Search
151,643 CVEs · High severity
CVEs (151,643, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 351–375 of 151,643 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-20356 | HIGH | 7.5 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive… | |
| CVE-2026-20291 | HIGH | 7.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive… | |
| CVE-2026-20236 | HIGH | 7.5 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive… | |
| CVE-2026-114123 | HIGH | Patched | 7.5 | 2026-10-21 | D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documen… |
| CVE-2026-114490 | HIGH | 7.8 | 2026-10-21 | Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of do… | |
| CVE-2026-114489 | HIGH | 8.1 | 2026-10-21 | Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote authenticated user whose credential is co… | |
| CVE-2026-114476 | HIGH | 7.5 | 2026-10-21 | Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the ma… | |
| CVE-2026-102486 | HIGH | 7.5 | 2026-10-21 | Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Ext… | |
| CVE-2026-102483 | HIGH | 7.5 | 2026-10-21 | Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields. | |
| CVE-2026-113779 | HIGH | 8.8 | 2026-10-21 | The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-p… | |
| CVE-2026-112221 | HIGH | 7.1 | 2026-10-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affect… | |
| CVE-2026-111848 | HIGH | 7.1 | 2026-10-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affe… | |
| CVE-2026-111840 | HIGH | 7.1 | 2026-10-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows R… | |
| CVE-2026-111838 | HIGH | 7.1 | 2026-10-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehunk-customizer allows Reflected X… | |
| CVE-2026-111833 | HIGH | 7.5 | 2026-10-21 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: … | |
| CVE-2026-104948 | HIGH | — | 2026-10-21 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions… | |
| CVE-2026-97313 | HIGH | 7.5 | 2026-10-21 | A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a deni… | |
| CVE-2026-96888 | HIGH | 7.5 | 2026-10-21 | A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue… | |
| CVE-2026-94300 | HIGH | 8.1 | 2026-10-21 | Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the ne… | |
| CVE-2026-82230 | HIGH | 7.5 | 2026-10-21 | Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nes… | |
| CVE-2026-19630 | HIGH | 7.5 | 2026-10-21 | In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a mal… | |
| CVE-2026-114405 | HIGH | Patched | — | 2026-10-21 | Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2. |
| CVE-2026-114400 | HIGH | 5.9 | 2026-10-21 | Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because … | |
| CVE-2026-114399 | HIGH | 6.5 | 2026-10-21 | Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/… | |
| CVE-2026-114397 | HIGH | 7.4 | 2026-10-21 | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them rem… |