Browse All CVEs
50,443 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-50008 |
medium | 6.9 | 0.0034 | 2026-10-29 | Parse Server is an open source backend that can be deployed to any infrastructure that can | |
CVE-2026-47248 |
medium | 6.9 | 0.0029 | 2026-10-29 | Parse Server is an open source backend that can be deployed to any infrastructure that can | |
CVE-2026-47138 |
high | 8.7 | 0.0058 | 2026-10-29 | Parse Server is an open source backend that can be deployed to any infrastructure that can | |
CVE-2026-12043 |
high | 8.7 | 0.0035 | 2026-10-29 | Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http | |
CVE-2026-53406 |
high | 7.8 | 0.0008 | 2026-10-29 | Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center f | |
CVE-2026-48165 |
high | 7.2 | 0.0151 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to befo | |
CVE-2026-48163 |
high | 7.2 | 0.0091 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to befo | |
CVE-2026-47965 |
high | 7.8 | 0.0015 | 2026-10-29 | Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an out-of-b | |
CVE-2026-47223 |
medium | 5.4 | 0.0022 | 2026-10-29 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3 | |
CVE-2026-44173 |
medium | 5.3 | 0.0062 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to befo | |
CVE-2026-44172 |
medium | 6.9 | 0.0104 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8 | |
CVE-2026-44171 |
high | 7.8 | 0.0019 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to befo | |
CVE-2026-44170 |
medium | 6.3 | 0.0133 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to befo | |
CVE-2026-44169 |
medium | 4.3 | 0.0024 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to befo | |
CVE-2026-44168 |
— | — | 0.0059 | 2026-10-29 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to befo | |
CVE-2026-53982 |
high | 7.1 | 0.0033 | 2026-10-29 | Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletio | |
CVE-2026-47224 |
medium | 4.3 | 0.0019 | 2026-10-29 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3 | |
CVE-2026-47222 |
medium | 5.4 | 0.0017 | 2026-10-29 | NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3 | |
CVE-2026-3840 |
high | 7.1 | 0.0019 | 2026-10-29 | A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by pro | |
CVE-2026-9641 |
medium | 5.3 | 0.0023 | 2026-10-29 | Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number o | |
CVE-2026-9638 |
high | 7.5 | 0.0031 | 2026-10-29 | Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. | |
CVE-2026-8828 |
high | 8.8 | 0.0028 | 2026-10-29 | A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project | |
CVE-2026-5792 |
medium | 6.5 | 0.0021 | 2026-10-29 | Authentication bypass by spoofing vulnerability in Hedef Media Promotion Interactive Media | |
CVE-2026-50091 |
high | 7.4 | 0.0029 | 2026-10-29 | Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the | |
CVE-2026-50090 |
medium | 6.1 | 0.0025 | 2026-10-29 | The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulner | |
CVE-2026-50089 |
medium | 6.1 | 0.0020 | 2026-10-29 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an in | |
CVE-2026-50087 |
medium | 6.1 | 0.0020 | 2026-10-29 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing v | |
CVE-2026-50086 |
critical | 9.8 | 0.0029 | 2026-10-29 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups aga | |
CVE-2026-50085 |
critical | 9.8 | 0.0041 | 2026-10-29 | The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and f | |
CVE-2026-50084 |
medium | 6.5 | 0.0024 | 2026-10-29 | The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid | |
CVE-2026-50083 |
critical | 9.8 | 0.0036 | 2026-10-29 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, | |
CVE-2026-50082 |
medium | 5.3 | 0.0027 | 2026-10-29 | The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any ema | |
CVE-2026-47190 |
medium | 4.4 | 0.0033 | 2026-10-29 | IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, | |
CVE-2026-46690 |
medium | 5.8 | 0.0013 | 2026-10-29 | unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and pr | |
CVE-2026-45833 |
critical | 9.4 | 0.0043 | 2026-10-29 | A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project a | |
CVE-2026-45832 |
high | 8.8 | 0.0028 | 2026-10-29 | All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant an | |
CVE-2026-45831 |
high | 8.8 | 0.0024 | 2026-10-29 | The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of t | |
CVE-2026-45830 |
high | 8.8 | 0.0034 | 2026-10-29 | A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python proje | |
CVE-2026-44967 |
medium | 5.3 | 0.0021 | 2026-10-29 | OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the | |
CVE-2026-8694 |
medium | 5.3 | 0.0022 | 2026-10-29 | Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an | |
CVE-2026-6853 |
critical | 9.8 | 0.0035 | 2026-10-29 | Improper restriction of excessive authentication attempts vulnerability in Başbelen Group | |
CVE-2026-6211 |
high | 8.7 | 0.0021 | 2026-10-29 | Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Ser | |
CVE-2026-54133 |
critical | 9.8 | 0.0044 | 2026-10-29 | jmespath.php allows users to use JMESPath, software for declaratively specifying how to ex | |
CVE-2026-53787 |
critical | 9.3 | 0.0564 | 2026-10-29 | Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arb | |
CVE-2026-47210 |
critical | 9.8 | 0.0172 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vu | |
CVE-2026-47209 |
high | 8.6 | 0.0029 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set | |
CVE-2026-47208 |
critical | 10.0 | 0.0104 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a | |
CVE-2026-47141 |
medium | 6.9 | 0.0038 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some | |
CVE-2026-47140 |
critical | 10.0 | 0.0098 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks sever | |
CVE-2026-47139 |
high | 8.6 | 0.0036 | 2026-10-29 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports exc |