Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-47339 |
medium | 5.3 | 0.0047 | 2026-10-29 | Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on aut | |
CVE-2026-44915 |
low | 2.1 | 0.0064 | 2026-10-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The d | |
CVE-2026-44087 |
medium | 5.3 | 0.0028 | 2026-10-29 | Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid | |
CVE-2026-44046 |
low | 2.3 | 0.0047 | 2026-10-29 | Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of | |
CVE-2026-39999 |
high | 7.0 | 0.0063 | 2026-10-29 | Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can comple | |
CVE-2026-39998 |
medium | 5.8 | 0.0068 | 2026-10-29 | Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage | |
CVE-2026-12104 |
high | 8.6 | 0.0132 | 2026-10-29 | OS command injection in the environment and tunnel configuration functionality in SIMA Gmb | |
CVE-2026-56142 |
high | 8.8 | 0.0062 | 2026-10-29 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3. | |
CVE-2026-56141 |
critical | 9.8 | 0.0052 | 2026-10-29 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3. | |
CVE-2026-53915 |
high | 8.8 | 0.0045 | 2026-10-29 | In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted proje | |
CVE-2026-50242 |
critical | 9.8 | 0.0061 | 2026-10-29 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3. | |
CVE-2026-44939 |
critical | 9.4 | 0.0128 | 2026-10-29 | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endp | |
CVE-2026-11941 |
medium | 5.6 | 0.0025 | 2026-10-29 | Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID it | |
CVE-2026-8296 |
medium | 5.6 | 0.0032 | 2026-10-29 | In affected versions of Octopus Server with certain access levels it was possible to embed | |
CVE-2026-56138 |
medium | 5.3 | 0.0051 | 2026-10-29 | AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. | |
CVE-2026-41156 |
high | 7.7 | 0.0016 | 2026-10-29 | Software installed and run as a non-privileged user may conduct improper GPU system calls | |
CVE-2026-34192 |
high | 7.7 | 0.0016 | 2026-10-29 | Software installed and run as a non-privileged user may conduct improper GPU system calls | |
CVE-2026-11576 |
high | 7.5 | 0.0046 | 2026-10-29 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in | |
CVE-2026-46461 |
high | 7.8 | 0.0014 | 2026-10-29 | Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control | |
CVE-2026-56132 |
medium | 6.9 | 0.0016 | 2026-10-29 | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c | |
CVE-2026-56131 |
medium | 4.9 | 0.0018 | 2026-10-29 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from | |
CVE-2026-54414 |
critical | 9.3 | 0.0066 | 2026-10-29 | FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoin | |
CVE-2026-11752 |
medium | 5.9 | 0.0032 | 2026-10-29 | A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where D | |
CVE-2026-10720 |
medium | 5.1 | 0.0030 | 2026-10-29 | Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path tr | |
CVE-2026-8806 |
high | 8.7 | 0.0064 | 2026-10-29 | Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-EN | |
CVE-2026-8805 |
high | 8.7 | 0.0064 | 2026-10-29 | Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Ele | |
CVE-2026-52866 |
high | 7.1 | 0.0035 | 2026-10-29 | An attacker within BLE communication range can monopolize the device's only available BLE | |
CVE-2026-50034 |
high | 7.1 | 0.0021 | 2026-10-29 | An attacker within BLE communication range can passively intercept wireless traffic and o | |
CVE-2026-12050 |
medium | 5.3 | 0.0043 | 2026-10-29 | SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_po | |
CVE-2026-12049 |
medium | 5.3 | 0.0038 | 2026-10-29 | Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and regist | |
CVE-2026-12048 |
critical | 9.3 | 0.0027 | 2026-10-29 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. | |
CVE-2026-12047 |
medium | 4.8 | 0.0022 | 2026-10-29 | HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, reg | |
CVE-2026-12046 |
critical | 9.5 | 0.0104 | 2026-10-29 | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/clos | |
CVE-2026-12045 |
critical | 9.4 | 0.0066 | 2026-10-29 | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can infl | |
CVE-2026-12044 |
high | 8.7 | 0.0071 | 2026-10-29 | SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS ' | |
CVE-2026-56074 |
medium | 6.8 | 0.0018 | 2026-10-29 | PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocati | |
CVE-2026-8668 |
low | 2.3 | 0.0027 | 2026-10-29 | A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access | |
CVE-2026-8100 |
high | 8.6 | 0.0055 | 2026-10-29 | Impact A security issue has been identified in Chef 360 that could allow unauthorized acc | |
CVE-2026-54130 |
critical | 9.8 | 0.0108 | 2026-10-29 | Missing authentication for critical function in M365 Copilot allows an unauthorized attack | |
CVE-2026-49205 |
medium | 6.5 | 0.0039 | 2026-10-29 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Auth | |
CVE-2026-47647 |
critical | 9.9 | 0.0078 | 2026-10-29 | Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate | |
CVE-2026-47633 |
high | 7.5 | 0.0103 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Cost Management Interactive | |
CVE-2026-32174 |
high | 7.7 | 0.0077 | 2026-10-29 | Improper authentication in Azure Bot Service allows an authorized attacker to elevate priv | |
CVE-2026-22674 |
medium | 4.8 | 0.0031 | 2026-10-29 | Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site sc | |
CVE-2026-49454 |
critical | 9.1 | 0.0023 | 2026-10-29 | Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Ve | |
CVE-2026-49257 |
critical | 10.0 | 0.0062 | 2026-10-29 | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apach | |
CVE-2026-49252 |
critical | 9.9 | 0.0047 | 2026-10-29 | deepstream is a server that allows clients and backend services to sync data, send message | |
CVE-2026-49248 |
high | 8.3 | 0.0057 | 2026-10-29 | OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, Tar | |
CVE-2026-46699 |
high | 7.6 | 0.0033 | 2026-10-29 | conda-smithy is a tool for combining a conda recipe with configurations to build using fre | |
CVE-2026-45696 |
high | 8.3 | 0.0042 | 2026-10-29 | OpenEXR is the reference implementation and specification for the EXR image format, widely |