Search
151,644 CVEs · High severity
CVEs (151,644, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 151,644 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114143 | HIGH | Patched | — | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing lon… |
| CVE-2026-114135 | HIGH | Patched | 8.8 | 2026-10-21 | Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChan… |
| CVE-2026-114136 | HIGH | Patched | 7.5 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type chars… |
| CVE-2026-111812 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affect… |
| CVE-2026-111814 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to pre… |
| CVE-2026-111815 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy… |
| CVE-2026-112381 | HIGH | Patched | 5.9 | 2026-10-21 | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed fro… |
| CVE-2026-111805 | HIGH | Patched | 8.6 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from… |
| CVE-2026-111808 | HIGH | Patched | 8.6 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.… |
| CVE-2026-111810 | HIGH | Patched | 7.5 | 2026-10-21 | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers ma… |
| CVE-2026-79976 | HIGH | 7.1 | 2026-10-21 | The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register num… | |
| CVE-2026-78118 | HIGH | 7.0 | 2026-10-21 | The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the s… | |
| CVE-2026-19676 | HIGH | 7.8 | 2026-10-21 | The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the… | |
| CVE-2026-113870 | HIGH | 8.8 | 2026-10-21 | MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployme… | |
| CVE-2026-114268 | HIGH | 9.9 | 2026-10-21 | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of … | |
| CVE-2026-111804 | HIGH | Patched | 8.2 | 2026-10-21 | Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal st… |
| CVE-2026-110803 | HIGH | Patched | — | 2026-10-21 | VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying … |
| CVE-2026-105942 | HIGH | Patched | — | 2026-10-21 | When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and t… |
| CVE-2026-105945 | HIGH | Patched | — | 2026-10-21 | The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names con… |
| CVE-2026-107588 | HIGH | Patched | — | 2026-10-21 | Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove … |
| CVE-2026-105934 | HIGH | Patched | — | 2026-10-21 | The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating … |
| CVE-2026-105937 | HIGH | Patched | — | 2026-10-21 | Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting t… |
| CVE-2025-55702 | HIGH | Patched | 8.7 | 2026-10-21 | When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connect… |
| CVE-2026-92206 | HIGH | 8.8 | 2026-10-21 | CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… | |
| CVE-2026-92207 | HIGH | 8.8 | 2026-10-21 | MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mi… |