Search
6,517 CVEs · High severity
CVEs (6,517, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 6,517 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-114137 | HIGH | Patched | 7.4 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses the proxy's user-id pk wh… |
| CVE-2026-114136 | HIGH | Patched | 7.5 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the client-supplied Content-Type chars… |
| CVE-2026-114135 | HIGH | Patched | 8.8 | 2026-10-21 | Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChan… |
| CVE-2026-112381 | HIGH | Patched | 5.9 | 2026-10-21 | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed fro… |
| CVE-2026-111815 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy… |
| CVE-2026-111814 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to pre… |
| CVE-2026-111812 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affect… |
| CVE-2026-111810 | HIGH | Patched | 7.5 | 2026-10-21 | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers ma… |
| CVE-2026-111808 | HIGH | Patched | 8.6 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.… |
| CVE-2026-111805 | HIGH | Patched | 8.6 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from… |
| CVE-2026-79976 | HIGH | 7.1 | 2026-10-21 | The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller first writes a register num… | |
| CVE-2026-78118 | HIGH | 7.0 | 2026-10-21 | The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the s… | |
| CVE-2026-19676 | HIGH | 7.8 | 2026-10-21 | The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the… | |
| CVE-2026-114268 | HIGH | 9.9 | 2026-10-21 | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of … | |
| CVE-2026-113870 | HIGH | 8.8 | 2026-10-21 | MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployme… | |
| CVE-2026-111804 | HIGH | Patched | 8.2 | 2026-10-21 | Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal st… |
| CVE-2026-110803 | HIGH | Patched | — | 2026-10-21 | VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying … |
| CVE-2026-107588 | HIGH | Patched | — | 2026-10-21 | Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove … |
| CVE-2026-105945 | HIGH | Patched | — | 2026-10-21 | The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names con… |
| CVE-2026-105942 | HIGH | Patched | — | 2026-10-21 | When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and t… |
| CVE-2026-105937 | HIGH | Patched | — | 2026-10-21 | Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting t… |
| CVE-2026-105934 | HIGH | Patched | — | 2026-10-21 | The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating … |
| CVE-2025-55702 | HIGH | Patched | 8.7 | 2026-10-21 | When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connect… |
| CVE-2026-92210 | HIGH | 7.2 | 2026-10-21 | NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on a… | |
| CVE-2026-92209 | HIGH | 7.8 | 2026-10-21 | NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations… |