Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 226–250 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-119128 | CRITICAL | Patched | 7.4 | 2026-10-29 | ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users la… |
| CVE-2026-119127 | HIGH | Patched | 8.1 | 2026-10-29 | ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and em… |
| CVE-2026-119126 | LOW | Patched | 3.1 | 2026-10-29 | Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored … |
| CVE-2026-119125 | LOW | Patched | 3.1 | 2026-10-29 | Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients… |
| CVE-2026-119124 | MEDIUM | Patched | 3.3 | 2026-10-29 | ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacke… |
| CVE-2026-119123 | MEDIUM | Patched | 3.7 | 2026-10-29 | ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image f… |
| CVE-2026-119122 | MEDIUM | Patched | 5.3 | 2026-10-29 | Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_c… |
| CVE-2026-119121 | MEDIUM | Patched | 4.3 | 2026-10-29 | Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in… |
| CVE-2026-119120 | HIGH | Patched | 7.5 | 2026-10-29 | Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which … |
| CVE-2026-119119 | HIGH | Patched | 7.5 | 2026-10-29 | Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, an… |
| CVE-2026-119118 | HIGH | Patched | 6.5 | 2026-10-29 | Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to intercept crawls because Chromium always launches with --ig… |
| CVE-2026-118673 | MEDIUM | Patched | — | 2026-10-29 | KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authori… |
| CVE-2026-118085 | HIGH | 7.1 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions. | |
| CVE-2026-118084 | MEDIUM | 6.5 | 2026-10-29 | Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions. | |
| CVE-2026-118083 | HIGH | 7.5 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | |
| CVE-2026-118082 | HIGH | 8.8 | 2026-10-29 | Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. | |
| CVE-2026-118081 | HIGH | 8.8 | 2026-10-29 | Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | |
| CVE-2026-118080 | HIGH | 8.8 | 2026-10-29 | Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | |
| CVE-2026-118079 | HIGH | 7.2 | 2026-10-29 | Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions. | |
| CVE-2026-118078 | HIGH | 7.2 | 2026-10-29 | Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. | |
| CVE-2026-118077 | HIGH | 7.2 | 2026-10-29 | Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. | |
| CVE-2026-118076 | HIGH | 8.8 | 2026-10-29 | Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | |
| CVE-2026-118075 | HIGH | 8.8 | 2026-10-29 | Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | |
| CVE-2026-118074 | HIGH | 7.2 | 2026-10-29 | Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. | |
| CVE-2026-118073 | HIGH | 8.8 | 2026-10-29 | Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. |