Search
4,652 CVEs
CVEs (4,652, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 226–250 of 4,652 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-30054 | CRITICAL | — | 2026-10-23 | CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its … | |
| CVE-2026-19677 | CRITICAL | — | 2026-10-23 | An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbit… | |
| CVE-2026-79876 | CRITICAL | 9.3 | 2026-10-22 | A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. S… | |
| CVE-2026-79873 | CRITICAL | 9.3 | 2026-10-22 | Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Succes… | |
| CVE-2026-79874 | CRITICAL | 9.3 | 2026-10-22 | An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allo… | |
| CVE-2026-79875 | CRITICAL | 9.3 | 2026-10-22 | A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication co… | |
| CVE-2026-112327 | CRITICAL | 9.3 | 2026-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Ameli… | |
| CVE-2026-111809 | MEDIUM | Patched | 9.3 | 2026-10-21 | Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 thr… |
| CVE-2026-111816 | CRITICAL | Patched | 9.3 | 2026-10-21 | Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the reje… |
| CVE-2026-76475 | CRITICAL | 9.3 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisc… | |
| CVE-2026-111852 | CRITICAL | 9.3 | 2026-10-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.… | |
| CVE-2026-91644 | CRITICAL | 9.3 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attac… | |
| CVE-2026-91622 | CRITICAL | 9.3 | 2026-10-20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version t… | |
| CVE-2026-91230 | CRITICAL | 9.3 | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. E… | |
| CVE-2026-93475 | CRITICAL | — | 2026-10-20 | The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO… | |
| CVE-2026-86471 | CRITICAL | Patched | — | 2026-10-20 | An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB o… |
| CVE-2026-113703 | CRITICAL | Patched | 9.3 | 2026-10-20 | SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication() in api_service/auth/middlewar… |
| CVE-2026-9589 | CRITICAL | — | 2026-10-20 | Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud de… | |
| CVE-2026-43844 | CRITICAL | — | 2026-10-20 | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism. | |
| CVE-2026-43836 | CRITICAL | — | 2026-10-20 | A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges. | |
| CVE-2026-113380 | CRITICAL | Patched | — | 2026-10-20 | In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio … |
| CVE-2026-102503 | CRITICAL | Patched | — | 2026-10-19 | Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) i… |
| CVE-2026-103091 | CRITICAL | Patched | — | 2026-10-19 | Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC r… |
| CVE-2026-109894 | CRITICAL | 9.3 | 2026-10-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Bo… | |
| CVE-2026-111497 | CRITICAL | — | 2026-10-22 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attack… |