Browse All CVEs
34,289 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-82854 |
critical | 9.3 | 0.0198 | 2026-10-29 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized en | |
CVE-2026-73051 |
medium | 6.3 | 0.0057 | 2026-10-29 | actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the H | |
CVE-2026-72831 |
high | 8.7 | 0.0086 | 2026-10-29 | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect aut | |
CVE-2026-72832 |
medium | 5.1 | 0.0031 | 2026-10-29 | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerabilit | |
CVE-2026-72825 |
high | 7.2 | 0.0035 | 2026-10-29 | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in t | |
CVE-2026-72826 |
high | 8.7 | 0.0047 | 2026-10-29 | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a ne | |
CVE-2026-72813 |
medium | 6.9 | 0.0049 | 2026-10-29 | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty | |
CVE-2026-67312 |
medium | 6.3 | 0.0052 | 2026-10-29 | axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled | |
CVE-2026-63308 |
medium | 5.3 | 0.0049 | 2026-10-29 | Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in | |
CVE-2026-61871 |
medium | 6.3 | 0.0035 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that | |
CVE-2026-61872 |
low | 2.0 | 0.0010 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when | |
CVE-2026-61869 |
low | 2.1 | 0.0010 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that | |
CVE-2026-61870 |
low | 2.1 | 0.0019 | 2026-10-29 | ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when | |
CVE-2026-61865 |
low | 2.1 | 0.0010 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the hough lines operat | |
CVE-2026-61868 |
medium | 6.3 | 0.0022 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV d | |
CVE-2026-61863 |
low | 2.1 | 0.0019 | 2026-10-29 | ImageMagick before 7.1.2-26 (and 6.x before 6.9.13-51) contains a memory leak in the TIFF | |
CVE-2026-61864 |
low | 2.1 | 0.0010 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation t | |
CVE-2026-61861 |
medium | 6.3 | 0.0055 | 2026-10-29 | ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCap | |
CVE-2026-61862 |
low | 2.1 | 0.0010 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains an information disclosure vulnerability | |
CVE-2026-61859 |
medium | 4.8 | 0.0017 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnera | |
CVE-2026-61860 |
medium | 6.3 | 0.0035 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a use-after-free vulnerability that occ | |
CVE-2026-61857 |
medium | 6.3 | 0.0027 | 2026-10-29 | ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing | |
CVE-2026-61858 |
medium | 4.8 | 0.0025 | 2026-10-29 | ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and | |
CVE-2026-61465 |
medium | 4.8 | 0.0017 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory alloca | |
CVE-2026-61464 |
low | 1.0 | 0.0009 | 2026-10-29 | ImageMagick before 7.1.2-26 and 6.9.13-51 contains a heap-based buffer over-write vulnerab | |
CVE-2026-58652 |
high | 7.7 | 0.0067 | 2026-10-29 | luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a Lu | |
CVE-2026-58660 |
high | 7.2 | 0.0050 | 2026-10-29 | Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used b | |
CVE-2026-56378 |
medium | 6.3 | 0.0039 | 2026-10-29 | ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read | |
CVE-2026-56379 |
critical | 9.2 | 0.0164 | 2026-10-29 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in th | |
CVE-2026-56369 |
medium | 6.3 | 0.0023 | 2026-10-29 | ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the Passke | |
CVE-2026-56370 |
medium | 4.8 | 0.0018 | 2026-10-29 | ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedCom | |
CVE-2026-56361 |
medium | 4.8 | 0.0013 | 2026-10-29 | ImageMagick before 7.1.2-19 contains an off-by-one error in morphology validation allowing | |
CVE-2026-56362 |
low | 2.1 | 0.0019 | 2026-10-29 | ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability in GetPixel | |
CVE-2026-55202 |
high | 8.8 | 0.0038 | 2026-10-29 | Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host hea | |
CVE-2026-40037 |
high | 7.1 | 0.0031 | 2026-10-29 | OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuar | |
CVE-2026-41401 |
medium | 6.9 | 0.0067 | 2026-10-29 | libyang before 5.4.3 contains a heap use-after-free write vulnerability in lyd_parser_set_ | |
CVE-2026-32989 |
high | 8.6 | 0.0022 | 2026-10-29 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allo | |
CVE-2026-35632 |
medium | 6.9 | 0.0042 | 2026-10-29 | OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and | |
CVE-2026-22185 |
medium | 4.6 | 0.0015 | 2026-10-29 | OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34, prior to c | |
CVE-2026-105215 |
critical | 9.3 | 0.0034 | 2026-10-29 | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hoste | |
CVE-2026-109266 |
medium | 6.9 | 0.0030 | 2026-10-29 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerabili | |
CVE-2026-105210 |
high | 8.8 | 0.0024 | 2026-10-29 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in | |
CVE-2026-105212 |
high | 8.7 | 0.0032 | 2026-10-29 | ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the h | |
CVE-2026-105208 |
high | 8.7 | 0.0008 | 2026-10-29 | ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthent | |
CVE-2026-105209 |
critical | 9.3 | 0.0022 | 2026-10-29 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnera | |
CVE-2026-105206 |
medium | 5.3 | 0.0028 | 2026-10-29 | ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization fla | |
CVE-2026-105207 |
critical | 9.3 | 0.0031 | 2026-10-29 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts a | |
CVE-2026-105081 |
low | 2.0 | 0.0011 | 2026-10-29 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symboli | |
CVE-2026-104436 |
medium | 6.3 | 0.0027 | 2026-10-29 | Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows | |
CVE-2026-100834 |
high | 8.2 | 0.0032 | 2026-10-29 | http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions |