lim | |
CVE-2026-16648 |
low | 3.8 | 0.0025 | 2026-10-29 | Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log a | |
CVE-2026-84911 |
low | 3.1 | 0.0019 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-84916 |
low | 3.7 | 0.0025 | 2026-10-29 | Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This is | |
CVE-2026-84918 |
low | 3.7 | 0.0016 | 2026-10-29 | Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment | |
CVE-2026-87948 |
low | 3.5 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-87949 |
low | 3.3 | 0.0021 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-87951 |
low | 3.8 | 0.0025 | 2026-10-29 | Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provi | |
CVE-2026-87952 |
low | 3.1 | 0.0022 | 2026-10-29 | Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provide | |
CVE-2026-87953 |
low | 3.3 | 0.0017 | 2026-10-29 | Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider al | |
CVE-2026-96360 |
low | 3.5 | 0.0023 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulne | |
CVE-2026-96369 |
low | 3.1 | 0.0021 | 2026-10-29 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform | |
CVE-2026-96373 |
low | 3.3 | 0.0023 | 2026-10-29 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This iss | |
CVE-2026-96384 |
low | 3.5 | 0.0020 | 2026-10-29 | Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Brow | |
CVE-2026-96387 |
low | 3.8 | 0.0027 | 2026-10-29 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop admi | |
CVE-2026-96392 |
low | 3.5 | 0.0021 | 2026-10-29 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Dru | |
CVE-2026-109931 |
low | 3.7 | 0.0024 | 2026-10-29 | The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or | |
CVE-2026-110011 |
low | 2.7 | 0.0024 | 2026-10-29 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perfo | |
CVE-2026-88849 |
low | 2.7 | 0.0022 | 2026-10-29 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that |