Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42565 |
medium | 4.3 | 0.0019 | 2026-10-29 | @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. P | |
CVE-2026-8318 |
medium | 5.5 | 0.0037 | 2026-10-29 | A security flaw has been discovered in VectifyAI PageIndex up to f50e52975313c6716c02b20a1 | |
CVE-2026-7790 |
high | 8.7 | 0.0043 | 2026-10-29 | Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) a | |
CVE-2026-45224 |
medium | 6.8 | 0.0014 | 2026-10-29 | Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's worksp | |
CVE-2026-45223 |
high | 7.7 | 0.0038 | 2026-10-29 | Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator us | |
CVE-2026-45222 |
medium | 6.9 | 0.0015 | 2026-10-29 | Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configurati | |
CVE-2026-43969 |
low | 2.1 | 0.0015 | 2026-10-29 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines co | |
CVE-2026-43968 |
medium | 6.3 | 0.0027 | 2026-10-29 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines co | |
CVE-2026-42871 |
medium | 6.9 | 0.0025 | 2026-10-29 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/f | |
CVE-2026-42866 |
medium | 6.7 | 0.0021 | 2026-10-29 | Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py | |
CVE-2026-42864 |
critical | 9.9 | 0.0027 | 2026-10-29 | FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firef | |
CVE-2026-7308 |
medium | 5.1 | 0.0026 | 2026-10-29 | An authenticated user with upload permission to a hosted repository can store content that | |
CVE-2026-7210 |
medium | 6.3 | 0.0067 | 2026-10-29 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-fl | |
CVE-2026-5266 |
low | 2.3 | 0.0025 | 2026-10-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foun | |
CVE-2026-44777 |
medium | 5.4 | 0.0016 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader r | |
CVE-2026-44659 |
medium | 4.7 | 0.0016 | 2026-10-29 | Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates l | |
CVE-2026-44658 |
low | 2.4 | 0.0016 | 2026-10-29 | Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are v | |
CVE-2026-44413 |
high | 7.5 | 0.0027 | 2026-10-29 | In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API | |
CVE-2026-43995 |
medium | 5.3 | 0.0040 | 2026-10-29 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-43896 |
medium | 5.5 | 0.0015 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_objec | |
CVE-2026-43895 |
medium | 4.4 | 0.0016 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes i | |
CVE-2026-43894 |
medium | 5.5 | 0.0016 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is giv | |
CVE-2026-43640 |
high | 8.6 | 0.0050 | 2026-10-29 | Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication whe | |
CVE-2026-43639 |
high | 8.9 | 0.0060 | 2026-10-29 | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that al | |
CVE-2026-43638 |
medium | 5.3 | 0.0019 | 2026-10-29 | Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that al | |
CVE-2026-42865 |
low | 2.3 | 0.0023 | 2026-10-29 | Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email strea | |
CVE-2026-42860 |
high | 8.5 | 0.0030 | 2026-10-29 | The Open edx Enterprise Service app provides enterprise features to the Open edX platform. | |
CVE-2026-42859 |
high | 8.1 | 0.0063 | 2026-10-29 | Neat VNC is a VNC server library. Prior to 0.9.6, a pre-authentication stack buffer overfl | |
CVE-2026-42858 |
critical | 9.9 | 0.0037 | 2026-10-29 | Open edX Platform enables the authoring and delivery of online learning at any scale. The | |
CVE-2026-42857 |
medium | 5.4 | 0.0018 | 2026-10-29 | Open edX Platform enables the authoring and delivery of online learning at any scale. The | |
CVE-2026-42856 |
high | 8.7 | 0.0055 | 2026-10-29 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP | |
CVE-2026-42316 |
medium | 6.5 | 0.0034 | 2026-10-29 | kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data | |
CVE-2026-41431 |
high | 8.0 | 0.0020 | 2026-10-29 | Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application | |
CVE-2026-41257 |
medium | 6.4 | 0.0014 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack | |
CVE-2026-41256 |
medium | 5.5 | 0.0016 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded fr | |
CVE-2026-41250 |
medium | 5.7 | 0.0028 | 2026-10-29 | Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Tai | |
CVE-2026-40612 |
medium | 5.4 | 0.0016 | 2026-10-29 | jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into neste | |
CVE-2026-3609 |
high | 7.8 | 0.0023 | 2026-10-29 | Wellbia's XIGNCODE3 xhunter1.sys kernel driver, version 10.0.10011.16384 through 2023.12.7 | |
CVE-2026-3048 |
medium | 5.1 | 0.0017 | 2026-10-29 | An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus | |
CVE-2026-34095 |
none | — | 0.0018 | 2026-10-29 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with p | |
CVE-2026-34094 |
low | 2.0 | 0.0017 | 2026-10-29 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with p | |
CVE-2026-34093 |
low | 1.1 | 0.0023 | 2026-10-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foun | |
CVE-2026-44738 |
high | 7.7 | 0.0028 | 2026-10-29 | Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the Twig sandbox allow-list permit | |
CVE-2026-44737 |
medium | 6.2 | 0.0032 | 2026-10-29 | grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a c | |
CVE-2026-42845 |
high | 7.7 | 0.0074 | 2026-10-29 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there | |
CVE-2026-42843 |
high | 8.8 | 0.0035 | 2026-10-29 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your s | |
CVE-2026-42842 |
medium | 5.4 | 0.0018 | 2026-10-29 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Store | |
CVE-2026-42603 |
high | 8.8 | 0.0025 | 2026-10-29 | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, | |
CVE-2026-42349 |
high | 7.6 | 0.0025 | 2026-10-29 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), au | |
CVE-2026-33362 |
high | 8.6 | 0.0024 | 2026-10-29 | In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), |