Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-23853 |
high | 8.4 | 0.0016 | 2026-10-29 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release | |
CVE-2026-6443 |
critical | 9.8 | 0.0050 | 2026-10-29 | All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in var | |
CVE-2026-6482 |
high | 8.5 | 0.0018 | 2026-10-29 | The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalatio | |
CVE-2026-6421 |
medium | 6.4 | 0.0015 | 2026-10-29 | A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects | |
CVE-2026-21719 |
high | 8.6 | 0.0120 | 2026-10-29 | An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a | |
CVE-2026-5807 |
— | — | 0.0072 | 2026-10-29 | Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can | |
CVE-2026-5052 |
high | 8.6 | 0.0034 | 2026-10-29 | Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and | |
CVE-2026-4525 |
high | 8.8 | 0.0041 | 2026-10-29 | If a Vault auth mount is configured to pass through the "Authorization" header, and the "A | |
CVE-2026-3605 |
— | — | 0.0038 | 2026-10-29 | An authenticated user with access to a kvv2 path through a policy containing a glob may be | |
CVE-2026-40265 |
medium | 5.9 | 0.0045 | 2026-10-29 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the ass | |
CVE-2026-40263 |
low | 3.7 | 0.0026 | 2026-10-29 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the log | |
CVE-2026-40262 |
high | 8.7 | 0.0032 | 2026-10-29 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the ass | |
CVE-2026-22734 |
high | 8.6 | 0.0037 | 2026-10-29 | Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for | |
CVE-2026-40255 |
medium | 6.1 | 0.0026 | 2026-10-29 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In | |
CVE-2026-41113 |
high | 8.1 | 0.0087 | 2026-10-29 | sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in | |
CVE-2026-39313 |
high | 8.7 | 0.0047 | 2026-10-29 | mcp-framework is a framework for building Model Context Protocol (MCP) servers. In version | |
CVE-2026-35469 |
high | 8.7 | 0.0067 | 2026-10-29 | spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5 | |
CVE-2026-6442 |
high | 8.3 | 0.0040 | 2026-10-29 | Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 | |
CVE-2023-20585 |
medium | 5.6 | 0.0010 | 2026-10-29 | Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with p | |
CVE-2026-41082 |
high | 7.8 | 0.0021 | 2026-10-29 | In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ | |
CVE-2026-2336 |
high | 8.7 | 0.0024 | 2026-10-29 | A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privil | |
CVE-2026-27820 |
low | 1.7 | 0.0058 | 2026-10-29 | zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 an | |
CVE-2026-24749 |
medium | 5.3 | 0.0041 | 2026-10-29 | The Silverstripe Assets Module is a required component of Silverstripe Framework. In versi | |
CVE-2026-5426 |
critical | 9.1 | 0.0102 | 2026-10-29 | Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments | |
CVE-2026-6409 |
high | 7.1 | 0.0034 | 2026-10-29 | A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the pars | |
CVE-2026-3324 |
high | 8.2 | 0.0128 | 2026-10-29 | Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication | |
CVE-2026-5785 |
high | 8.1 | 0.0142 | 2026-10-29 | Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro ve | |
CVE-2026-31987 |
high | 7.5 | 0.0075 | 2026-10-29 | JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Aut | |
CVE-2026-31843 |
critical | 10.0 | 0.0141 | 2026-10-29 | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the | |
CVE-2026-23772 |
high | 7.3 | 0.0012 | 2026-10-29 | Dell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an | |
CVE-2026-41035 |
high | 7.8 | 0.0041 | 2026-10-29 | In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a q | |
CVE-2026-41034 |
medium | 5.0 | 0.0031 | 2026-10-29 | ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS process | |
CVE-2026-41030 |
medium | 6.2 | 0.0017 | 2026-10-29 | In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform | |
CVE-2026-3861 |
high | 7.1 | 0.0032 | 2026-10-29 | LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browse | |
CVE-2026-22619 |
critical | 9.9 | 0.0033 | 2026-10-29 | Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its exe | |
CVE-2026-22618 |
high | 7.1 | 0.0024 | 2026-10-29 | A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), whe | |
CVE-2026-22617 |
high | 7.4 | 0.0017 | 2026-10-29 | Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could | |
CVE-2026-40118 |
medium | 5.1 | 0.0018 | 2026-10-29 | UDP Console provided by Arcserve contains an incorrectly specified destination in a commun | |
CVE-2026-22616 |
high | 7.5 | 0.0032 | 2026-10-29 | Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts a | |
CVE-2026-22615 |
high | 7.2 | 0.0036 | 2026-10-29 | Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML | |
CVE-2023-5872 |
medium | 4.3 | 0.0033 | 2026-10-29 | In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enume | |
CVE-2023-3634 |
high | 8.8 | 0.0067 | 2026-10-29 | In products of the MSE6 product-family by Festo a remote authenticated, low privileged att | |
CVE-2026-5070 |
medium | 6.4 | 0.0020 | 2026-10-29 | The Vantage theme for WordPress is vulnerable to Stored Cross-Site Scripting via Gallery b | |
CVE-2026-6351 |
high | 8.7 | 0.0060 | 2026-10-29 | MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing una | |
CVE-2026-6350 |
critical | 9.3 | 0.0078 | 2026-10-29 | MailGates/MailAudit developed by Openfind has a Stack-based Buffer Overflow vulnerability, | |
CVE-2026-6349 |
critical | 9.3 | 0.0207 | 2026-10-29 | The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing una | |
CVE-2026-6348 |
critical | 9.3 | 0.0018 | 2026-10-29 | WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability | |
CVE-2026-41015 |
high | 7.4 | 0.0120 | 2026-10-29 | radare2 before 9236f44, when configured on UNIX without SSL, allows command injection via | |
CVE-2026-3428 |
medium | 5.4 | 0.0008 | 2026-10-29 | A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Mem | |
CVE-2026-1880 |
medium | 5.4 | 0.0014 | 2026-10-29 | An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverH |