Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-50519 |
medium | 6.5 | 0.0092 | 2026-10-29 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio | |
CVE-2026-49346 |
high | 7.1 | 0.0037 | 2026-10-29 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.1.0 | |
CVE-2026-49337 |
medium | 4.3 | 0.0024 | 2026-10-29 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.2 | |
CVE-2026-49295 |
high | 7.1 | 0.0034 | 2026-10-29 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.2 | |
CVE-2026-48584 |
critical | 9.9 | 0.0091 | 2026-10-29 | Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to el | |
CVE-2026-48582 |
critical | 9.6 | 0.0069 | 2026-10-29 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevat | |
CVE-2026-48129 |
medium | 6.5 | 0.0036 | 2026-10-29 | Kestra is an open-source, event-driven orchestration platform. Prior to versions 1.3.19, 1 | |
CVE-2026-47645 |
high | 8.8 | 0.0076 | 2026-10-29 | Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Ch | |
CVE-2026-45480 |
critical | 10.0 | 0.0090 | 2026-10-29 | Improper authentication in Azure Active Directory allows an unauthorized attacker to eleva | |
CVE-2026-42895 |
medium | 6.5 | 0.0071 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in Mic | |
CVE-2026-32208 |
high | 8.8 | 0.0052 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-49345 |
medium | 5.3 | 0.0063 | 2026-10-29 | Mercator is an open source web application that enables mapping of the information system. | |
CVE-2026-49344 |
high | 7.1 | 0.0038 | 2026-10-29 | Mercator is an open source web application that enables mapping of the information system. | |
CVE-2026-49342 |
medium | 5.3 | 0.0033 | 2026-10-29 | YARD is a documentation generation tool for the Ruby programming language. Prior to versio | |
CVE-2026-48787 |
high | 7.4 | 0.0059 | 2026-10-29 | gin-vue-admin is an AI-assisted basic development platform. In version 2.9.1, an authentic | |
CVE-2026-48774 |
high | 7.5 | 0.0039 | 2026-10-29 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 thro | |
CVE-2026-48773 |
critical | 9.8 | 0.0069 | 2026-10-29 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 throug | |
CVE-2026-48772 |
critical | 10.0 | 0.0023 | 2026-10-29 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 thro | |
CVE-2026-48715 |
high | 7.7 | 0.0033 | 2026-10-29 | radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the `radvdump` uti | |
CVE-2026-48089 |
high | 7.1 | 0.0036 | 2026-10-29 | DevGuard provides vulnerability management for the full software supply chain. Prior to 1. | |
CVE-2026-49340 |
high | 8.1 | 0.0031 | 2026-10-29 | gonic is a music streaming server / free-software subsonic server API implementation. Prio | |
CVE-2026-49339 |
high | 7.1 | 0.0031 | 2026-10-29 | gonic is a music streaming server / free-software subsonic server API implementation. The | |
CVE-2026-49338 |
high | 7.1 | 0.0029 | 2026-10-29 | gonic is a music streaming server / free-software subsonic server API implementation. Prio | |
CVE-2026-49336 |
medium | 5.5 | 0.0075 | 2026-10-29 | @microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API c | |
CVE-2026-49293 |
high | 7.5 | 0.0064 | 2026-10-29 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Version | |
CVE-2026-49291 |
high | 8.1 | 0.0049 | 2026-10-29 | mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65. | |
CVE-2026-49288 |
medium | 4.3 | 0.0027 | 2026-10-29 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 an | |
CVE-2026-12726 |
medium | 6.3 | 0.0033 | 2026-10-29 | A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_reques | |
CVE-2023-54357 |
high | 8.7 | 0.0066 | 2026-10-29 | Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that a | |
CVE-2026-49359 |
medium | 6.5 | 0.0042 | 2026-10-29 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior t | |
CVE-2026-49290 |
high | 7.6 | 0.0083 | 2026-10-29 | Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksm | |
CVE-2026-49287 |
high | 7.4 | 0.0046 | 2026-10-29 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 an | |
CVE-2026-49286 |
high | 8.1 | 0.0073 | 2026-10-29 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior t | |
CVE-2026-49271 |
medium | 6.5 | 0.0036 | 2026-10-29 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.1, the u | |
CVE-2026-49260 |
high | 8.2 | 0.0021 | 2026-10-29 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior t | |
CVE-2026-12622 |
medium | 5.3 | 0.0021 | 2026-10-29 | The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password chan | |
CVE-2026-12621 |
medium | 5.3 | 0.0023 | 2026-10-29 | Improper neutralization of input during web page generation XSS vulnerability in the Grid | |
CVE-2026-12620 |
medium | 4.6 | 0.0039 | 2026-10-29 | The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some en | |
CVE-2026-12619 |
medium | 5.1 | 0.0023 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting' | |
CVE-2026-49358 |
low | 3.0 | 0.0017 | 2026-10-29 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior t | |
CVE-2026-21768 |
medium | 6.3 | 0.0016 | 2026-10-29 | The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text em | |
CVE-2026-4027 |
high | 7.1 | 0.0035 | 2026-10-29 | A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 and R2 that | |
CVE-2026-4026 |
high | 8.7 | 0.0035 | 2026-10-29 | A security vulnerability has been identified in FlexNet Manager Suite 2025 R1 that could a | |
CVE-2026-49872 |
medium | 5.3 | 0.0053 | 2026-10-29 | Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used | |
CVE-2026-49871 |
low | 2.1 | 0.0035 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default confi | |
CVE-2026-49357 |
high | 8.8 | 0.0056 | 2026-10-29 | Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-serv | |
CVE-2026-49231 |
low | 2.3 | 0.0057 | 2026-10-29 | Authentication Bypass by Spoofing vulnerability in opa plugin. An attacker could relay sp | |
CVE-2026-49230 |
medium | 6.3 | 0.0030 | 2026-10-29 | Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decr | |
CVE-2026-48895 |
low | 2.1 | 0.0065 | 2026-10-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The a | |
CVE-2026-47341 |
medium | 6.3 | 0.0069 | 2026-10-29 | Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can bene |