Browse All CVEs
13,250 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-117540 |
high | 8.7 | 0.0035 | 2026-10-29 | svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Saniti | |
CVE-2026-102800 |
high | 8.7 | 0.0039 | 2026-10-29 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < | |
CVE-2026-106087 |
high | 8.7 | 0.0025 | 2026-10-29 | TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can expl | |
CVE-2026-109995 |
high | 7.2 | 0.0024 | 2026-10-29 | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is v | |
CVE-2026-10756 |
high | 7.7 | 0.0018 | 2026-10-29 | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network ac | |
CVE-2026-13162 |
high | 7.7 | 0.0019 | 2026-10-29 | An OS command vulnerability exists in CoreTec product that allows authenticated users with | |
CVE-2026-41020 |
high | 7.5 | 0.0023 | 2026-10-29 | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticat | |
CVE-2026-41021 |
high | 7.5 | 0.0018 | 2026-10-29 | Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a pass | |
CVE-2026-4337 |
high | 8.8 | 0.0032 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application a | |
CVE-2026-100164 |
high | 7.5 | 0.0030 | 2026-10-29 | Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism | |
CVE-2026-24269 |
high | 7.1 | 0.0014 | 2026-10-29 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side r | |
CVE-2026-47486 |
high | 7.8 | 0.0015 | 2026-10-29 | NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an o | |
CVE-2026-65119 |
high | 8.4 | 0.0016 | 2026-10-29 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokeni | |
CVE-2026-65120 |
high | 7.1 | 0.0014 | 2026-10-29 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side r | |
CVE-2026-65151 |
high | 8.4 | 0.0018 | 2026-10-29 | NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injec | |
CVE-2026-92546 |
high | 7.5 | 0.0030 | 2026-10-29 | Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic | |
CVE-2026-117553 |
high | 7.7 | 0.0050 | 2026-10-29 | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that | |
CVE-2026-117558 |
high | 8.5 | 0.0069 | 2026-10-29 | The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerabilit | |
CVE-2026-117559 |
high | 8.5 | 0.0069 | 2026-10-29 | DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients | |
CVE-2026-117560 |
high | 8.5 | 0.0065 | 2026-10-29 | ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in | |
CVE-2026-117561 |
high | 8.5 | 0.0065 | 2026-10-29 | Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows | |
CVE-2026-117567 |
high | 8.5 | 0.0065 | 2026-10-29 | esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows | |
CVE-2026-117568 |
high | 7.3 | 0.0060 | 2026-10-29 | mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attack | |
CVE-2026-117569 |
high | 8.5 | 0.0067 | 2026-10-29 | Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_ | |
CVE-2026-117573 |
high | 8.5 | 0.0070 | 2026-10-29 | hagent through commit 761eec6 contains an OS command injection vulnerability that allows M | |
CVE-2026-117602 |
high | 8.6 | 0.0011 | 2026-10-29 | Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader | |
CVE-2025-52290 |
high | 7.5 | 0.0058 | 2026-10-29 | A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg ve | |
CVE-2026-107084 |
high | 8.8 | 0.0020 | 2026-10-29 | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forger | |
CVE-2026-112770 |
high | 8.7 | 0.0071 | 2026-10-29 | Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnera | |
CVE-2026-112775 |
high | 8.7 | 0.0040 | 2026-10-29 | Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that al | |
CVE-2026-112390 |
high | 8.2 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite | |
CVE-2026-112392 |
high | 8.2 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can deref | |
CVE-2026-112396 |
high | 7.5 | 0.0069 | 2026-10-29 | Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after- | |
CVE-2026-112397 |
high | 8.7 | 0.0057 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() c | |
CVE-2026-112399 |
high | 8.7 | 0.0053 | 2026-10-29 | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG d | |
CVE-2026-112400 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected | |
CVE-2026-112402 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory w | |
CVE-2026-112404 |
high | 8.8 | 0.0044 | 2026-10-29 | Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA d | |
CVE-2026-112405 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can d | |
CVE-2026-112406 |
high | 8.7 | 0.0057 | 2026-10-29 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite | |
CVE-2026-112892 |
high | 8.7 | 0.0050 | 2026-10-29 | Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can | |
CVE-2026-112893 |
high | 8.2 | 0.0055 | 2026-10-29 | Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid g | |
CVE-2026-112894 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time t | |
CVE-2026-112895 |
high | 8.7 | 0.0059 | 2026-10-29 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources | |
CVE-2026-112896 |
high | 8.8 | 0.0047 | 2026-10-29 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond | |
CVE-2026-112897 |
high | 8.7 | 0.0048 | 2026-10-29 | Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitializ | |
CVE-2026-112370 |
high | 8.6 | 0.0203 | 2026-10-29 | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_4 | |
CVE-2026-109440 |
high | 8.7 | 0.0060 | 2026-10-29 | LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allo | |
CVE-2026-113386 |
high | 7.1 | 0.0100 | 2026-10-29 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command inject | |
CVE-2026-113405 |
high | 8.7 | 0.0052 | 2026-10-29 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remo |