Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44663 |
high | 7.1 | 0.0021 | 2026-10-29 | OpenEXR is the reference implementation and specification for the EXR image format, widely | |
CVE-2026-56099 |
medium | 6.9 | 0.0050 | 2026-10-29 | OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in | |
CVE-2026-48983 |
medium | 5.8 | 0.0011 | 2026-10-29 | pam_usb provides hardware authentication for Linux using ordinary removable media. In vers | |
CVE-2026-48982 |
medium | 5.8 | 0.0012 | 2026-10-29 | pam_usb provides hardware authentication for Linux using ordinary removable media. In vers | |
CVE-2026-48981 |
medium | 6.7 | 0.0015 | 2026-10-29 | pam_usb provides hardware authentication for Linux using ordinary removable media. In vers | |
CVE-2026-48980 |
medium | 6.3 | 0.0018 | 2026-10-29 | pam_usb provides hardware authentication for Linux using removable media. In versions prio | |
CVE-2026-48716 |
high | 8.7 | 0.0033 | 2026-10-29 | nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge | |
CVE-2026-47847 |
medium | 5.3 | 0.0031 | 2026-10-29 | Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default | |
CVE-2026-47846 |
critical | 9.8 | 0.0048 | 2026-10-29 | Bitnami Cassandra container images are affected by a retained default superuser vulnerabil | |
CVE-2026-25865 |
high | 8.5 | 0.0020 | 2026-10-29 | Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability th | |
CVE-2026-9692 |
medium | 5.3 | 0.0042 | 2026-10-29 | Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecu | |
CVE-2026-55392 |
medium | 6.7 | 0.0015 | 2026-10-29 | NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails | |
CVE-2026-48937 |
high | 7.5 | 0.0057 | 2026-10-29 | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after se | |
CVE-2026-47833 |
medium | 6.9 | 0.0017 | 2026-10-29 | setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege esca | |
CVE-2026-12390 |
high | 8.4 | 0.0019 | 2026-10-29 | In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be expl | |
CVE-2026-54390 |
critical | 9.3 | 0.0060 | 2026-10-29 | 1 PoC | JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerabil |
CVE-2026-48986 |
medium | 4.7 | 0.0014 | 2026-10-29 | pam_usb provides hardware authentication for Linux using removable media. In pam_usb 0.9.1 | |
CVE-2026-48985 |
medium | 5.5 | 0.0016 | 2026-10-29 | pam_usb provides hardware authentication for Linux using ordinary removable media. In vers | |
CVE-2026-48984 |
medium | 4.7 | 0.0015 | 2026-10-29 | pam_usb provides hardware authentication for Linux using ordinary removable media. In vers | |
CVE-2026-56024 |
medium | 6.5 | 0.0018 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site | |
CVE-2026-55237 |
high | 8.8 | 0.0023 | 2026-10-29 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous | |
CVE-2026-55205 |
medium | 6.9 | 0.0052 | 2026-10-29 | Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthent | |
CVE-2026-55204 |
high | 8.7 | 0.0048 | 2026-10-29 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulne | |
CVE-2026-55203 |
critical | 9.0 | 0.0033 | 2026-10-29 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability | |
CVE-2026-48617 |
high | 8.2 | 0.0032 | 2026-10-29 | A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeRepo | |
CVE-2026-11982 |
medium | 5.1 | 0.0038 | 2026-10-29 | Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulne | |
CVE-2026-46580 |
high | 8.4 | 0.0051 | 2026-10-29 | In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttem | |
CVE-2026-44691 |
high | 8.4 | 0.0041 | 2026-10-29 | In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g | |
CVE-2026-44688 |
high | 8.4 | 0.0051 | 2026-10-29 | In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and | |
CVE-2026-22551 |
medium | 6.7 | 0.0031 | 2026-10-29 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from A | |
CVE-2026-9158 |
medium | 5.2 | 0.0060 | 2026-10-29 | In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection comm | |
CVE-2026-56012 |
high | 8.5 | 0.0036 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-56009 |
medium | 5.9 | 0.0014 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-56007 |
medium | 5.9 | 0.0014 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-54419 |
critical | 9.3 | 0.0148 | 2026-10-29 | claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, la | |
CVE-2026-54224 |
high | 7.1 | 0.0027 | 2026-10-29 | UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent reque | |
CVE-2026-54223 |
high | 8.6 | 0.0063 | 2026-10-29 | UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit tem | |
CVE-2026-54222 |
high | 8.6 | 0.0031 | 2026-10-29 | UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access to the Me | |
CVE-2026-54221 |
medium | 5.1 | 0.0029 | 2026-10-29 | UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input | |
CVE-2026-54220 |
high | 8.6 | 0.0019 | 2026-10-29 | uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protecti | |
CVE-2026-54219 |
medium | 5.1 | 0.0029 | 2026-10-29 | UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The applic | |
CVE-2026-50141 |
high | 7.1 | 0.0043 | 2026-10-29 | Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vul | |
CVE-2026-44942 |
medium | 6.5 | 0.0042 | 2026-10-29 | A path traversal in handling the "path" component of .repo files processed by libzypp befo | |
CVE-2026-12539 |
medium | 5.7 | 0.0014 | 2026-10-29 | Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creat | |
CVE-2026-12527 |
medium | 6.0 | 0.0022 | 2026-10-29 | A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian C | |
CVE-2026-12039 |
medium | 5.7 | 0.0010 | 2026-10-29 | Docker Sandboxes (sbx) enforces an HTTP/S-only egress allowlist but does not apply it to D | |
CVE-2026-11958 |
high | 7.3 | 0.0010 | 2026-10-29 | Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DF | |
CVE-2026-11719 |
high | 8.6 | 0.0014 | 2026-10-29 | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases du | |
CVE-2026-11718 |
critical | 9.3 | 0.0019 | 2026-10-29 | An authentication bypass vulnerability exists in the generic opaque token validation path | |
CVE-2026-11717 |
critical | 9.3 | 0.0018 | 2026-10-29 | An authentication bypass vulnerability exists in the generic opaque token validation path |