Search
6,517 CVEs · High severity
CVEs (6,517, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 276–300 of 6,517 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-15723 | HIGH | Patched | 8.2 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP … |
| CVE-2026-112212 | HIGH | Patched | 7.5 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an… |
| CVE-2026-76530 | HIGH | 8.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a sof… | |
| CVE-2026-76307 | HIGH | 7.2 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer aut… | |
| CVE-2026-76306 | HIGH | 7.5 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes … | |
| CVE-2026-76298 | HIGH | 8.8 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser p… | |
| CVE-2026-76293 | HIGH | 7.2 | 2026-10-21 | In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-sys… | |
| CVE-2026-76291 | HIGH | 8.8 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards i… | |
| CVE-2026-76290 | HIGH | 7.5 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the… | |
| CVE-2026-76288 | HIGH | 7.5 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger end… | |
| CVE-2026-103090 | HIGH | Patched | — | 2026-10-21 | Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus… |
| CVE-2026-96778 | HIGH | Patched | — | 2026-10-21 | Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an … |
| CVE-2026-96644 | HIGH | Patched | — | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src… |
| CVE-2026-96643 | HIGH | Patched | — | 2026-10-21 | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Ex… |
| CVE-2026-96642 | HIGH | Patched | — | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that return… |
| CVE-2026-96640 | HIGH | Patched | — | 2026-10-21 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking du… |
| CVE-2026-96637 | HIGH | Patched | — | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size with… |
| CVE-2026-29001 | HIGH | 7.2 | 2026-10-21 | TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a seriali… | |
| CVE-2026-114145 | HIGH | Patched | 7.5 | 2026-10-21 | GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced sub… |
| CVE-2026-114144 | HIGH | Patched | 7.5 | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parse… |
| CVE-2026-114143 | HIGH | Patched | — | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing lon… |
| CVE-2026-114142 | HIGH | Patched | — | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString(… |
| CVE-2026-114141 | HIGH | Patched | — | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assigne… |
| CVE-2026-114140 | HIGH | Patched | — | 2026-10-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconv… |
| CVE-2026-114138 | HIGH | Patched | 7.5 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded n… |