Browse All CVEs
10,793 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-65769 |
medium | 6.5 | 0.0092 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allow | |
CVE-2026-65806 |
medium | 6.5 | 0.0084 | 2026-10-29 | Missing authorization in Azure CycleCloud allows an authorized attacker to disclose inform | |
CVE-2026-66301 |
medium | 6.5 | 0.0100 | 2026-10-29 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-p | |
CVE-2026-68813 |
medium | 5.5 | 0.0054 | 2026-10-29 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose i | |
CVE-2026-70310 |
medium | 5.5 | 0.0043 | 2026-10-29 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose in | |
CVE-2026-72971 |
medium | 5.5 | 0.0036 | 2026-10-29 | Improper link resolution before file access ('link following') in Windows Container Isolat | |
CVE-2026-73085 |
medium | 5.3 | 0.0046 | 2026-10-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuth | |
CVE-2026-48790 |
medium | 5.5 | 0.0015 | 2026-10-29 | Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions | |
CVE-2026-65680 |
medium | 6.7 | 0.0039 | 2026-10-29 | Improper link resolution before file access ('link following') in Microsoft OneDrive allow | |
CVE-2026-69113 |
medium | 5.3 | 0.0027 | 2026-10-29 | Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment e | |
CVE-2026-72712 |
medium | 6.9 | 0.0050 | 2026-10-29 | Nmap versions up to and including 7.99 contains a denial of service vulnerability that all | |
CVE-2026-73219 |
medium | 5.3 | 0.0047 | 2026-10-29 | CVAT is an open source interactive video and image annotation tool for computer vision. Fr | |
CVE-2026-18698 |
medium | 5.3 | 0.0024 | 2026-10-29 | An issue in MongoDB Server could allow an authenticated user with a limited database-scope | |
CVE-2026-18699 |
medium | 6.0 | 0.0040 | 2026-10-29 | An issue in MongoDB Server's query planner could allow an authenticated user with read-lev | |
CVE-2026-18700 |
medium | 6.0 | 0.0040 | 2026-10-29 | An issue in MongoDB Server's geospatial validation could allow an authenticated user with | |
CVE-2026-18702 |
medium | 5.3 | 0.0027 | 2026-10-29 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped | |
CVE-2026-18709 |
medium | 5.9 | 0.0019 | 2026-10-29 | An issue in MongoDB Server could allow an authenticated user with direct network access to | |
CVE-2026-73221 |
medium | 5.3 | 0.0043 | 2026-10-29 | CVAT is an open source interactive video and image annotation tool for computer vision. Fr | |
CVE-2026-73228 |
medium | 5.3 | 0.0056 | 2026-10-29 | Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Fra | |
CVE-2026-66146 |
medium | 6.1 | 0.0030 | 2026-10-29 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 95 | |
CVE-2026-70339 |
medium | 5.4 | 0.0041 | 2026-10-29 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium- | |
CVE-2026-71468 |
medium | 5.3 | 0.0042 | 2026-10-29 | A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refre | |
CVE-2026-71475 |
medium | 6.8 | 0.0069 | 2026-10-29 | A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spok | |
CVE-2026-73229 |
medium | 4.3 | 0.0037 | 2026-10-29 | Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3 | |
CVE-2026-73243 |
medium | 5.8 | 0.0043 | 2026-10-29 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1 | |
CVE-2026-73244 |
medium | 5.3 | 0.0044 | 2026-10-29 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1 | |
CVE-2026-73282 |
medium | 4.8 | 0.0016 | 2026-10-29 | In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pa | |
CVE-2026-19579 |
medium | 5.3 | 0.0034 | 2026-10-29 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) | |
CVE-2026-48762 |
medium | 5.4 | 0.0030 | 2026-10-29 | TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcripti | |
CVE-2026-63134 |
medium | 5.3 | 0.0042 | 2026-10-29 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract. | |
CVE-2026-66148 |
medium | 6.3 | 0.0110 | 2026-10-29 | An authenticated command injection vulnerability was identified in GMS Command-Line Interf | |
CVE-2026-73245 |
medium | 6.5 | 0.0033 | 2026-10-29 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra' | |
CVE-2026-64927 |
medium | 6.4 | 0.0033 | 2026-10-29 | A flaw was found in the multicloud-operators-channel component. This vulnerability allows | |
CVE-2026-19587 |
medium | 6.5 | 0.0036 | 2026-10-29 | Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Exce | |
CVE-2026-19588 |
medium | 6.5 | 0.0035 | 2026-10-29 | Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Ov | |
CVE-2026-9318 |
medium | 4.8 | 0.0030 | 2026-10-29 | tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML ex | |
CVE-2026-12232 |
medium | 6.1 | 0.0015 | 2026-10-29 | The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/ | |
CVE-2026-12233 |
medium | 5.9 | 0.0051 | 2026-10-29 | The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentia | |
CVE-2026-12235 |
medium | 6.3 | 0.0014 | 2026-10-29 | The Linkable Loadable Extensions (llext) subsystem mis-handles PLT/RELA relocation entries | |
CVE-2026-67283 |
medium | 6.9 | 0.0042 | 2026-10-29 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cot | |
CVE-2026-18652 |
medium | 6.5 | 0.0034 | 2026-10-29 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant | |
CVE-2026-64952 |
medium | 6.5 | 0.0030 | 2026-10-29 | The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permis | |
CVE-2026-64955 |
medium | 6.1 | 0.0036 | 2026-10-29 | When Microsoft Excel imports a CSV file, it executes cells beginning with certain characte | |
CVE-2026-67284 |
medium | 5.3 | 0.0035 | 2026-10-29 | Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cot | |
CVE-2026-68868 |
medium | 6.5 | 0.0060 | 2026-10-29 | The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never | |
CVE-2026-70560 |
medium | 4.8 | 0.0020 | 2026-10-29 | Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vul | |
CVE-2026-70466 |
medium | 5.3 | 0.0031 | 2026-10-29 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8. | |
CVE-2026-71408 |
medium | 5.3 | 0.0062 | 2026-10-29 | A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7 | |
CVE-2026-16999 |
medium | 6.3 | 0.0017 | 2026-10-29 | Improper restriction of XML external entity reference vulnerability in Ministry of Justice | |
CVE-2026-14479 |
medium | 5.5 | 0.0015 | 2026-10-29 | A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, ma |