Browse All CVEs
13,233 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-116488 |
high | 7.0 | 0.0037 | 2026-10-29 | 1 PoC | NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap b |
CVE-2026-116492 |
high | 7.1 | 0.0024 | 2026-10-29 | Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows au | |
CVE-2026-97200 |
high | 8.2 | 0.0056 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in beno | |
CVE-2026-106781 |
high | 7.8 | 0.0015 | 2026-10-29 | 1 PoC | An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE versio |
CVE-2026-112345 |
high | 8.6 | 0.0024 | 2026-10-29 | TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a | |
CVE-2026-115930 |
high | 7.6 | 0.0014 | 2026-10-29 | The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its ow | |
CVE-2026-77052 |
high | 8.7 | 0.0033 | 2026-10-29 | boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path thro | |
CVE-2026-77053 |
high | 8.7 | 0.0025 | 2026-10-29 | boneIO Black firmware ships with authentication disabled by default. Its management web AP | |
CVE-2026-77056 |
high | 7.1 | 0.0036 | 2026-10-29 | boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default c | |
CVE-2026-77059 |
high | 8.8 | 0.0012 | 2026-10-29 | boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() fun | |
CVE-2026-90885 |
high | 7.5 | 0.0060 | 2026-10-29 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon | |
CVE-2026-99094 |
high | 7.5 | 0.0023 | 2026-10-29 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pc | |
CVE-2026-99099 |
high | 7.8 | 0.0013 | 2026-10-29 | In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD | |
CVE-2026-112343 |
high | 8.6 | 0.0047 | 2026-10-29 | Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows | |
CVE-2026-112344 |
high | 7.6 | 0.0030 | 2026-10-29 | Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows a | |
CVE-2026-115721 |
high | 7.5 | 0.0047 | 2026-10-29 | **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all v | |
CVE-2026-115748 |
high | 8.8 | 0.0061 | 2026-10-29 | **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Ap | |
CVE-2026-116489 |
high | 7.7 | 0.0050 | 2026-10-29 | Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows l | |
CVE-2026-116539 |
high | 8.2 | 0.0040 | 2026-10-29 | Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in | |
CVE-2026-116540 |
high | 8.2 | 0.0046 | 2026-10-29 | netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-a | |
CVE-2026-116541 |
high | 8.2 | 0.0049 | 2026-10-29 | Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the | |
CVE-2026-116543 |
high | 8.7 | 0.0039 | 2026-10-29 | Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_mul | |
CVE-2026-85297 |
high | 7.7 | 0.0031 | 2026-10-29 | Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform | |
CVE-2026-107091 |
high | 7.8 | 0.0015 | 2026-10-29 | An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacke | |
CVE-2026-115418 |
high | 7.3 | 0.0017 | 2026-10-29 | SQL injection in the database-query custom resource handlers in the Amazon Web Services (A | |
CVE-2026-115907 |
high | 7.5 | 0.0035 | 2026-10-29 | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1 | |
CVE-2026-115908 |
high | 7.4 | 0.0043 | 2026-10-29 | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2 | |
CVE-2026-115909 |
high | 7.5 | 0.0046 | 2026-10-29 | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3 | |
CVE-2026-115912 |
high | 8.8 | 0.0051 | 2026-10-29 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an aut | |
CVE-2026-116612 |
high | 7.8 | 0.0023 | 2026-10-29 | A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file | |
CVE-2026-71456 |
high | 8.5 | 0.0010 | 2026-10-29 | Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass al | |
CVE-2026-81038 |
high | 7.1 | 0.0015 | 2026-10-29 | The Object Transfer Service server builds its Object Action Control Point (OACP) response | |
CVE-2026-105608 |
high | 8.8 | 0.0045 | 2026-10-29 | HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in servic | |
CVE-2026-105626 |
high | 7.5 | 0.0043 | 2026-10-29 | HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP A | |
CVE-2026-105765 |
high | 7.5 | 0.0024 | 2026-10-29 | HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorizati | |
CVE-2026-116634 |
high | 8.2 | 0.0050 | 2026-10-29 | OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows | |
CVE-2026-33521 |
high | 7.5 | 0.0045 | 2026-10-29 | There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior t | |
CVE-2026-70379 |
high | 7.1 | 0.0011 | 2026-10-29 | When the vSolution Matrix feature is enabled, affected devices may make current screen con | |
CVE-2026-72753 |
high | 8.2 | 0.0040 | 2026-10-29 | When Routinator encounters an RRDP notification file with gaps in the delta entries, it is | |
CVE-2026-72754 |
high | 7.5 | 0.0040 | 2026-10-29 | When Routinator encounters a CRL with many entries, it may hang or run out of memory. If R | |
CVE-2026-72756 |
high | 7.5 | 0.0040 | 2026-10-29 | Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cann | |
CVE-2026-72758 |
high | 7.5 | 0.0040 | 2026-10-29 | When parsing an AS range in Routinator, if the maximum value of the range is smaller than | |
CVE-2026-104591 |
high | 7.5 | 0.0045 | 2026-10-29 | libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() i | |
CVE-2026-104594 |
high | 7.5 | 0.0047 | 2026-10-29 | libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parser | |
CVE-2026-116638 |
high | 7.5 | 0.0042 | 2026-10-29 | The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to byp | |
CVE-2026-104596 |
high | 7.5 | 0.0039 | 2026-10-29 | libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-ser | |
CVE-2026-115924 |
high | 8.6 | 0.0039 | 2026-10-29 | Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpo | |
CVE-2026-57187 |
high | 7.1 | 0.0048 | 2026-10-29 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asteris | |
CVE-2026-65629 |
high | 7.4 | 0.0006 | 2026-10-29 | Use of Password Hash With Insufficient Computational Effort in the jose library allows an | |
CVE-2025-13833 |
high | 7.7 | 0.0015 | 2026-10-29 | A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Conne |