Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 276–300 of 172,839 (capped at 500)
| CVE ID | Severity ↓ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114715 | MEDIUM | Patched | 6.8 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took… |
| CVE-2026-114641 | MEDIUM | Patched | 3.7 | 2026-10-22 | Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round… |
| CVE-2026-114656 | MEDIUM | Patched | 7.5 | 2026-10-22 | Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host… |
| CVE-2026-114657 | MEDIUM | Patched | 5.7 | 2026-10-22 | Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content… |
| CVE-2026-114577 | MEDIUM | 7.3 | 2026-10-22 | A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. Th… | |
| CVE-2026-114634 | MEDIUM | Patched | 4.3 | 2026-10-22 | WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-val… |
| CVE-2026-12664 | MEDIUM | Patched | 6.8 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, co… |
| CVE-2026-13319 | MEDIUM | Patched | 4.3 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authe… |
| CVE-2026-16255 | MEDIUM | Patched | 5.9 | 2026-10-22 | GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or … |
| CVE-2026-112378 | MEDIUM | Patched | 4.3 | 2026-10-22 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could h… |
| CVE-2026-114714 | MEDIUM | Patched | 5.3 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the s… |
| CVE-2026-105777 | MEDIUM | Patched | 4.3 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, … |
| CVE-2026-89052 | MEDIUM | — | 2026-10-21 | A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an… | |
| CVE-2026-76308 | MEDIUM | 6.5 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Spl… | |
| CVE-2026-76406 | MEDIUM | 5.9 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authenticatio… | |
| CVE-2026-76303 | MEDIUM | 5.7 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app docu… | |
| CVE-2026-76304 | MEDIUM | 4.3 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Bro… | |
| CVE-2026-76305 | MEDIUM | 6.5 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could e… | |
| CVE-2026-76292 | MEDIUM | 6.5 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that do… | |
| CVE-2026-76294 | MEDIUM | 4.3 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field … | |
| CVE-2026-76295 | MEDIUM | 4.3 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the … | |
| CVE-2026-76296 | MEDIUM | 4.3 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete so… | |
| CVE-2026-76297 | MEDIUM | 4.2 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capa… | |
| CVE-2026-76287 | MEDIUM | 5.4 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability co… | |
| CVE-2026-76289 | MEDIUM | 6.5 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise insta… |