Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42096 |
high | 8.7 | 0.0060 | 2026-10-29 | Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with th | |
CVE-2026-7860 |
low | 1.6 | 0.0012 | 2026-10-29 | A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaad | |
CVE-2026-7571 |
high | 7.1 | 0.0042 | 2026-10-29 | A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and | |
CVE-2026-7507 |
— | — | 0.0084 | 2026-10-29 | A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unaut | |
CVE-2026-7504 |
— | — | 0.0064 | 2026-10-29 | A flaw was found in Keycloak's URL validation logic during redirect operations. By craftin | |
CVE-2026-7307 |
— | — | 0.0088 | 2026-10-29 | A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially craf | |
CVE-2026-4630 |
medium | 6.8 | 0.0030 | 2026-10-29 | A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Obj | |
CVE-2026-45442 |
medium | 4.3 | 0.0024 | 2026-10-29 | Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting In | |
CVE-2026-37982 |
medium | 6.8 | 0.0044 | 2026-10-29 | A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker t | |
CVE-2026-37981 |
medium | 4.3 | 0.0037 | 2026-10-29 | A flaw was found in Keycloak. A broken access control vulnerability in the Account Resourc | |
CVE-2026-37979 |
medium | 6.5 | 0.0037 | 2026-10-29 | A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Conne | |
CVE-2026-37978 |
medium | 4.9 | 0.0043 | 2026-10-29 | A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role c | |
CVE-2026-8827 |
high | 8.2 | 0.0033 | 2026-10-29 | The AddressRepository::getSqlQuery() method constructs a database query without properly s | |
CVE-2026-8727 |
high | 7.1 | 0.0039 | 2026-10-29 | The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs direct | |
CVE-2026-8726 |
high | 8.2 | 0.0044 | 2026-10-29 | The extension fails to properly sanitize user input before using it in a database query. A | |
CVE-2026-46725 |
critical | 9.2 | 0.0262 | 2026-10-29 | The extension passes an attacker-controlled cookie directly to PHP's unserialize() without | |
CVE-2026-46724 |
medium | 5.9 | 0.0040 | 2026-10-29 | The file indexer does not normalize the configured directory path. A backend user with per | |
CVE-2026-46723 |
medium | 5.9 | 0.0032 | 2026-10-29 | The additional_tables configuration of the page and tt_content indexers accepts arbitrary | |
CVE-2026-46722 |
medium | 5.9 | 0.0030 | 2026-10-29 | The OOXML parsing of the file indexer does not disable external entity resolution. A craft | |
CVE-2026-46721 |
medium | 6.9 | 0.0036 | 2026-10-29 | The create and edit flows do not restrict which user properties may be submitted and do no | |
CVE-2026-32994 |
medium | 5.3 | 0.0025 | 2026-10-29 | The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8 | |
CVE-2026-47092 |
high | 7.3 | 0.0051 | 2026-10-29 | Claude HUD through 0.0.12, patched in commit 234d9aa, contains a command injection vulnera | |
CVE-2026-47091 |
medium | 4.8 | 0.0013 | 2026-10-29 | Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerabil | |
CVE-2026-47090 |
low | 2.4 | 0.0010 | 2026-10-29 | Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink | |
CVE-2026-21789 |
medium | 4.6 | 0.0012 | 2026-10-29 | HCL Connections contains a broken access control vulnerability that may allow unauthorized | |
CVE-2026-45231 |
medium | 5.3 | 0.0019 | 2026-10-29 | DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fi | |
CVE-2026-45230 |
high | 8.8 | 0.0063 | 2026-10-29 | DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete- | |
CVE-2026-32849 |
medium | 5.7 | 0.0011 | 2026-10-29 | NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cry | |
CVE-2026-32848 |
medium | 5.7 | 0.0008 | 2026-10-29 | NetBSD prior to commit ec8451e contains a race condition vulnerability in cryptodev_op() w | |
CVE-2023-24215 |
critical | 9.1 | 0.0024 | 2026-10-29 | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 al | |
CVE-2026-8843 |
high | 7.1 | 0.0024 | 2026-10-29 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but | |
CVE-2026-45829 |
critical | 10.0 | 0.1515 | 2026-10-29 | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the Chroma | |
CVE-2026-20685 |
medium | 6.5 | 0.0027 | 2026-10-29 | An attacker in a privileged network position may be able to leak sensitive information. A | |
CVE-2025-57282 |
high | 8.8 | 0.0098 | 2026-10-29 | ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. | |
CVE-2026-42009 |
high | 7.5 | 0.0134 | 2026-10-29 | A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Trans | |
CVE-2026-8803 |
medium | 6.3 | 0.0018 | 2026-10-29 | A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is | |
CVE-2026-0983 |
high | 7.1 | 0.0023 | 2026-10-29 | Denial-of-service condition in M-Files Server versions before 26.5.16015.0, before 26.2 LT | |
CVE-2026-4320 |
critical | 9.3 | 0.0025 | 2026-10-29 | Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to | |
CVE-2026-41119 |
medium | 6.8 | 0.0014 | 2026-10-29 | Dell Live Optics Windows and Personal Edition collectors contain an improper certificate v | |
CVE-2026-7498 |
high | 8.8 | 0.0030 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-6902 |
high | 7.7 | 0.0046 | 2026-10-29 | A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, pri | |
CVE-2026-8788 |
high | 7.3 | 0.0023 | 2026-10-29 | Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values | |
CVE-2026-8785 |
medium | 5.5 | 0.0025 | 2026-10-29 | A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by | |
CVE-2026-8784 |
low | 1.8 | 0.0016 | 2026-10-29 | A vulnerability was detected in npitre cramfs-tools up to 2.2. Affected is the function ch | |
CVE-2026-8783 |
low | 2.1 | 0.0040 | 2026-10-29 | A security vulnerability has been detected in omec-project amf up to 2.1.3-dev. This impac | |
CVE-2026-8782 |
low | 2.1 | 0.0030 | 2026-10-29 | A weakness has been identified in omec-project amf up to 2.1.3-dev. This affects an unknow | |
CVE-2026-8781 |
low | 2.1 | 0.0030 | 2026-10-29 | A security flaw has been discovered in omec-project amf up to 2.1.3-dev. The impacted elem | |
CVE-2026-8780 |
low | 2.1 | 0.0030 | 2026-10-29 | A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element i | |
CVE-2026-8779 |
low | 2.1 | 0.0030 | 2026-10-29 | A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the functi | |
CVE-2026-8777 |
low | 2.1 | 0.0191 | 2026-10-29 | A vulnerability was found in Edimax BR-6428NS 1.10. This issue affects the function formSt |