Browse All CVEs
10,751 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-17545 |
medium | 6.9 | 0.0037 | 2026-10-29 | On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as C | |
CVE-2026-91766 |
medium | 5.9 | 0.0029 | 2026-10-29 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authoriza | |
CVE-2026-91767 |
medium | 6.5 | 0.0011 | 2026-10-29 | php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument | |
CVE-2026-91769 |
medium | 4.3 | 0.0016 | 2026-10-29 | PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries fir | |
CVE-2026-91768 |
medium | 6.5 | 0.0038 | 2026-10-29 | The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 1 | |
CVE-2026-92842 |
medium | 5.9 | 0.0028 | 2026-10-29 | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-de | |
CVE-2026-100749 |
medium | 5.1 | 0.0009 | 2026-10-29 | Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extens | |
CVE-2026-97165 |
medium | 5.3 | 0.0014 | 2026-10-29 | Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extens | |
CVE-2026-100753 |
medium | 5.3 | 0.0015 | 2026-10-29 | Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (F | |
CVE-2026-101109 |
medium | 5.3 | 0.0015 | 2026-10-29 | Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) | |
CVE-2026-18416 |
medium | 5.3 | 0.0023 | 2026-10-29 | The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c com | |
CVE-2026-12345 |
medium | 5.9 | 0.0034 | 2026-10-29 | The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker | |
CVE-2024-31027 |
medium | 5.4 | 0.0026 | 2026-10-29 | Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platf | |
CVE-2026-97301 |
medium | 6.5 | 0.0017 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | |
CVE-2026-83589 |
medium | 6.1 | 0.0038 | 2026-10-29 | A flaw was found in oauth-proxy. The application fails to properly validate the destinatio | |
CVE-2026-105133 |
medium | 6.9 | 0.7947 | 2026-10-29 | KEV | Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote |
CVE-2026-104030 |
medium | 5.5 | 0.0012 | 2026-10-29 | A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Serv | |
CVE-2026-104031 |
medium | 5.5 | 0.0010 | 2026-10-29 | A flaw was found in SSSD. In configurations where the autofs responder service is enabled, | |
CVE-2026-104032 |
medium | 5.5 | 0.0010 | 2026-10-29 | A flaw was found in SSSD. An unprivileged local user can repeatedly request master automou | |
CVE-2026-106111 |
medium | 5.3 | 0.0028 | 2026-10-29 | ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCo | |
CVE-2026-106114 |
medium | 5.3 | 0.0033 | 2026-10-29 | ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing cal | |
CVE-2026-106116 |
medium | 5.3 | 0.0033 | 2026-10-29 | ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trust | |
CVE-2026-106456 |
medium | 6.5 | 0.0024 | 2026-10-29 | Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, th | |
CVE-2026-106458 |
medium | 6.5 | 0.0027 | 2026-10-29 | Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, th | |
CVE-2026-106460 |
medium | 6.8 | 0.0031 | 2026-10-29 | Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and | |
CVE-2026-106461 |
medium | 4.3 | 0.0019 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backst | |
CVE-2026-106462 |
medium | 6.4 | 0.0017 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder | |
CVE-2026-106463 |
medium | 5.4 | 0.0017 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backst | |
CVE-2026-106487 |
medium | 5.0 | 0.0026 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 0.21.10, the @back | |
CVE-2026-106489 |
medium | 6.5 | 0.0029 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backst | |
CVE-2026-106490 |
medium | 6.5 | 0.0037 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backst | |
CVE-2026-106491 |
medium | 6.4 | 0.0027 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backs | |
CVE-2026-106492 |
medium | 6.5 | 0.0021 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, | |
CVE-2026-106493 |
medium | 4.1 | 0.0028 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud stor | |
CVE-2026-106494 |
medium | 4.9 | 0.0031 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backs | |
CVE-2025-70515 |
medium | 6.1 | 0.0029 | 2026-10-29 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanit | |
CVE-2025-70519 |
medium | 6.1 | 0.0023 | 2026-10-29 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanit | |
CVE-2026-106564 |
medium | 5.3 | 0.0037 | 2026-10-29 | ImageMagick is free and open-source software used for editing and manipulating digital ima | |
CVE-2026-106566 |
medium | 4.4 | 0.0014 | 2026-10-29 | ImageMagick is free and open-source software used for editing and manipulating digital ima | |
CVE-2026-106568 |
medium | 5.3 | 0.0038 | 2026-10-29 | ImageMagick is free and open-source software used for editing and manipulating digital ima | |
CVE-2026-106437 |
medium | 5.9 | 0.0013 | 2026-10-29 | The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than t | |
CVE-2026-106438 |
medium | 5.1 | 0.0014 | 2026-10-29 | An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept c | |
CVE-2026-96563 |
medium | 6.4 | 0.0020 | 2026-10-29 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerabl | |
CVE-2026-109171 |
medium | 5.3 | 0.0020 | 2026-10-29 | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any aut | |
CVE-2026-109176 |
medium | 5.3 | 0.0022 | 2026-10-29 | MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allow | |
CVE-2026-109256 |
medium | 6.0 | 0.0031 | 2026-10-29 | FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data | |
CVE-2026-109287 |
medium | 5.3 | 0.0028 | 2026-10-29 | Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge bas | |
CVE-2026-109295 |
medium | 5.3 | 0.0033 | 2026-10-29 | Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulne | |
CVE-2026-109296 |
medium | 5.3 | 0.0034 | 2026-10-29 | Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authen | |
CVE-2026-109336 |
medium | 5.3 | 0.0022 | 2026-10-29 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record u |