Browse All CVEs
10,768 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-68076 |
medium | 5.4 | 0.0034 | 2026-10-29 | Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or | |
CVE-2026-68758 |
medium | 6.5 | 0.0035 | 2026-10-29 | A low-privileged authenticated user may access restricted support information under specif | |
CVE-2026-68969 |
medium | 6.5 | 0.0036 | 2026-10-29 | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in c | |
CVE-2026-68970 |
medium | 6.5 | 0.0023 | 2026-10-29 | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a li | |
CVE-2026-68971 |
medium | 6.5 | 0.0033 | 2026-10-29 | Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materiali | |
CVE-2026-69107 |
medium | 5.9 | 0.0041 | 2026-10-29 | An unauthenticated user may access restricted artifacts in JFrog Artifactory under specifi | |
CVE-2026-70547 |
medium | 4.3 | 0.0028 | 2026-10-29 | An authenticated user without repository read permission may access package metadata under | |
CVE-2026-16694 |
medium | 5.4 | 0.0023 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerabil | |
CVE-2026-18106 |
medium | 4.3 | 0.0050 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensiti | |
CVE-2026-18144 |
medium | 4.3 | 0.0032 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass securit | |
CVE-2026-18246 |
medium | 4.3 | 0.0032 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass securit | |
CVE-2026-73237 |
medium | 6.1 | 0.0079 | 2026-10-29 | XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura | |
CVE-2026-73238 |
medium | 6.1 | 0.0079 | 2026-10-29 | XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: bef | |
CVE-2026-73239 |
medium | 6.5 | 0.0062 | 2026-10-29 | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Arti | |
CVE-2026-73295 |
medium | 5.4 | 0.0033 | 2026-10-29 | Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2 | |
CVE-2026-73297 |
medium | 6.9 | 0.0290 | 2026-10-29 | Microsoft UFO open-source framework for intelligent automation across devices and platform | |
CVE-2026-17109 |
medium | 4.3 | 0.0045 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected | |
CVE-2026-17222 |
medium | 4.3 | 0.0034 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in | |
CVE-2026-17248 |
medium | 6.5 | 0.0047 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial | |
CVE-2026-17266 |
medium | 6.5 | 0.0066 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensiti | |
CVE-2026-17268 |
medium | 6.8 | 0.0034 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass securit | |
CVE-2026-17419 |
medium | 6.5 | 0.0042 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tab | |
CVE-2026-17420 |
medium | 6.3 | 0.0037 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass securit | |
CVE-2026-18250 |
medium | 5.0 | 0.0027 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensiti | |
CVE-2026-18673 |
medium | 5.3 | 0.0046 | 2026-10-29 | When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the | |
CVE-2026-18675 |
medium | 5.3 | 0.0056 | 2026-10-29 | The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JW | |
CVE-2026-18676 |
medium | 5.1 | 0.0030 | 2026-10-29 | The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signi | |
CVE-2026-18677 |
medium | 6.0 | 0.0058 | 2026-10-29 | In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template d | |
CVE-2026-18678 |
medium | 5.5 | 0.0013 | 2026-10-29 | When an operator adds an HTTPS control plane profile to kumactl without providing a CA cer | |
CVE-2026-17445 |
medium | 6.5 | 0.0041 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass securit | |
CVE-2026-18099 |
medium | 5.4 | 0.0033 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitr | |
CVE-2026-18148 |
medium | 4.3 | 0.0034 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitra | |
CVE-2026-18150 |
medium | 5.3 | 0.0028 | 2026-10-29 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensiti | |
CVE-2026-18679 |
medium | 5.8 | 0.0016 | 2026-10-29 | When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA | |
CVE-2026-19642 |
medium | 6.0 | 0.0050 | 2026-10-29 | An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 m | |
CVE-2026-19643 |
medium | 6.0 | 0.0056 | 2026-10-29 | An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, o | |
CVE-2026-19657 |
medium | 6.1 | 0.0028 | 2026-10-29 | ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. | |
CVE-2026-63295 |
medium | 4.3 | 0.0035 | 2026-10-29 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass pr | |
CVE-2026-72787 |
medium | 5.1 | 0.0026 | 2026-10-29 | Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in th | |
CVE-2026-72788 |
medium | 6.9 | 0.0038 | 2026-10-29 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILay | |
CVE-2026-72790 |
medium | 6.9 | 0.0032 | 2026-10-29 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook | |
CVE-2026-72791 |
medium | 6.9 | 0.0032 | 2026-10-29 | SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earl | |
CVE-2026-72792 |
medium | 6.9 | 0.0032 | 2026-10-29 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getT | |
CVE-2026-72796 |
medium | 6.9 | 0.0035 | 2026-10-29 | SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file rou | |
CVE-2026-72797 |
medium | 6.9 | 0.0030 | 2026-10-29 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEn | |
CVE-2026-72799 |
medium | 6.9 | 0.0032 | 2026-10-29 | SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five f | |
CVE-2026-72800 |
medium | 6.9 | 0.0032 | 2026-10-29 | SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeVi | |
CVE-2026-72802 |
medium | 6.9 | 0.0030 | 2026-10-29 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resol | |
CVE-2026-72803 |
medium | 6.9 | 0.0030 | 2026-10-29 | SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs a | |
CVE-2026-72805 |
medium | 6.9 | 0.0030 | 2026-10-29 | SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, |