Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-13318 |
medium | 6.4 | 0.0024 | 2026-10-29 | A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward ha | |
CVE-2026-13218 |
medium | 4.2 | 0.0014 | 2026-10-29 | A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile | |
CVE-2026-13083 |
medium | 6.9 | 0.0030 | 2026-10-29 | A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into | |
CVE-2026-12993 |
medium | 6.5 | 0.0052 | 2026-10-29 | A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks extern | |
CVE-2026-54479 |
medium | 6.9 | 0.0042 | 2026-10-29 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but | |
CVE-2026-50176 |
high | 8.7 | 0.0071 | 2026-10-29 | The WebSocket Application Programming Interface lacks restrictions on the number of authen | |
CVE-2026-44622 |
medium | 6.9 | 0.0042 | 2026-10-29 | Charging station authentication identifiers are publicly accessible via web-based mapping | |
CVE-2026-40702 |
critical | 9.3 | 0.0065 | 2026-10-29 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersona | |
CVE-2026-13283 |
high | 7.5 | 0.0034 | 2026-10-29 | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a r | |
CVE-2026-13282 |
medium | 6.8 | 0.0015 | 2026-10-29 | Use after free in Payments in Google Chrome on Android prior to 149.0.7827.201 allowed a l | |
CVE-2026-13281 |
high | 8.3 | 0.0026 | 2026-10-29 | Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacke | |
CVE-2026-12992 |
high | 7.4 | 0.0034 | 2026-10-29 | A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader | |
CVE-2026-12975 |
— | — | 0.0044 | 2026-10-29 | A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates | |
CVE-2026-11800 |
— | — | 0.0026 | 2026-10-29 | A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Author | |
CVE-2026-56445 |
high | 8.8 | 0.0064 | 2026-10-29 | The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DI | |
CVE-2026-37452 |
high | 7.5 | 0.0053 | 2026-10-29 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a re | |
CVE-2026-12473 |
high | 8.3 | 0.0039 | 2026-10-29 | Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch | |
CVE-2026-57522 |
low | 2.3 | 0.0046 | 2026-10-29 | Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTem | |
CVE-2026-57521 |
medium | 5.3 | 0.0043 | 2026-10-29 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allow | |
CVE-2026-57520 |
high | 7.1 | 0.0064 | 2026-10-29 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows | |
CVE-2026-46602 |
high | 7.5 | 0.0061 | 2026-10-29 | The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a m | |
CVE-2026-46601 |
high | 7.5 | 0.0061 | 2026-10-29 | The webp decoder can panic when processing a VP8 chunk with dimensions that do not match t | |
CVE-2026-37454 |
high | 7.5 | 0.0034 | 2026-10-29 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a re | |
CVE-2026-37453 |
high | 7.5 | 0.0054 | 2026-10-29 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a re | |
CVE-2026-2299 |
medium | 4.3 | 0.0020 | 2026-10-29 | The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membersh | |
CVE-2026-57700 |
critical | 10.0 | 0.0052 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows | |
CVE-2026-56790 |
high | 7.0 | 0.0031 | 2026-10-29 | CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overfl | |
CVE-2026-56789 |
high | 7.1 | 0.0042 | 2026-10-29 | RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb func | |
CVE-2026-56788 |
medium | 4.8 | 0.0017 | 2026-10-29 | RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function w | |
CVE-2026-56787 |
medium | 6.9 | 0.0056 | 2026-10-29 | RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode | |
CVE-2026-56786 |
critical | 9.3 | 0.0071 | 2026-10-29 | RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 func | |
CVE-2026-56779 |
medium | 5.3 | 0.0029 | 2026-10-29 | MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation | |
CVE-2026-56772 |
medium | 5.3 | 0.0033 | 2026-10-29 | NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenti | |
CVE-2026-56771 |
medium | 6.3 | 0.0035 | 2026-10-29 | NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the | |
CVE-2026-56770 |
high | 8.7 | 0.0058 | 2026-10-29 | libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index | |
CVE-2026-56769 |
medium | 6.3 | 0.0037 | 2026-10-29 | Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-si | |
CVE-2026-56768 |
high | 8.7 | 0.0071 | 2026-10-29 | Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-li | |
CVE-2026-56767 |
high | 8.7 | 0.0060 | 2026-10-29 | Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability | |
CVE-2026-56766 |
high | 8.6 | 0.0244 | 2026-10-29 | Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authe | |
CVE-2026-54250 |
medium | 5.8 | 0.0017 | 2026-10-29 | K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, | |
CVE-2026-53925 |
high | 7.8 | 0.0019 | 2026-10-29 | Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, t | |
CVE-2026-4930 |
high | 7.1 | 0.0014 | 2026-10-29 | SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that a | |
CVE-2026-46611 |
medium | 5.3 | 0.0014 | 2026-10-29 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glanc | |
CVE-2026-46608 |
high | 7.4 | 0.0040 | 2026-10-29 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glanc | |
CVE-2026-46607 |
high | 7.8 | 0.0019 | 2026-10-29 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/o | |
CVE-2026-46606 |
high | 7.8 | 0.0019 | 2026-10-29 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glanc | |
CVE-2026-28898 |
medium | 5.3 | 0.0031 | 2026-10-29 | swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for contr | |
CVE-2026-12921 |
high | 8.4 | 0.0019 | 2026-10-29 | In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be expl | |
CVE-2026-12897 |
high | 8.4 | 0.0018 | 2026-10-29 | Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Rea | |
CVE-2026-55967 |
low | 2.0 | 0.0018 | 2026-10-29 | AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 Gi |