Browse All CVEs
10,768 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-106493 |
medium | 4.1 | 0.0028 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud stor | |
CVE-2026-106494 |
medium | 4.9 | 0.0031 | 2026-10-29 | Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backs | |
CVE-2025-70515 |
medium | 6.1 | 0.0029 | 2026-10-29 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanit | |
CVE-2025-70519 |
medium | 6.1 | 0.0023 | 2026-10-29 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanit | |
CVE-2026-106564 |
medium | 5.3 | 0.0037 | 2026-10-29 | ImageMagick is free and open-source software used for editing and manipulating digital ima | |
CVE-2026-106566 |
medium | 4.4 | 0.0014 | 2026-10-29 | ImageMagick is free and open-source software used for editing and manipulating digital ima | |
CVE-2026-106568 |
medium | 5.3 | 0.0038 | 2026-10-29 | ImageMagick is free and open-source software used for editing and manipulating digital ima | |
CVE-2026-106437 |
medium | 5.9 | 0.0013 | 2026-10-29 | The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than t | |
CVE-2026-106438 |
medium | 5.1 | 0.0014 | 2026-10-29 | An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept c | |
CVE-2026-96563 |
medium | 6.4 | 0.0020 | 2026-10-29 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerabl | |
CVE-2026-109171 |
medium | 5.3 | 0.0020 | 2026-10-29 | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any aut | |
CVE-2026-109176 |
medium | 5.3 | 0.0022 | 2026-10-29 | MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allow | |
CVE-2026-109256 |
medium | 6.0 | 0.0031 | 2026-10-29 | FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data | |
CVE-2026-109287 |
medium | 5.3 | 0.0028 | 2026-10-29 | Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge bas | |
CVE-2026-109295 |
medium | 5.3 | 0.0033 | 2026-10-29 | Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulne | |
CVE-2026-109296 |
medium | 5.3 | 0.0034 | 2026-10-29 | Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authen | |
CVE-2026-109336 |
medium | 5.3 | 0.0022 | 2026-10-29 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record u | |
CVE-2026-109356 |
medium | 5.3 | 0.0019 | 2026-10-29 | LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController:: | |
CVE-2026-109366 |
medium | 6.3 | 0.0016 | 2026-10-29 | Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound | |
CVE-2025-27895 |
medium | 6.1 | 0.0016 | 2026-10-29 | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site s | |
CVE-2025-27896 |
medium | 6.1 | 0.0016 | 2026-10-29 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site s | |
CVE-2025-27897 |
medium | 6.1 | 0.0016 | 2026-10-29 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site s | |
CVE-2025-27902 |
medium | 6.1 | 0.0018 | 2026-10-29 | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untruste | |
CVE-2024-58389 |
medium | 5.1 | 0.0028 | 2026-10-29 | HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/aut | |
CVE-2026-109376 |
medium | 5.3 | 0.0025 | 2026-10-29 | ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the g | |
CVE-2026-109574 |
medium | 6.7 | 0.0014 | 2026-10-29 | Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malic | |
CVE-2026-84284 |
medium | 5.3 | 0.0022 | 2026-10-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19 | |
CVE-2026-109940 |
medium | 5.1 | 0.0014 | 2026-10-29 | FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based bu | |
CVE-2026-109966 |
medium | 6.9 | 0.0041 | 2026-10-29 | yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unaut | |
CVE-2024-34319 |
medium | 6.5 | 0.0027 | 2026-10-29 | A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v20 | |
CVE-2024-34321 |
medium | 6.1 | 0.0019 | 2026-10-29 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scrip | |
CVE-2024-34326 |
medium | 6.1 | 0.0019 | 2026-10-29 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scrip | |
CVE-2026-10759 |
medium | 5.5 | 0.0025 | 2026-10-29 | A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionalit | |
CVE-2026-110100 |
medium | 5.3 | 0.0022 | 2026-10-29 | Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() | |
CVE-2026-110105 |
medium | 6.9 | 0.0029 | 2026-10-29 | B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows un | |
CVE-2026-110110 |
medium | 5.3 | 0.0030 | 2026-10-29 | JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allo | |
CVE-2026-110122 |
medium | 5.3 | 0.0025 | 2026-10-29 | PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability t | |
CVE-2026-110127 |
medium | 5.3 | 0.0025 | 2026-10-29 | waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in | |
CVE-2026-23706 |
medium | 6.5 | 0.0034 | 2026-10-29 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vu | |
CVE-2026-102221 |
medium | 4.4 | 0.0036 | 2026-10-29 | No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a sec | |
CVE-2026-103567 |
medium | 5.5 | 0.0044 | 2026-10-29 | Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to di | |
CVE-2026-103576 |
medium | 6.5 | 0.0086 | 2026-10-29 | Url redirection to untrusted site ('open redirect') in Active Directory Federation Service | |
CVE-2026-103578 |
medium | 6.8 | 0.0046 | 2026-10-29 | Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate | |
CVE-2026-105006 |
medium | 6.4 | 0.0035 | 2026-10-29 | Use after free in HID class driver allows an unauthorized attacker to elevate privileges w | |
CVE-2026-108462 |
medium | 5.5 | 0.0089 | 2026-10-29 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kern | |
CVE-2026-108466 |
medium | 5.3 | 0.0070 | 2026-10-29 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over | |
CVE-2026-110210 |
medium | 6.0 | 0.0050 | 2026-10-29 | Phase Console through 2.77.3 contains a missing authorization vulnerability that allows or | |
CVE-2026-110225 |
medium | 5.1 | 0.0034 | 2026-10-29 | Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows au | |
CVE-2026-110231 |
medium | 5.6 | 0.0027 | 2026-10-29 | muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows | |
CVE-2026-110256 |
medium | 6.3 | 0.0037 | 2026-10-29 | Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth |