Browse All CVEs
13,252 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-113405 |
high | 8.7 | 0.0052 | 2026-10-29 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remo | |
CVE-2026-113406 |
high | 8.7 | 0.0052 | 2026-10-29 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remo | |
CVE-2026-113354 |
high | 7.1 | 0.0037 | 2026-10-29 | Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin | |
CVE-2026-105949 |
high | 8.8 | 0.0033 | 2026-10-29 | Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact p | |
CVE-2026-113390 |
high | 8.6 | 0.0186 | 2026-10-29 | A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue i | |
CVE-2026-112940 |
high | 7.1 | 0.0019 | 2026-10-29 | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWrit | |
CVE-2025-71436 |
high | 7.1 | 0.0050 | 2026-10-29 | Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow | |
CVE-2026-111765 |
high | 7.5 | 0.0080 | 2026-10-29 | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in vers | |
CVE-2026-113606 |
high | 7.1 | 0.0036 | 2026-10-29 | Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allow | |
CVE-2026-113658 |
high | 7.5 | 0.0062 | 2026-10-29 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the un | |
CVE-2026-111756 |
high | 8.2 | 0.0047 | 2026-10-29 | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows red | |
CVE-2026-113718 |
high | 7.1 | 0.0024 | 2026-10-29 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, | |
CVE-2026-113722 |
high | 7.8 | 0.0029 | 2026-10-29 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, | |
CVE-2026-113723 |
high | 7.1 | 0.0024 | 2026-10-29 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, | |
CVE-2026-113725 |
high | 7.8 | 0.0026 | 2026-10-29 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, | |
CVE-2026-86409 |
high | 8.1 | 0.0110 | 2026-10-29 | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to | |
CVE-2026-86410 |
high | 8.1 | 0.0077 | 2026-10-29 | A flaw in the curl command line tool's logic makes it only set SSH host verification optio | |
CVE-2026-86412 |
high | 8.1 | 0.0083 | 2026-10-29 | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie ja | |
CVE-2012-20002 |
high | 8.7 | 0.0053 | 2026-10-29 | TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vuln | |
CVE-2014-125133 |
high | 8.7 | 0.0112 | 2026-10-29 | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that | |
CVE-2014-125134 |
high | 8.7 | 0.0082 | 2026-10-29 | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allo | |
CVE-2015-20123 |
high | 8.7 | 0.0041 | 2026-10-29 | Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerabilit | |
CVE-2015-20124 |
high | 8.7 | 0.0050 | 2026-10-29 | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulne | |
CVE-2015-20125 |
high | 8.7 | 0.0041 | 2026-10-29 | Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerabilit | |
CVE-2015-20128 |
high | 8.8 | 0.0034 | 2026-10-29 | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthent | |
CVE-2016-20100 |
high | 8.7 | 0.0053 | 2026-10-29 | Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vuln | |
CVE-2016-20103 |
high | 8.7 | 0.0061 | 2026-10-29 | Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allo | |
CVE-2016-20104 |
high | 8.7 | 0.0061 | 2026-10-29 | EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vul | |
CVE-2026-107928 |
high | 8.1 | 0.0070 | 2026-10-29 | When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory pas | |
CVE-2026-107929 |
high | 8.1 | 0.0067 | 2026-10-29 | When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one | |
CVE-2026-111758 |
high | 7.5 | 0.0055 | 2026-10-29 | markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to bef | |
CVE-2026-112407 |
high | 8.8 | 0.0046 | 2026-10-29 | Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-appl | |
CVE-2026-86415 |
high | 7.5 | 0.0042 | 2026-10-29 | libcurl's connection cache match function never considers the automatic client certificate | |
CVE-2026-87862 |
high | 8.1 | 0.0100 | 2026-10-29 | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silen | |
CVE-2026-87863 |
high | 8.1 | 0.0083 | 2026-10-29 | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, | |
CVE-2026-87864 |
high | 8.1 | 0.0083 | 2026-10-29 | Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APP | |
CVE-2026-87865 |
high | 7.4 | 0.0060 | 2026-10-29 | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can | |
CVE-2026-92386 |
high | 8.1 | 0.0083 | 2026-10-29 | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server c | |
CVE-2026-92387 |
high | 8.1 | 0.0104 | 2026-10-29 | By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or S | |
CVE-2026-92389 |
high | 8.1 | 0.0072 | 2026-10-29 | libcurl's TFTP state machine fails to validate state transitions against the requested tra | |
CVE-2026-92390 |
high | 7.5 | 0.0059 | 2026-10-29 | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented ant | |
CVE-2026-92391 |
high | 7.5 | 0.0117 | 2026-10-29 | A deeply nested multipart MIME structure constructed via the public API causes a stack ove | |
CVE-2026-94266 |
high | 7.5 | 0.0056 | 2026-10-29 | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_UR | |
CVE-2026-101387 |
high | 7.6 | 0.0030 | 2026-10-29 | Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern | |
CVE-2026-101388 |
high | 7.1 | 0.0036 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101390 |
high | 8.1 | 0.0041 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101398 |
high | 7.6 | 0.0033 | 2026-10-29 | Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern | |
CVE-2026-101410 |
high | 7.5 | 0.0034 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101411 |
high | 8.1 | 0.0041 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101416 |
high | 7.5 | 0.0031 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo |