Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-41691 |
critical | 9.1 | 0.0031 | 2026-10-29 | Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript libr | |
CVE-2026-8142 |
medium | 6.5 | 0.0011 | 2026-10-29 | VINCE versions 3.0.38 and earlier do not properly verify the From address authenticity due | |
CVE-2026-8088 |
low | 1.9 | 0.0025 | 2026-10-29 | A weakness has been identified in OSGeo gdal up to 3.13.0dev-4. The affected element is th | |
CVE-2026-8087 |
low | 1.9 | 0.0022 | 2026-10-29 | A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the funct | |
CVE-2026-43510 |
medium | 5.1 | 0.0040 | 2026-10-29 | manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an orga | |
CVE-2026-42499 |
— | — | 0.0080 | 2026-10-29 | Pathological inputs could cause DoS through consumePhrase when parsing an email address ac | |
CVE-2026-42241 |
medium | 5.3 | 0.0027 | 2026-10-29 | ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version | |
CVE-2026-42225 |
high | 8.2 | 0.0016 | 2026-10-29 | PJSIP is a free and open source multimedia communication library written in C. Prior to ve | |
CVE-2026-39836 |
high | 7.5 | 0.0063 | 2026-10-29 | The Dial and LookupPort functions panic on Windows when provided with an input containing | |
CVE-2026-39826 |
medium | 6.1 | 0.0037 | 2026-10-29 | If a trusted template author were to write a <script> tag containing an empty 'type' attri | |
CVE-2026-39825 |
medium | 5.3 | 0.0039 | 2026-10-29 | ReverseProxy can forward queries containing parameters not visible to Rewrite functions. W | |
CVE-2026-39823 |
medium | 6.1 | 0.0031 | 2026-10-29 | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a | |
CVE-2026-39820 |
high | 7.5 | 0.0078 | 2026-10-29 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to tr | |
CVE-2026-33814 |
high | 7.5 | 0.0084 | 2026-10-29 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing C | |
CVE-2026-33811 |
high | 7.5 | 0.0088 | 2026-10-29 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a | |
CVE-2026-8086 |
low | 1.9 | 0.0024 | 2026-10-29 | A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the fun | |
CVE-2026-8084 |
low | 1.9 | 0.0026 | 2026-10-29 | A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects | |
CVE-2026-8083 |
medium | 5.5 | 0.0025 | 2026-10-29 | A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This | |
CVE-2026-42214 |
high | 7.8 | 0.0024 | 2026-10-29 | Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, No | |
CVE-2026-41653 |
high | 7.0 | 0.0036 | 2026-10-29 | BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cro | |
CVE-2026-8081 |
low | 2.1 | 0.0022 | 2026-10-29 | A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue | |
CVE-2026-7415 |
critical | 9.8 | 0.0054 | 2026-10-29 | The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connect | |
CVE-2026-7414 |
critical | 9.8 | 0.0053 | 2026-10-29 | Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmwa | |
CVE-2026-7413 |
critical | 9.8 | 0.0058 | 2026-10-29 | A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, una | |
CVE-2026-7821 |
critical | 9.1 | 0.0051 | 2026-10-29 | Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12. | |
CVE-2026-6973 |
high | 7.2 | 0.3445 | 2026-10-29 | KEV | Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability |
CVE-2026-5788 |
critical | 9.8 | 0.0082 | 2026-10-29 | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 | |
CVE-2026-5787 |
critical | 9.1 | 0.0069 | 2026-10-29 | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and | |
CVE-2026-5786 |
high | 8.8 | 0.1120 | 2026-10-29 | An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1 | |
CVE-2026-44264 |
medium | 4.3 | 0.0027 | 2026-10-29 | Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer u | |
CVE-2026-44263 |
medium | 4.3 | 0.0034 | 2026-10-29 | Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, | |
CVE-2026-42011 |
high | 7.4 | 0.0047 | 2026-10-29 | A flaw was found in gnutls. This vulnerability occurs because permitted name constraints w | |
CVE-2026-41689 |
medium | 6.0 | 0.0018 | 2026-10-29 | Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 a | |
CVE-2026-41688 |
high | 7.7 | 0.0023 | 2026-10-29 | Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 a | |
CVE-2026-41687 |
medium | 4.3 | 0.0020 | 2026-10-29 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4. | |
CVE-2026-41654 |
medium | 5.3 | 0.0037 | 2026-10-29 | Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user w | |
CVE-2026-41650 |
medium | 6.1 | 0.0024 | 2026-10-29 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries o | |
CVE-2026-41519 |
medium | 5.4 | 0.0027 | 2026-10-29 | Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes the | |
CVE-2026-41505 |
high | 8.7 | 0.0026 | 2026-10-29 | RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vulnerable to | |
CVE-2026-32686 |
medium | 6.9 | 0.0048 | 2026-10-29 | Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated r | |
CVE-2025-63706 |
critical | 9.8 | 0.0152 | 2026-10-29 | NPM package next-npm-version1.0.1 is vulnerable to Command injection. | |
CVE-2026-41685 |
medium | 4.3 | 0.0033 | 2026-10-29 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads o | |
CVE-2026-41684 |
medium | 6.5 | 0.0041 | 2026-10-29 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.Ge | |
CVE-2026-41648 |
medium | 5.3 | 0.0027 | 2026-10-29 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, user prov | |
CVE-2026-41647 |
medium | 6.5 | 0.0039 | 2026-10-29 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing | |
CVE-2026-41589 |
critical | 9.6 | 0.0039 | 2026-10-29 | Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to | |
CVE-2026-41554 |
high | 7.1 | 0.0014 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-41490 |
high | 8.3 | 0.0027 | 2026-10-29 | Dagster is an orchestration platform for the development, production, and observation of d | |
CVE-2026-30496 |
critical | 9.8 | 0.0033 | 2026-10-29 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an | |
CVE-2026-8094 |
— | — | 0.0045 | 2026-10-29 | Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 |