Browse All CVEs
10,808 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-63105 |
medium | 5.1 | 0.0024 | 2026-10-29 | ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability tha | |
CVE-2026-71959 |
medium | 6.9 | 0.0048 | 2026-10-29 | Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organi | |
CVE-2026-72751 |
medium | 5.1 | 0.0045 | 2026-10-29 | CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conv | |
CVE-2026-72759 |
medium | 6.9 | 0.0048 | 2026-10-29 | In affected versions of MISP cti-transmute, the conversion-history details endpoint perfor | |
CVE-2026-72760 |
medium | 5.3 | 0.0038 | 2026-10-29 | Affected versions of MISP cti-transmute disclose users' email addresses through the accoun | |
CVE-2026-56620 |
medium | 4.3 | 0.0029 | 2026-10-29 | HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exce | |
CVE-2026-56619 |
medium | 5.4 | 0.0023 | 2026-10-29 | HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to i | |
CVE-2026-71577 |
medium | 6.3 | 0.0042 | 2026-10-29 | A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system | |
CVE-2026-12339 |
medium | 6.9 | 0.0053 | 2026-10-29 | A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file writ | |
CVE-2026-68870 |
medium | 5.3 | 0.0036 | 2026-10-29 | The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved | |
CVE-2026-68871 |
medium | 6.5 | 0.0036 | 2026-10-29 | The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-sco | |
CVE-2026-68872 |
medium | 6.5 | 0.0060 | 2026-10-29 | The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's A | |
CVE-2026-6791 |
medium | 6.6 | 0.0022 | 2026-10-29 | When expanding paths that begin with a tilde (~) followed by a username, the internal pars | |
CVE-2026-71967 |
medium | 5.7 | 0.0017 | 2026-10-29 | OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vul | |
CVE-2026-69112 |
medium | 6.9 | 0.0019 | 2026-10-29 | Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_che | |
CVE-2026-69116 |
medium | 5.3 | 0.0034 | 2026-10-29 | FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content pa | |
CVE-2026-72743 |
medium | 5.1 | 0.0030 | 2026-10-29 | SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vul | |
CVE-2026-72906 |
medium | 4.3 | 0.0035 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and | |
CVE-2026-72907 |
medium | 6.5 | 0.0044 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and | |
CVE-2026-72908 |
medium | 6.5 | 0.0051 | 2026-10-29 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and | |
CVE-2026-72912 |
medium | 4.3 | 0.0032 | 2026-10-29 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to | |
CVE-2026-73035 |
medium | 5.3 | 0.0037 | 2026-10-29 | npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequ | |
CVE-2026-72917 |
medium | 5.9 | 0.0035 | 2026-10-29 | AnythingLLM is an application that turns pieces of content into context that any LLM can u | |
CVE-2026-72918 |
medium | 5.4 | 0.0022 | 2026-10-29 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior t | |
CVE-2026-72919 |
medium | 4.3 | 0.0032 | 2026-10-29 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior t | |
CVE-2026-40130 |
medium | 5.3 | 0.0047 | 2026-10-29 | SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain com | |
CVE-2026-58235 |
medium | 6.3 | 0.0029 | 2026-10-29 | SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source c | |
CVE-2026-58236 |
medium | 5.5 | 0.0069 | 2026-10-29 | SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privil | |
CVE-2026-58237 |
medium | 5.9 | 0.0028 | 2026-10-29 | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain fun | |
CVE-2026-58238 |
medium | 5.9 | 0.0043 | 2026-10-29 | SAP Approuter does not sufficiently handle certain requests under specific conditions. An | |
CVE-2026-58241 |
medium | 4.2 | 0.0025 | 2026-10-29 | SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integrat | |
CVE-2026-58244 |
medium | 4.3 | 0.0028 | 2026-10-29 | SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorizat | |
CVE-2026-58247 |
medium | 5.3 | 0.0036 | 2026-10-29 | SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an | |
CVE-2026-58248 |
medium | 6.5 | 0.0044 | 2026-10-29 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privile | |
CVE-2026-66760 |
medium | 6.4 | 0.0018 | 2026-10-29 | SAP Approuter does not correctly validate client certificates in certain callback flows. A | |
CVE-2026-66761 |
medium | 4.3 | 0.0038 | 2026-10-29 | SAP Approuter does not enforce sufficient flow control in certain functionality. An attack | |
CVE-2026-66764 |
medium | 4.3 | 0.0028 | 2026-10-29 | Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization | |
CVE-2026-66770 |
medium | 6.3 | 0.0027 | 2026-10-29 | Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacke | |
CVE-2026-66771 |
medium | 6.1 | 0.0038 | 2026-10-29 | SAPUI5 allows a key user with content adaptation privileges to inject malicious script con | |
CVE-2026-66772 |
medium | 4.3 | 0.0031 | 2026-10-29 | SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform suffici | |
CVE-2026-66773 |
medium | 5.9 | 0.0031 | 2026-10-29 | A malicious or compromised OData service could disclose sensitive authentication informati | |
CVE-2026-66775 |
medium | 4.3 | 0.0016 | 2026-10-29 | SAP Approuter does not enforce cross-site request forgery protection on the authentication | |
CVE-2026-66776 |
medium | 5.9 | 0.0020 | 2026-10-29 | SAP Approuter does not consistently enforce integrity verification on certain session-rela | |
CVE-2026-66777 |
medium | 5.9 | 0.0044 | 2026-10-29 | SAP Approuter does not sufficiently validate certain incoming requests before forwarding t | |
CVE-2026-66778 |
medium | 5.3 | 0.0036 | 2026-10-29 | SAP Approuter does not sufficiently sanitize certain request headers before forwarding tra | |
CVE-2026-66779 |
medium | 6.3 | 0.0035 | 2026-10-29 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP | |
CVE-2026-24330 |
medium | 6.5 | 0.0052 | 2026-10-29 | A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account | |
CVE-2026-11893 |
medium | 5.9 | 0.0025 | 2026-10-29 | The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_ | |
CVE-2026-11894 |
medium | 5.9 | 0.0025 | 2026-10-29 | The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetoo | |
CVE-2026-12051 |
medium | 4.6 | 0.0023 | 2026-10-29 | The USB DFU class implementation in Zephyr's new (experimental) device_next USB device sta |