Search
4,652 CVEs
CVEs (4,652, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 326–350 of 4,652 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-20043 | CRITICAL | 9.0 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive… | |
| CVE-2025-31699 | CRITICAL | Patched | 8.9 | 2026-10-21 | Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, inclu… |
| CVE-2026-114111 | HIGH | Patched | — | 2026-10-21 | sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to co… |
| CVE-2026-114112 | HIGH | Patched | — | 2026-10-21 | Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images… |
| CVE-2026-115935 | HIGH | 8.8 | 2026-10-23 | The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can pl… | |
| CVE-2026-115938 | HIGH | 8.8 | 2026-10-23 | Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s… | |
| CVE-2026-115895 | HIGH | Patched | 8.8 | 2026-10-23 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleComp… |
| CVE-2026-79982 | HIGH | 8.8 | 2026-10-23 | The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buf… | |
| CVE-2026-57845 | HIGH | 8.8 | 2026-10-23 | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle… | |
| CVE-2026-53918 | HIGH | Patched | — | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer … |
| CVE-2026-114621 | HIGH | Patched | 8.8 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request… |
| CVE-2026-57144 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforc… |
| CVE-2026-55888 | HIGH | Patched | — | 2026-10-23 | XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary fil… |
| CVE-2026-57117 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and … |
| CVE-2026-56840 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the … |
| CVE-2026-56832 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any… |
| CVE-2026-89320 | HIGH | — | 2026-10-23 | `HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verifi… | |
| CVE-2025-30052 | HIGH | — | 2026-10-23 | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker… | |
| CVE-2026-79877 | HIGH | 8.8 | 2026-10-22 | A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected… | |
| CVE-2026-79878 | HIGH | 8.8 | 2026-10-22 | A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attac… | |
| CVE-2026-79879 | HIGH | 8.8 | 2026-10-22 | Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation c… | |
| CVE-2026-108357 | HIGH | Patched | — | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlSc… |
| CVE-2026-108358 | HIGH | Patched | — | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/R… |
| CVE-2026-115330 | HIGH | 8.8 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom… | |
| CVE-2026-115331 | HIGH | 8.8 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name o… |