Browse All CVEs
13,586 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-114104 |
high | 8.2 | 0.0033 | 2026-10-29 | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows a | |
CVE-2026-114106 |
high | 8.7 | 0.0043 | 2026-10-29 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that al | |
CVE-2026-114107 |
high | 8.7 | 0.0058 | 2026-10-29 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerabi | |
CVE-2026-114109 |
high | 8.7 | 0.0038 | 2026-10-29 | uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to | |
CVE-2026-114110 |
high | 8.7 | 0.0035 | 2026-10-29 | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to d | |
CVE-2026-114111 |
high | 8.9 | 0.0013 | 2026-10-29 | sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerabilit | |
CVE-2026-114112 |
high | 8.9 | 0.0024 | 2026-10-29 | Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achie | |
CVE-2026-114113 |
high | 8.4 | 0.0011 | 2026-10-29 | Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE | |
CVE-2026-114117 |
high | 8.2 | 0.0029 | 2026-10-29 | Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) | |
CVE-2026-114197 |
high | 8.7 | 0.0015 | 2026-10-29 | Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arb | |
CVE-2026-114198 |
high | 8.7 | 0.0015 | 2026-10-29 | Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arb | |
CVE-2026-82814 |
high | 8.8 | 0.0073 | 2026-10-29 | The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injec | |
CVE-2026-82819 |
high | 7.1 | 0.0046 | 2026-10-29 | A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform | |
CVE-2026-111074 |
high | 8.7 | 0.0042 | 2026-10-29 | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre | |
CVE-2026-111075 |
high | 8.7 | 0.0037 | 2026-10-29 | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross | |
CVE-2026-110938 |
high | 8.7 | 0.0042 | 2026-10-29 | In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial o | |
CVE-2026-70386 |
high | 8.5 | 0.0138 | 2026-10-29 | Improper neutralization of special elements used in an OS command ('OS command injection') | |
CVE-2026-70387 |
high | 8.4 | 0.0031 | 2026-10-29 | Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus | |
CVE-2026-97206 |
high | 7.5 | 0.0033 | 2026-10-29 | 1 PoC | NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (D |
CVE-2026-41114 |
high | 7.5 | 0.0056 | 2026-10-29 | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue | |
CVE-2026-54425 |
high | 7.5 | 0.0065 | 2026-10-29 | Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows rem | |
CVE-2026-54426 |
high | 7.5 | 0.0046 | 2026-10-29 | Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote R | |
CVE-2026-54427 |
high | 7.5 | 0.0051 | 2026-10-29 | Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer | |
CVE-2026-56386 |
high | 7.5 | 0.0073 | 2026-10-29 | Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache | |
CVE-2026-56387 |
high | 7.5 | 0.0060 | 2026-10-29 | The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly fr | |
CVE-2026-58064 |
high | 7.5 | 0.0057 | 2026-10-29 | The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocat | |
CVE-2026-59229 |
high | 8.8 | 0.0045 | 2026-10-29 | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER ( | |
CVE-2026-61902 |
high | 7.5 | 0.0048 | 2026-10-29 | Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_siz | |
CVE-2026-61916 |
high | 7.5 | 0.0057 | 2026-10-29 | Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC befor | |
CVE-2026-74755 |
high | 7.5 | 0.0057 | 2026-10-29 | An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all p | |
CVE-2026-74757 |
high | 7.5 | 0.0063 | 2026-10-29 | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18 | |
CVE-2026-74758 |
high | 7.5 | 0.0065 | 2026-10-29 | A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) al | |
CVE-2026-78048 |
high | 7.5 | 0.0063 | 2026-10-29 | A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) | |
CVE-2026-78058 |
high | 7.5 | 0.0081 | 2026-10-29 | Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version | |
CVE-2026-78066 |
high | 7.5 | 0.0051 | 2026-10-29 | Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers t | |
CVE-2026-79704 |
high | 7.5 | 0.0051 | 2026-10-29 | An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (ver | |
CVE-2026-80463 |
high | 7.5 | 0.0057 | 2026-10-29 | Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (versio | |
CVE-2026-81755 |
high | 7.5 | 0.0073 | 2026-10-29 | Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < | |
CVE-2026-114387 |
high | 8.7 | 0.0032 | 2026-10-29 | Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows | |
CVE-2026-114391 |
high | 7.1 | 0.0030 | 2026-10-29 | ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOp | |
CVE-2026-114396 |
high | 7.1 | 0.0050 | 2026-10-29 | Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allo | |
CVE-2026-114397 |
high | 8.3 | 0.0063 | 2026-10-29 | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes ena | |
CVE-2026-114399 |
high | 7.0 | 0.0059 | 2026-10-29 | Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators | |
CVE-2026-114400 |
high | 8.2 | 0.0050 | 2026-10-29 | Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthe | |
CVE-2026-114405 |
high | 8.7 | 0.0034 | 2026-10-29 | Improper validation of array index vulnerability in Velneo vServer. This issue affects vSe | |
CVE-2026-19630 |
high | 7.5 | 0.0045 | 2026-10-29 | In a BIND resolver, inbound DNS protocol messages with a particular structure will result | |
CVE-2026-82210 |
high | 7.5 | 0.0050 | 2026-10-29 | Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all pl | |
CVE-2026-82230 |
high | 7.5 | 0.0055 | 2026-10-29 | Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all | |
CVE-2026-82231 |
high | 7.5 | 0.0042 | 2026-10-29 | A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by d | |
CVE-2026-82425 |
high | 7.5 | 0.0042 | 2026-10-29 | A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a maliciou |