Browse All CVEs
10,794 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-33921 |
medium | 4.8 | 0.0013 | 2026-10-29 | The Windows installer deployed Npcap leaving its access restriction option at the insecure | |
CVE-2026-33922 |
medium | 6.8 | 0.0017 | 2026-10-29 | A path traversal vulnerability was discovered in the Offline archives functionality of the | |
CVE-2026-73162 |
medium | 5.3 | 0.0025 | 2026-10-29 | Affected versions of MISP cti-transmute expose several state-changing account operations a | |
CVE-2026-72539 |
medium | 6.5 | 0.0040 | 2026-10-29 | An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows a | |
CVE-2026-72541 |
medium | 6.5 | 0.0030 | 2026-10-29 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any | |
CVE-2026-72542 |
medium | 5.4 | 0.0030 | 2026-10-29 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows aut | |
CVE-2026-72549 |
medium | 5.3 | 0.0048 | 2026-10-29 | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows una | |
CVE-2026-72553 |
medium | 5.4 | 0.0023 | 2026-10-29 | A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registe | |
CVE-2026-72554 |
medium | 6.5 | 0.0037 | 2026-10-29 | A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows | |
CVE-2026-72559 |
medium | 5.4 | 0.0023 | 2026-10-29 | A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspac | |
CVE-2026-72560 |
medium | 6.5 | 0.0034 | 2026-10-29 | A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev | |
CVE-2026-72597 |
medium | 6.5 | 0.0034 | 2026-10-29 | A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch al | |
CVE-2026-72598 |
medium | 6.5 | 0.0037 | 2026-10-29 | A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated cons | |
CVE-2026-72604 |
medium | 6.5 | 0.0052 | 2026-10-29 | A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticat | |
CVE-2026-72608 |
medium | 6.5 | 0.0038 | 2026-10-29 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26. | |
CVE-2026-72610 |
medium | 4.3 | 0.0034 | 2026-10-29 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26. | |
CVE-2026-72747 |
medium | 5.1 | 0.0035 | 2026-10-29 | AVideo fails to sanitize the phone field during user registration, allowing unauthenticate | |
CVE-2026-72748 |
medium | 6.9 | 0.0119 | 2026-10-29 | AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoder | |
CVE-2026-72750 |
medium | 5.3 | 0.0047 | 2026-10-29 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snow | |
CVE-2026-72764 |
medium | 5.8 | 0.0081 | 2026-10-29 | n8n's JavaScript task runner shared a single module cache across all users' Code-node exec | |
CVE-2026-72768 |
medium | 6.4 | 0.0040 | 2026-10-29 | n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnera | |
CVE-2026-72769 |
medium | 6.1 | 0.0051 | 2026-10-29 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in th | |
CVE-2026-72773 |
medium | 4.9 | 0.0057 | 2026-10-29 | n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/c | |
CVE-2026-72775 |
medium | 5.8 | 0.0047 | 2026-10-29 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Post | |
CVE-2026-72783 |
medium | 6.9 | 0.0020 | 2026-10-29 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a the | |
CVE-2026-72784 |
medium | 6.9 | 0.0024 | 2026-10-29 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a ser | |
CVE-2026-19434 |
medium | 5.1 | 0.0047 | 2026-10-29 | Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows aut | |
CVE-2026-73210 |
medium | 5.1 | 0.0047 | 2026-10-29 | A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture | |
CVE-2026-17535 |
medium | 6.2 | 0.0016 | 2026-10-29 | Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion | |
CVE-2026-18636 |
medium | 6.8 | 0.0040 | 2026-10-29 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the | |
CVE-2026-73066 |
medium | 6.8 | 0.0013 | 2026-10-29 | Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model | |
CVE-2026-73067 |
medium | 6.7 | 0.0013 | 2026-10-29 | Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loade | |
CVE-2026-11737 |
medium | 4.3 | 0.0033 | 2026-10-29 | Insufficient input validation vulnerability in the listed NETGEAR models allows authentic | |
CVE-2026-11738 |
medium | 4.3 | 0.0040 | 2026-10-29 | Insufficient input validation vulnerability in the listed NETGEAR models allows authentica | |
CVE-2026-11739 |
medium | 4.9 | 0.0255 | 2026-10-29 | A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a | |
CVE-2026-18638 |
medium | 6.5 | 0.0041 | 2026-10-29 | Any authenticated Velociraptor user — including one holding only the readerrole — can term | |
CVE-2026-19078 |
medium | 4.3 | 0.0036 | 2026-10-29 | A flaw was found in the oauth-server component. This open redirect vulnerability occurs wh | |
CVE-2026-53414 |
medium | 6.5 | 0.0036 | 2026-10-29 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, wh | |
CVE-2026-56720 |
medium | 5.3 | 0.0034 | 2026-10-29 | CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in th | |
CVE-2026-6727 |
medium | 5.9 | 0.0015 | 2026-10-29 | A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A pr | |
CVE-2026-9214 |
medium | 4.3 | 0.0023 | 2026-10-29 | Insufficient input validation vulnerability in the NETGEAR R7000 models allows authentica | |
CVE-2026-18247 |
medium | 5.3 | 0.0044 | 2026-10-29 | A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions ear | |
CVE-2026-40375 |
medium | 6.5 | 0.0084 | 2026-10-29 | Missing authorization in Dynamics Business Central allows an authorized attacker to disclo | |
CVE-2026-47285 |
medium | 6.5 | 0.0092 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in Vis | |
CVE-2026-48483 |
medium | 5.4 | 0.0033 | 2026-10-29 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forw | |
CVE-2026-54123 |
medium | 5.5 | 0.0048 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpo | |
CVE-2026-62740 |
medium | 5.5 | 0.0040 | 2026-10-29 | Use of uninitialized resource in Windows Imaging Component allows an authorized attacker t | |
CVE-2026-62775 |
medium | 5.5 | 0.0035 | 2026-10-29 | Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allo | |
CVE-2026-62899 |
medium | 5.9 | 0.0075 | 2026-10-29 | Inconsistent interpretation of http requests ('http request/response smuggling') in .NET a | |
CVE-2026-62900 |
medium | 5.9 | 0.0075 | 2026-10-29 | Improper removal of sensitive information before storage or transfer in .NET allows an una |