Search
4,652 CVEs
CVEs (4,652, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 251–275 of 4,652 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114509 | CRITICAL | Patched | — | 2026-10-21 | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credent… |
| CVE-2026-105869 | CRITICAL | Patched | — | 2026-10-21 | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with… |
| CVE-2026-43838 | CRITICAL | — | 2026-10-20 | A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution. | |
| CVE-2026-43845 | CRITICAL | — | 2026-10-20 | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism. | |
| CVE-2026-112900 | CRITICAL | Patched | — | 2026-10-19 | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript … |
| CVE-2026-112398 | CRITICAL | Patched | — | 2026-10-19 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG d… |
| CVE-2026-112403 | CRITICAL | Patched | — | 2026-10-19 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecod… |
| CVE-2026-112393 | CRITICAL | Patched | — | 2026-10-19 | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data … |
| CVE-2026-107685 | CRITICAL | Patched | — | 2026-10-23 | Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions… |
| CVE-2026-115547 | CRITICAL | 9.1 | 2026-10-23 | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator c… | |
| CVE-2026-109122 | CRITICAL | 9.1 | 2026-10-22 | The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An a… | |
| CVE-2026-105014 | CRITICAL | 9.1 | 2026-10-22 | Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-114611 | CRITICAL | 9.1 | 2026-10-22 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollme… | |
| CVE-2026-114607 | CRITICAL | Patched | 9.1 | 2026-10-22 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, … |
| CVE-2022-51022 | HIGH | Patched | 9.1 | 2026-10-22 | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers… |
| CVE-2026-114220 | CRITICAL | 9.1 | 2026-10-22 | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle at… | |
| CVE-2026-96355 | CRITICAL | 9.1 | 2026-10-22 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0… | |
| CVE-2026-91403 | CRITICAL | 9.1 | 2026-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are aff… | |
| CVE-2026-114139 | CRITICAL | Patched | — | 2026-10-21 | Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips applicatio… |
| CVE-2026-87095 | CRITICAL | 9.1 | 2026-10-21 | Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build… | |
| CVE-2026-91655 | CRITICAL | 9.1 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attack… | |
| CVE-2026-91656 | CRITICAL | 9.1 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privi… | |
| CVE-2026-91624 | CRITICAL | 9.1 | 2026-10-20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version t… | |
| CVE-2026-91490 | CRITICAL | 9.1 | 2026-10-20 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 a… | |
| CVE-2026-91341 | CRITICAL | 9.1 | 2026-10-20 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is… |