Browse All CVEs
10,793 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-109574 |
medium | 6.7 | 0.0014 | 2026-10-29 | Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malic | |
CVE-2026-84284 |
medium | 5.3 | 0.0022 | 2026-10-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19 | |
CVE-2026-109940 |
medium | 5.1 | 0.0014 | 2026-10-29 | FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based bu | |
CVE-2026-109966 |
medium | 6.9 | 0.0041 | 2026-10-29 | yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unaut | |
CVE-2024-34319 |
medium | 6.5 | 0.0027 | 2026-10-29 | A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v20 | |
CVE-2024-34321 |
medium | 6.1 | 0.0019 | 2026-10-29 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scrip | |
CVE-2024-34326 |
medium | 6.1 | 0.0019 | 2026-10-29 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scrip | |
CVE-2026-10759 |
medium | 5.5 | 0.0025 | 2026-10-29 | A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionalit | |
CVE-2026-110100 |
medium | 5.3 | 0.0022 | 2026-10-29 | Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() | |
CVE-2026-110105 |
medium | 6.9 | 0.0029 | 2026-10-29 | B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows un | |
CVE-2026-110110 |
medium | 5.3 | 0.0030 | 2026-10-29 | JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allo | |
CVE-2026-110122 |
medium | 5.3 | 0.0025 | 2026-10-29 | PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability t | |
CVE-2026-110127 |
medium | 5.3 | 0.0025 | 2026-10-29 | waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in | |
CVE-2026-23706 |
medium | 6.5 | 0.0034 | 2026-10-29 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vu | |
CVE-2026-102221 |
medium | 4.4 | 0.0036 | 2026-10-29 | No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a sec | |
CVE-2026-103567 |
medium | 5.5 | 0.0044 | 2026-10-29 | Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to di | |
CVE-2026-103576 |
medium | 6.5 | 0.0086 | 2026-10-29 | Url redirection to untrusted site ('open redirect') in Active Directory Federation Service | |
CVE-2026-103578 |
medium | 6.8 | 0.0046 | 2026-10-29 | Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate | |
CVE-2026-105006 |
medium | 6.4 | 0.0035 | 2026-10-29 | Use after free in HID class driver allows an unauthorized attacker to elevate privileges w | |
CVE-2026-108462 |
medium | 5.5 | 0.0089 | 2026-10-29 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kern | |
CVE-2026-108466 |
medium | 5.3 | 0.0070 | 2026-10-29 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over | |
CVE-2026-110210 |
medium | 6.0 | 0.0050 | 2026-10-29 | Phase Console through 2.77.3 contains a missing authorization vulnerability that allows or | |
CVE-2026-110225 |
medium | 5.1 | 0.0034 | 2026-10-29 | Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows au | |
CVE-2026-110231 |
medium | 5.6 | 0.0027 | 2026-10-29 | muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows | |
CVE-2026-110256 |
medium | 6.3 | 0.0037 | 2026-10-29 | Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth | |
CVE-2026-59116 |
medium | 6.8 | 0.0040 | 2026-10-29 | Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unaut | |
CVE-2026-62687 |
medium | 5.5 | 0.0050 | 2026-10-29 | Improper link resolution before file access ('link following') in Windows Backup Engine al | |
CVE-2026-62879 |
medium | 5.5 | 0.0034 | 2026-10-29 | Missing authentication for critical function in Windows SmartScreen allows an authorized a | |
CVE-2026-66822 |
medium | 5.9 | 0.0078 | 2026-10-29 | Insertion of sensitive information into sent data in .NET allows an unauthorized attacker | |
CVE-2026-69506 |
medium | 4.7 | 0.0035 | 2026-10-29 | Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclo | |
CVE-2026-69635 |
medium | 6.6 | 0.0047 | 2026-10-29 | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate p | |
CVE-2026-69640 |
medium | 5.3 | 0.0069 | 2026-10-29 | Incorrect authorization in Windows Key Distribution Center allows an authorized attacker t | |
CVE-2026-69644 |
medium | 5.5 | 0.0093 | 2026-10-29 | Exposure of sensitive system information to an unauthorized control sphere in Windows iSCS | |
CVE-2026-69968 |
medium | 6.5 | 0.0086 | 2026-10-29 | Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform t | |
CVE-2026-69969 |
medium | 4.7 | 0.0037 | 2026-10-29 | Improper link resolution before file access ('link following') in Windows AppX Deployment | |
CVE-2026-69971 |
medium | 5.5 | 0.0040 | 2026-10-29 | Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to di | |
CVE-2026-69973 |
medium | 6.5 | 0.0078 | 2026-10-29 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows | |
CVE-2026-69974 |
medium | 4.7 | 0.0032 | 2026-10-29 | Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose inf | |
CVE-2026-69978 |
medium | 5.6 | 0.0039 | 2026-10-29 | Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service | |
CVE-2026-69979 |
medium | 5.5 | 0.0038 | 2026-10-29 | Improper protection of alternate path in Windows AppX Deployment Service allows an authori | |
CVE-2026-69982 |
medium | 5.9 | 0.0065 | 2026-10-29 | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized | |
CVE-2026-70005 |
medium | 5.9 | 0.0063 | 2026-10-29 | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized | |
CVE-2026-70011 |
medium | 5.5 | 0.0046 | 2026-10-29 | Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker to disclos | |
CVE-2026-70055 |
medium | 5.5 | 0.0093 | 2026-10-29 | Exposure of sensitive system information to an unauthorized control sphere in Windows Cryp | |
CVE-2026-70057 |
medium | 5.5 | 0.0032 | 2026-10-29 | Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an auth | |
CVE-2026-70063 |
medium | 4.7 | 0.0035 | 2026-10-29 | Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information | |
CVE-2026-70072 |
medium | 6.5 | 0.0123 | 2026-10-29 | Allocation of resources without limits or throttling in Windows Netlogon allows an authori | |
CVE-2026-70075 |
medium | 4.4 | 0.0031 | 2026-10-29 | Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security | |
CVE-2026-70077 |
medium | 4.7 | 0.0035 | 2026-10-29 | Use after free in Windows Kernel allows an authorized attacker to disclose information loc | |
CVE-2026-70084 |
medium | 5.5 | 0.0050 | 2026-10-29 | Improper access control in Windows Projected File System allows an authorized attacker to |