Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44442 |
critical | 9.9 | 0.0028 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, cert | |
CVE-2026-44441 |
medium | 4.3 | 0.0016 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and | |
CVE-2026-44440 |
medium | 5.7 | 0.0036 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.101.1 and | |
CVE-2026-44439 |
medium | 6.6 | 0.0040 | 2026-10-29 | PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, Pl | |
CVE-2026-44437 |
medium | 6.9 | 0.0020 | 2026-10-29 | The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next | |
CVE-2026-44195 |
medium | 6.5 | 0.0032 | 2026-10-29 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw i | |
CVE-2026-44194 |
critical | 9.1 | 0.0567 | 2026-10-29 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticat | |
CVE-2026-44193 |
critical | 9.1 | 0.0069 | 2026-10-29 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC met | |
CVE-2026-42463 |
high | 8.6 | 0.0025 | 2026-10-29 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior | |
CVE-2026-32993 |
high | 8.3 | 0.0030 | 2026-10-29 | Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` end | |
CVE-2026-32992 |
high | 8.2 | 0.0025 | 2026-10-29 | SSL verification is disabled in the DNS Cluster system. This could allow for a malicious s | |
CVE-2026-29205 |
high | 8.6 | 0.0837 | 2026-10-29 | Incorrect privileges management and insufficient path filtering allow to read arbitrary fi | |
CVE-2026-8328 |
medium | 5.9 | 0.0046 | 2026-10-29 | The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While | |
CVE-2026-45229 |
high | 8.7 | 0.0037 | 2026-10-29 | Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endp | |
CVE-2026-45228 |
medium | 5.1 | 0.0018 | 2026-10-29 | Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the Syste | |
CVE-2026-44418 |
high | 8.7 | 0.0029 | 2026-10-29 | EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput | |
CVE-2026-44373 |
medium | 5.3 | 0.0045 | 2026-10-29 | Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could byp | |
CVE-2026-44372 |
medium | 5.3 | 0.0028 | 2026-10-29 | Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could tur | |
CVE-2026-44368 |
medium | 6.9 | 0.0031 | 2026-10-29 | PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, | |
CVE-2026-42602 |
high | 8.1 | 0.0022 | 2026-10-29 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server | |
CVE-2026-42561 |
— | — | 0.0074 | 2026-10-29 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multi | |
CVE-2026-21821 |
high | 8.3 | 0.0021 | 2026-10-29 | The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQue | |
CVE-2026-44364 |
critical | 9.3 | 0.0019 | 2026-10-29 | MISP modules are autonomous modules that can be used to extend MISP for new services. In 3 | |
CVE-2026-44363 |
medium | 5.8 | 0.0010 | 2026-10-29 | MISP modules are autonomous modules that can be used to extend MISP for new services. Prio | |
CVE-2026-44351 |
critical | 9.1 | 0.0025 | 2026-10-29 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical aut | |
CVE-2026-42552 |
high | 7.5 | 0.0034 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handle | |
CVE-2026-42551 |
high | 7.5 | 0.0035 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unc | |
CVE-2026-42550 |
high | 8.8 | 0.0046 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), Sim | |
CVE-2026-42549 |
medium | 4.4 | 0.0020 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI | |
CVE-2026-42548 |
high | 8.6 | 0.0045 | 2026-10-29 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concaten | |
CVE-2026-33381 |
high | 8.1 | 0.0034 | 2026-10-29 | When a user's access to mint tokens for a service account is revoked, it is sometimes stil | |
CVE-2026-33380 |
medium | 6.5 | 0.0037 | 2026-10-29 | A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary file | |
CVE-2026-33378 |
medium | 6.5 | 0.0033 | 2026-10-29 | Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requi | |
CVE-2026-33377 |
high | 7.1 | 0.0023 | 2026-10-29 | An Editor can overwrite a dashboard not owned by them to acquire admin on that specific da | |
CVE-2026-33376 |
high | 7.4 | 0.0028 | 2026-10-29 | When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Ad | |
CVE-2026-28383 |
medium | 6.5 | 0.0033 | 2026-10-29 | A request to the Grafana plugin resources endpoint can cause unbounded memory allocation b | |
CVE-2026-28380 |
medium | 6.5 | 0.0023 | 2026-10-29 | Any Editor could delete any snapshot, even if they have no access to read or write them. | |
CVE-2026-28379 |
medium | 6.5 | 0.0026 | 2026-10-29 | A race condition in Grafana Live allows authenticated users with Viewer role to trigger a | |
CVE-2026-28376 |
medium | 6.5 | 0.0033 | 2026-10-29 | The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by se | |
CVE-2026-28374 |
medium | 4.3 | 0.0020 | 2026-10-29 | Editors could delete any annotation, even those they do not have read access to. The edito | |
CVE-2026-0243 |
medium | 4.9 | 0.0017 | 2026-10-29 | A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices en | |
CVE-2026-8496 |
medium | 6.1 | 0.0043 | 2026-10-29 | A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 5.12.7. A malic | |
CVE-2026-8466 |
high | 8.2 | 0.0038 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy all | |
CVE-2026-44248 |
high | 7.5 | 0.0056 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-43970 |
high | 8.2 | 0.0051 | 2026-10-29 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenine | |
CVE-2026-42587 |
— | — | 0.0099 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42586 |
high | 7.1 | 0.0022 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42585 |
high | 7.5 | 0.0027 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42584 |
critical | 9.1 | 0.0084 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-42583 |
high | 7.5 | 0.0046 | 2026-10-29 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina |