Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57922 |
medium | 5.3 | 0.0024 | 2026-10-29 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was poss | |
CVE-2026-57921 |
high | 7.5 | 0.0030 | 2026-10-29 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' p | |
CVE-2026-53914 |
critical | 9.8 | 0.0035 | 2026-10-29 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization i | |
CVE-2026-13426 |
medium | 5.4 | 0.0029 | 2026-10-29 | The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 | |
CVE-2026-57920 |
high | 7.7 | 0.0038 | 2026-10-29 | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass a | |
CVE-2026-57915 |
— | — | 0.0053 | 2026-10-29 | It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending | |
CVE-2026-40711 |
high | 8.0 | 0.0135 | 2026-10-29 | Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, | |
CVE-2026-57914 |
medium | 6.5 | 0.0044 | 2026-10-29 | By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possib | |
CVE-2026-57620 |
medium | 6.5 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-57918 |
high | 7.1 | 0.0030 | 2026-10-29 | libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read | |
CVE-2026-57913 |
high | 7.5 | 0.0042 | 2026-10-29 | Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing | |
CVE-2026-57912 |
high | 7.5 | 0.0042 | 2026-10-29 | Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by r | |
CVE-2026-57473 |
medium | 5.8 | 0.0023 | 2026-10-29 | A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions | |
CVE-2026-6658 |
medium | 5.4 | 0.0016 | 2026-10-29 | A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (X | |
CVE-2026-11702 |
high | 7.5 | 0.0051 | 2026-10-29 | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across fo | |
CVE-2026-11625 |
high | 7.5 | 0.0051 | 2026-10-29 | Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked pr | |
CVE-2026-57881 |
critical | 9.8 | 0.0065 | 2026-10-29 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision | |
CVE-2026-57880 |
critical | 9.8 | 0.0095 | 2026-10-29 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision G | |
CVE-2026-57879 |
critical | 9.8 | 0.0095 | 2026-10-29 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision G | |
CVE-2026-57878 |
critical | 9.8 | 0.0095 | 2026-10-29 | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision | |
CVE-2026-57877 |
high | 8.6 | 0.0043 | 2026-10-29 | An unauthenticated format string vulnerability exists in vlsvr in GeoVision GV-LPC2011 and | |
CVE-2026-57876 |
high | 7.5 | 0.0055 | 2026-10-29 | An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-L | |
CVE-2026-57875 |
high | 7.5 | 0.0073 | 2026-10-29 | An unauthenticated NULL pointer dereference vulnerability exists in the HTTP request parsi | |
CVE-2026-57874 |
high | 7.5 | 0.0055 | 2026-10-29 | An unauthenticated buffer overflow vulnerability exists in IEEE8021x_upload.cgi in GeoVisi | |
CVE-2026-57873 |
high | 7.5 | 0.0035 | 2026-10-29 | An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_upload.cgi i | |
CVE-2026-57872 |
high | 7.5 | 0.0145 | 2026-10-29 | An unauthenticated directory traversal vulnerability exists in get_fcont.cgi in GeoVision | |
CVE-2026-49486 |
high | 7.5 | 0.0044 | 2026-10-29 | The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connec | |
CVE-2026-2053 |
critical | 10.0 | 0.0039 | 2026-10-29 | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does | |
CVE-2026-8797 |
high | 8.5 | 0.0015 | 2026-10-29 | An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a | |
CVE-2026-8661 |
medium | 4.8 | 0.0038 | 2026-10-29 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdow | |
CVE-2026-50745 |
medium | 6.1 | 0.0038 | 2026-10-29 | A missing sanitisation vulnerability exists with user input in the stats-video.php script. | |
CVE-2026-50744 |
medium | 4.3 | 0.0029 | 2026-10-29 | A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The AP | |
CVE-2026-50742 |
medium | 5.4 | 0.0034 | 2026-10-29 | A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-ba | |
CVE-2026-50741 |
high | 8.8 | 0.0494 | 2026-10-29 | Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by | |
CVE-2026-50740 |
medium | 5.4 | 0.0038 | 2026-10-29 | A missing sanitisation vulnerability of user input in the zone-include.php script exists i | |
CVE-2026-50739 |
medium | 4.3 | 0.0049 | 2026-10-29 | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been appl | |
CVE-2026-48936 |
low | 3.3 | 0.0019 | 2026-10-29 | A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain | |
CVE-2026-48935 |
low | 3.3 | 0.0019 | 2026-10-29 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path t | |
CVE-2026-48934 |
medium | 4.3 | 0.0026 | 2026-10-29 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification vali | |
CVE-2026-48933 |
high | 7.5 | 0.0371 | 2026-10-29 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.e | |
CVE-2026-48930 |
critical | 9.8 | 0.0031 | 2026-10-29 | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silen | |
CVE-2026-48928 |
medium | 5.4 | 0.0022 | 2026-10-29 | A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-cont | |
CVE-2026-48619 |
high | 7.5 | 0.0064 | 2026-10-29 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN fram | |
CVE-2026-48618 |
medium | 6.5 | 0.0314 | 2026-10-29 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling c | |
CVE-2026-48615 |
high | 7.5 | 0.0041 | 2026-10-29 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY | |
CVE-2026-9222 |
critical | 9.2 | 0.0041 | 2026-10-29 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only requir | |
CVE-2026-9221 |
high | 8.7 | 0.0026 | 2026-10-29 | The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier use | |
CVE-2026-9220 |
high | 8.7 | 0.0039 | 2026-10-29 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts re | |
CVE-2026-9219 |
high | 8.3 | 0.0035 | 2026-10-29 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a pred | |
CVE-2026-13322 |
low | 3.8 | 0.0013 | 2026-10-29 | A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads gue |