Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-41481 |
— | — | 0.0026 | 2026-10-29 | LangChain is a framework for building agents and LLM-powered applications. Prior to langch | |
CVE-2026-41473 |
high | 8.8 | 0.0079 | 2026-10-29 | CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the A | |
CVE-2026-41472 |
medium | 5.3 | 0.0052 | 2026-10-29 | CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in | |
CVE-2026-41248 |
critical | 9.1 | 0.0032 | 2026-10-29 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRou | |
CVE-2026-6968 |
high | 7.1 | 0.0053 | 2026-10-29 | Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authent | |
CVE-2026-6967 |
high | 7.1 | 0.0025 | 2026-10-29 | Missing expiration, hash, and length enforcement in delegated metadata validation in awsla | |
CVE-2026-6966 |
high | 7.0 | 0.0028 | 2026-10-29 | Improper verification of cryptographic signature uniqueness in delegated role validation i | |
CVE-2026-41433 |
high | 8.4 | 0.0019 | 2026-10-29 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetr | |
CVE-2026-41429 |
high | 8.8 | 0.0031 | 2026-10-29 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and | |
CVE-2026-41427 |
high | 7.1 | 0.0021 | 2026-10-29 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, | |
CVE-2026-41244 |
medium | 4.7 | 0.0011 | 2026-10-29 | Mojic is a CLI tool to transform readable C code into an unrecognizable chaotic stream of | |
CVE-2026-41907 |
high | 8.1 | 0.0035 | 2026-10-29 | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and | |
CVE-2026-41492 |
critical | 9.8 | 0.0308 | 2026-10-29 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes th | |
CVE-2026-41419 |
high | 7.6 | 0.0031 | 2026-10-29 | 4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path trav | |
CVE-2026-41418 |
medium | 5.3 | 0.0020 | 2026-10-29 | 4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards | |
CVE-2026-41416 |
high | 8.1 | 0.0028 | 2026-10-29 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and | |
CVE-2026-41415 |
medium | 6.7 | 0.0031 | 2026-10-29 | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and | |
CVE-2026-41414 |
high | 7.4 | 0.0028 | 2026-10-29 | Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files | |
CVE-2026-33666 |
high | 7.5 | 0.0033 | 2026-10-29 | Zserio is a framework for serializing structured data with a compact and efficient way wit | |
CVE-2026-33662 |
high | 7.5 | 0.0040 | 2026-10-29 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linu | |
CVE-2026-33524 |
high | 7.5 | 0.0032 | 2026-10-29 | Zserio is a framework for serializing structured data with a compact and efficient way wit | |
CVE-2026-41680 |
high | 8.7 | 0.0034 | 2026-10-29 | Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Serv | |
CVE-2026-41322 |
medium | 5.3 | 0.0029 | 2026-10-29 | @astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, reque | |
CVE-2026-41321 |
low | 2.2 | 0.0024 | 2026-10-29 | @astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13 | |
CVE-2026-41140 |
low | 0.6 | 0.0029 | 2026-10-29 | Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in sr | |
CVE-2026-6912 |
high | 8.7 | 0.0055 | 2026-10-29 | Improperly controlled modification of dynamically-determined object attributes in the Cogn | |
CVE-2026-6911 |
critical | 9.3 | 0.0025 | 2026-10-29 | Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to fo | |
CVE-2026-41079 |
medium | 5.4 | 0.0041 | 2026-10-29 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operatin | |
CVE-2026-41067 |
medium | 6.1 | 0.0019 | 2026-10-29 | Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server- | |
CVE-2026-40897 |
— | — | 0.0055 | 2026-10-29 | Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15. | |
CVE-2026-39920 |
critical | 9.3 | 0.0054 | 2026-10-29 | BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis | |
CVE-2026-30368 |
medium | 5.4 | 0.0035 | 2026-10-29 | A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows | |
CVE-2026-42095 |
medium | 4.0 | 0.0016 | 2026-10-29 | bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket conn | |
CVE-2026-25660 |
critical | 9.3 | 0.0045 | 2026-10-29 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Sta | |
CVE-2026-5367 |
— | — | 0.0087 | 2026-10-29 | A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCP | |
CVE-2026-5265 |
medium | 6.5 | 0.0063 | 2026-10-29 | When generating an ICMP Destination Unreachable or Packet Too Big response, the handler co | |
CVE-2026-40690 |
medium | 4.3 | 0.0035 | 2026-10-29 | The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a | |
CVE-2026-38743 |
medium | 4.3 | 0.0035 | 2026-10-29 | The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Hum | |
CVE-2026-21515 |
critical | 9.9 | 0.0070 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an | |
CVE-2026-6043 |
high | 8.8 | 0.0126 | 2026-10-29 | P4 Server versions prior to 2026.1 are configured with insecure default settings that, whe | |
CVE-2026-4313 |
low | 2.4 | 0.0059 | 2026-10-29 | AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticat | |
CVE-2026-23902 |
high | 8.1 | 0.0045 | 2026-10-29 | Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated user | |
CVE-2026-41044 |
— | — | 0.0098 | 2026-10-29 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulne | |
CVE-2026-41043 |
medium | 6.5 | 0.0056 | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-40466 |
— | — | 0.0478 | 2026-10-29 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulne | |
CVE-2026-6272 |
high | 8.5 | 0.0032 | 2026-10-29 | A client holding only a read JWT scope can still register itself as a signal provider thro | |
CVE-2026-21728 |
— | — | 0.0064 | 2026-10-29 | Tempo queries with large limits can cause large memory allocations which can impact the av | |
CVE-2026-1952 |
high | 7.5 | 0.0027 | 2026-10-29 | Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerabil | |
CVE-2026-1951 |
critical | 9.8 | 0.0061 | 2026-10-29 | Delta Electronics AS320T has no checking of the length of the buffer with the directory na | |
CVE-2026-1950 |
critical | 9.8 | 0.0031 | 2026-10-29 | Delta Electronics AS320T has No checking of the length of the buffer with the file name v |