Search
14,262 CVEs · Medium severity
CVEs (14,262, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 14,262 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-114441 | MEDIUM | 7.3 | 2026-10-21 | A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argu… | |
| CVE-2026-114440 | MEDIUM | 7.3 | 2026-10-21 | A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_i… | |
| CVE-2026-114439 | MEDIUM | 7.3 | 2026-10-21 | A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Se… | |
| CVE-2026-100420 | MEDIUM | — | 2026-10-21 | A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account passwor… | |
| CVE-2026-114508 | MEDIUM | Patched | 6.5 | 2026-10-21 | Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a destructive database op… |
| CVE-2026-114501 | MEDIUM | Patched | — | 2026-10-21 | Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when … |
| CVE-2026-96641 | MEDIUM | Patched | 6.5 | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX but does not check neg… |
| CVE-2026-96638 | MEDIUM | Patched | 6.5 | 2026-10-21 | Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta escapes and absolute-mode run… |
| CVE-2026-96636 | MEDIUM | Patched | 6.5 | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Im… |
| CVE-2026-114406 | MEDIUM | 6.8 | 2026-10-21 | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which … | |
| CVE-2026-114379 | MEDIUM | 5.4 | 2026-10-21 | A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/con… | |
| CVE-2026-85518 | MEDIUM | 6.1 | 2026-10-21 | A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path t… | |
| CVE-2026-114438 | MEDIUM | 4.2 | 2026-10-21 | A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP act… | |
| CVE-2026-114362 | MEDIUM | 6.3 | 2026-10-21 | A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipu… | |
| CVE-2026-111817 | MEDIUM | Patched | 5.3 | 2026-10-21 | Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out… |
| CVE-2026-111809 | MEDIUM | Patched | 9.3 | 2026-10-21 | Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 thr… |
| CVE-2026-78119 | MEDIUM | 6.3 | 2026-10-21 | The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length field directly out of the … | |
| CVE-2026-78117 | MEDIUM | 4.2 | 2026-10-21 | The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cy_stc_b… | |
| CVE-2026-78116 | MEDIUM | 5.2 | 2026-10-21 | The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In data_ready_work_handler() (drivers/sensor/broad… | |
| CVE-2026-19947 | MEDIUM | 5.3 | 2026-10-21 | The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When CONFIG_USERSPACE is enabled… | |
| CVE-2026-114361 | MEDIUM | 5.6 | 2026-10-21 | A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipu… | |
| CVE-2026-114267 | MEDIUM | 7.3 | 2026-10-21 | A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results i… | |
| CVE-2026-113461 | MEDIUM | — | 2026-10-21 | Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or… | |
| CVE-2026-111401 | MEDIUM | 6.5 | 2026-10-21 | Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/… | |
| CVE-2026-105936 | MEDIUM | Patched | — | 2026-10-21 | The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoin… |