Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-4667 |
high | 7.3 | 0.0011 | 2026-10-29 | HP System Optimizer might potentially be vulnerable to escalation of privilege. HP is rele | |
CVE-2026-4145 |
high | 8.5 | 0.0020 | 2026-10-29 | During an internal security assessment, a potential vulnerability was discovered in Lenovo | |
CVE-2026-4135 |
medium | 5.2 | 0.0012 | 2026-10-29 | During an internal security assessment, a potential vulnerability was discovered in Lenovo | |
CVE-2026-4134 |
high | 7.0 | 0.0012 | 2026-10-29 | During an internal security assessment, a potential vulnerability was discovered in Lenovo | |
CVE-2026-25219 |
medium | 6.5 | 0.0056 | 2026-10-29 | The `access_key` and `connection_string` connection properties were not marked as sensitiv | |
CVE-2026-1636 |
medium | 5.4 | 0.0013 | 2026-10-29 | A potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under | |
CVE-2026-0827 |
medium | 6.9 | 0.0022 | 2026-10-29 | During an internal security assessment, a potential vulnerability was discovered in Lenovo | |
CVE-2026-40786 |
— | — | 0.0015 | 2026-10-29 | Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Explo | |
CVE-2026-40784 |
— | — | 0.0017 | 2026-10-29 | Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif Flue | |
CVE-2026-40764 |
— | — | 0.0010 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpf | |
CVE-2026-40763 |
— | — | 0.0019 | 2026-10-29 | Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-add | |
CVE-2026-40742 |
— | — | 0.0019 | 2026-10-29 | Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing al | |
CVE-2026-40740 |
— | — | 0.0018 | 2026-10-29 | Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrect | |
CVE-2026-40737 |
— | — | 0.0022 | 2026-10-29 | Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-w | |
CVE-2026-40734 |
— | — | 0.0014 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-40730 |
— | — | 0.0020 | 2026-10-29 | Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo | |
CVE-2026-40729 |
— | — | 0.0015 | 2026-10-29 | Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allo | |
CVE-2026-40728 |
— | — | 0.0015 | 2026-10-29 | Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exp | |
CVE-2026-33805 |
critical | 9.0 | 0.0046 | 2026-10-29 | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier proces | |
CVE-2026-30778 |
high | 7.5 | 0.0055 | 2026-10-29 | The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration inform | |
CVE-2026-5598 |
high | 8.9 | 0.0117 | 2026-10-29 | Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on al | |
CVE-2026-5588 |
medium | 6.3 | 0.0081 | 2026-10-29 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Cas | |
CVE-2026-3505 |
high | 8.7 | 0.0082 | 2026-10-29 | Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vu | |
CVE-2026-33808 |
critical | 9.1 | 0.0049 | 2026-10-29 | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to E | |
CVE-2026-33807 |
critical | 9.1 | 0.0045 | 2026-10-29 | @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister functio | |
CVE-2026-0636 |
medium | 5.5 | 0.0055 | 2026-10-29 | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulne | |
CVE-2026-5088 |
high | 7.5 | 0.0058 | 2026-10-29 | Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values | |
CVE-2026-5397 |
high | 7.8 | 0.0013 | 2026-10-29 | It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible P | |
CVE-2026-40499 |
high | 8.4 | 0.0120 | 2026-10-29 | radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parse | |
CVE-2026-40105 |
medium | 6.5 | 0.0055 | 2026-10-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built | |
CVE-2026-40104 |
medium | 6.9 | 0.0041 | 2026-10-29 | XWiki Platform is a generic wiki platform offering runtime services for applications built | |
CVE-2026-40091 |
medium | 4.4 | 0.0017 | 2026-10-29 | SpiceDB is an open source database system for creating and managing security-critical appl | |
CVE-2026-39984 |
medium | 5.5 | 0.0010 | 2026-10-29 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 | |
CVE-2026-39971 |
high | 7.2 | 0.0026 | 2026-10-29 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sen | |
CVE-2026-39963 |
medium | 6.9 | 0.0023 | 2026-10-29 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendip | |
CVE-2026-39884 |
high | 8.1 | 0.0026 | 2026-10-29 | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management | |
CVE-2026-1555 |
critical | 9.8 | 0.0100 | 2026-10-29 | The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing fi | |
CVE-2026-32219 |
high | 7.0 | 0.0019 | 2026-10-29 | Double free in Microsoft Brokering File System allows an authorized attacker to elevate pr | |
CVE-2026-32218 |
medium | 5.5 | 0.0045 | 2026-10-29 | Insertion of sensitive information into log file in Windows Kernel allows an authorized at | |
CVE-2026-32217 |
medium | 5.5 | 0.0044 | 2026-10-29 | Insertion of sensitive information into log file in Windows Kernel allows an authorized at | |
CVE-2026-32216 |
medium | 5.5 | 0.0038 | 2026-10-29 | Null pointer dereference in Windows Redirected Drive Buffering allows an authorized attack | |
CVE-2026-32215 |
medium | 5.5 | 0.0044 | 2026-10-29 | Insertion of sensitive information into log file in Windows Kernel allows an authorized at | |
CVE-2026-32214 |
medium | 5.5 | 0.0023 | 2026-10-29 | Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacke | |
CVE-2026-32212 |
medium | 5.5 | 0.0032 | 2026-10-29 | Improper link resolution before file access ('link following') in Universal Plug and Play | |
CVE-2026-32203 |
— | — | 0.0197 | 2026-10-29 | Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to d | |
CVE-2026-32202 |
medium | 4.3 | 0.7132 | 2026-10-29 | KEV | Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows |
CVE-2026-32201 |
medium | 6.5 | 0.4395 | 2026-10-29 | KEV | Microsoft SharePoint Server contains an improper input validation vulnerability that allow |
CVE-2026-32200 |
high | 7.8 | 0.0034 | 2026-10-29 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute c | |
CVE-2026-32199 |
high | 7.8 | 0.0030 | 2026-10-29 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code l | |
CVE-2026-32198 |
high | 7.8 | 0.0030 | 2026-10-29 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code l |