Browse All CVEs
49,628 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-49983 |
medium | 5.2 | 0.0014 | 2026-10-29 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment acc | |
CVE-2026-50221 |
medium | 5.3 | 0.0022 | 2026-10-29 | In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-C | |
CVE-2026-52844 |
high | 7.5 | 0.0062 | 2026-10-29 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windo | |
CVE-2026-52845 |
— | — | 0.0044 | 2026-10-29 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_ | |
CVE-2026-53662 |
critical | 9.6 | 0.0030 | 2026-10-29 | immich is a high performance self-hosted photo and video management solution. From commit | |
CVE-2026-54316 |
medium | 6.0 | 0.0052 | 2026-10-29 | Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname hu | |
CVE-2026-54317 |
high | 7.6 | 0.0031 | 2026-10-29 | Home Assistant is open source home automation software that puts local control and privacy | |
CVE-2026-54318 |
high | 7.1 | 0.0017 | 2026-10-29 | Home Assistant is open source home automation software that puts local control and privacy | |
CVE-2026-54323 |
medium | 5.9 | 0.0019 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-54324 |
medium | 6.5 | 0.0046 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-55517 |
medium | 4.3 | 0.0032 | 2026-10-29 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program | |
CVE-2026-57053 |
low | 2.5 | 0.0014 | 2026-10-29 | GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUn | |
CVE-2026-53753 |
critical | 10.0 | 0.0290 | 2026-10-29 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_e | |
CVE-2026-53754 |
high | 7.5 | 0.0043 | 2026-10-29 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker | |
CVE-2026-53755 |
high | 7.5 | 0.0158 | 2026-10-29 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker | |
CVE-2026-54319 |
medium | 4.2 | 0.0024 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-54320 |
high | 8.4 | 0.0035 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-54321 |
high | 7.0 | 0.0040 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-54322 |
high | 7.7 | 0.0030 | 2026-10-29 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and | |
CVE-2026-55249 |
high | 8.8 | 0.0055 | 2026-10-29 | @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec too | |
CVE-2026-55736 |
medium | 5.9 | 0.0022 | 2026-10-29 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerabili | |
CVE-2026-39253 |
high | 8.1 | 0.0072 | 2026-10-29 | An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via | |
CVE-2026-45792 |
medium | 6.9 | 0.0011 | 2026-10-29 | rtk filters and compresses command outputs before they reach your LLM context. Prior to 0. | |
CVE-2026-54325 |
medium | 4.4 | 0.0016 | 2026-10-29 | Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configurati | |
CVE-2026-54326 |
low | 2.5 | 0.0017 | 2026-10-29 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render | |
CVE-2026-54327 |
low | 2.2 | 0.0009 | 2026-10-29 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and | |
CVE-2026-54328 |
high | 7.3 | 0.0016 | 2026-10-29 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with tempor | |
CVE-2026-54555 |
high | 7.8 | 0.0020 | 2026-10-29 | rtk filters and compresses command outputs before they reach your LLM context. Prior to 0. | |
CVE-2026-12112 |
— | — | 0.0022 | 2026-10-29 | A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP | |
CVE-2026-41862 |
high | 8.8 | 0.0076 | 2026-10-29 | Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) | |
CVE-2026-50193 |
medium | 6.3 | 0.0062 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54512 |
high | 8.1 | 0.0107 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54513 |
— | — | 0.0123 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54514 |
medium | 5.3 | 0.0037 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54515 |
medium | 5.3 | 0.0044 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54516 |
medium | 5.3 | 0.0045 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54517 |
medium | 5.3 | 0.0038 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-54518 |
medium | 6.5 | 0.0035 | 2026-10-29 | jackson-databind contains the general-purpose data-binding functionality and tree-model fo | |
CVE-2026-11972 |
high | 8.2 | 0.0072 | 2026-10-29 | When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tar | |
CVE-2026-12163 |
medium | 4.8 | 0.0024 | 2026-10-29 | Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9. | |
CVE-2026-12164 |
medium | 4.4 | 0.0014 | 2026-10-29 | Fortra File Integrity Monitoring (FIM), formerly Tripwire Enterprise, versions prior to 9. | |
CVE-2026-48493 |
medium | 5.5 | 0.0031 | 2026-10-29 | Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with | |
CVE-2026-5818 |
high | 7.2 | 0.0024 | 2026-10-29 | Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwa | |
CVE-2026-6458 |
medium | 5.1 | 0.0020 | 2026-10-29 | Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results i | |
CVE-2026-7574 |
high | 8.7 | 0.0011 | 2026-10-29 | Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2 | |
CVE-2026-54639 |
high | 8.8 | 0.0036 | 2026-10-29 | Style Dictionary, a build system for creating cross-platform styles, has a prototype pollu | |
CVE-2026-12681 |
high | 8.9 | 0.0027 | 2026-10-29 | Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Goog | |
CVE-2026-12485 |
critical | 10.0 | 0.0060 | 2026-10-29 | GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be cont | |
CVE-2026-12486 |
critical | 9.1 | 0.0270 | 2026-10-29 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-12488 |
medium | 6.2 | 0.0034 | 2026-10-29 | A memory corruption vulnerability exists in the GV-Cloud functionality of GeoVision GV-VMS |