Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-8811 |
high | 7.1 | 0.0032 | 2026-10-29 | SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during enc | |
CVE-2026-50643 |
medium | 5.1 | 0.0014 | 2026-10-29 | 8cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives an | |
CVE-2026-28573 |
critical | 10.0 | 0.0014 | 2026-10-29 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing | |
CVE-2026-55740 |
critical | 9.3 | 0.0028 | 2026-10-29 | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30 | |
CVE-2026-48768 |
critical | 9.3 | 0.0033 | 2026-10-29 | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-i | |
CVE-2026-48764 |
high | 8.2 | 0.0033 | 2026-10-29 | TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is impleme | |
CVE-2026-50268 |
low | 1.9 | 0.0005 | 2026-10-29 | Steeltoe is an open source project that provides a collection of libraries that helps user | |
CVE-2026-50267 |
medium | 4.7 | 0.0006 | 2026-10-29 | Steeltoe is an open source project that provides a collection of libraries that helps user | |
CVE-2026-48759 |
high | 7.1 | 0.0020 | 2026-10-29 | TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Objec | |
CVE-2026-45617 |
high | 7.5 | 0.0046 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-45357 |
high | 7.5 | 0.0039 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-44646 |
medium | 5.3 | 0.0033 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-44645 |
medium | 6.5 | 0.0039 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-44644 |
medium | 6.1 | 0.0025 | 2026-10-29 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. | |
CVE-2026-12568 |
medium | 6.5 | 0.0025 | 2026-10-29 | The postman_download module uses the workspace name field from the Postman API to construc | |
CVE-2026-12567 |
low | 2.2 | 0.0009 | 2026-10-29 | The github_workflows module constructs local directory paths from user-controlled reposito | |
CVE-2026-12566 |
low | 3.1 | 0.0017 | 2026-10-29 | The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate | |
CVE-2026-12565 |
medium | 5.3 | 0.0021 | 2026-10-29 | The unarchive internal module's archive extraction commands perform no code-level validati | |
CVE-2024-27928 |
medium | 5.9 | 0.0028 | 2026-10-29 | vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to versio | |
CVE-2024-24769 |
low | 2.1 | 0.0028 | 2026-10-29 | vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to versio | |
CVE-2026-8050 |
high | 7.5 | 0.0037 | 2026-10-29 | In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference t | |
CVE-2026-8049 |
medium | 5.3 | 0.0011 | 2026-10-29 | In SignalRGB versions prior to 1.3.7.0, the \\.\SignalIo device object is created without | |
CVE-2026-54386 |
medium | 5.1 | 0.0024 | 2026-10-29 | marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebo | |
CVE-2026-50196 |
high | 7.5 | 0.0045 | 2026-10-29 | Steeltoe is an open source project that provides a collection of libraries that helps user | |
CVE-2026-48997 |
high | 7.1 | 0.0095 | 2026-10-29 | e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command i | |
CVE-2026-48990 |
medium | 5.3 | 0.0024 | 2026-10-29 | joserfc is a Python library that provides an implementation of several JSON Object Signing | |
CVE-2026-48989 |
high | 8.9 | 0.0040 | 2026-10-29 | Windows-MCP is an open-source project that integrates AI agents with Windows. In versions | |
CVE-2026-12530 |
high | 8.4 | 0.0034 | 2026-10-29 | Improper neutralization of argument delimiters in the install_packages() method in AWS Bed | |
CVE-2026-55201 |
high | 7.4 | 0.0030 | 2026-10-29 | Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability i | |
CVE-2026-55200 |
critical | 9.2 | 0.0388 | 2026-10-29 | 3 PoC | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in |
CVE-2026-50107 |
high | 8.6 | 0.0049 | 2026-10-29 | When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fab | |
CVE-2026-48817 |
medium | 5.3 | 0.0021 | 2026-10-29 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispa | |
CVE-2026-48814 |
critical | 9.1 | 0.0044 | 2026-10-29 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier | |
CVE-2026-32682 |
high | 7.1 | 0.0029 | 2026-10-29 | When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacke | |
CVE-2026-12529 |
medium | 6.9 | 0.0028 | 2026-10-29 | A security vulnerability has been detected in SourceCodester CET Automated Grading System | |
CVE-2026-11407 |
high | 8.6 | 0.0062 | 2026-10-29 | Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authent | |
CVE-2026-10741 |
medium | 5.9 | 0.0027 | 2026-10-29 | Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in | |
CVE-2026-10696 |
high | 7.5 | 0.0027 | 2026-10-29 | Use of an incorrectly resolved name or reference in the pinget backend in Devolutions Uni | |
CVE-2026-55198 |
high | 7.1 | 0.0035 | 2026-10-29 | Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session | |
CVE-2026-55197 |
high | 7.1 | 0.0035 | 2026-10-29 | Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/se | |
CVE-2026-53871 |
high | 8.6 | 0.0037 | 2026-10-29 | Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_pro | |
CVE-2026-53870 |
medium | 6.8 | 0.0016 | 2026-10-29 | Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with w | |
CVE-2026-53869 |
high | 8.7 | 0.0059 | 2026-10-29 | Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints t | |
CVE-2026-48818 |
— | — | 0.0037 | 2026-10-29 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFi | |
CVE-2026-7300 |
high | 8.8 | 0.0025 | 2026-10-29 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RT | |
CVE-2026-53805 |
critical | 9.3 | 0.0087 | 2026-10-29 | 1 PoC | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code exec |
CVE-2026-48591 |
medium | 4.8 | 0.0013 | 2026-10-29 | Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave ea | |
CVE-2026-47774 |
— | — | 0.0097 | 2026-10-29 | Envoy is an open source edge and service proxy designed for cloud-native applications. Pri | |
CVE-2026-3894 |
critical | 9.2 | 0.0020 | 2026-10-29 | Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overr | |
CVE-2026-39199 |
low | 2.9 | 0.0013 | 2026-10-29 | snes9x 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file. |