Search
43,412 CVEs
CVEs (43,412, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 401–425 of 43,412 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-62129 | CRITICAL | 9.9 | 2026-10-10 | Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. | |
| CVE-2026-62024 | CRITICAL | 9.9 | 2026-10-10 | Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions. | |
| CVE-2026-108263 | CRITICAL | Patched | 9.9 | 2026-10-09 | Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run … |
| CVE-2026-94510 | CRITICAL | 9.9 | 2026-10-08 | Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-106126 | CRITICAL | 9.9 | 2026-10-08 | A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute ar… | |
| CVE-2026-79798 | CRITICAL | 9.9 | 2026-10-06 | SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL in… | |
| CVE-2026-67269 | CRITICAL | Patched | 9.9 | 2026-10-06 | Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resourc… |
| CVE-2026-39755 | CRITICAL | 9.9 | 2026-10-06 | Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions. | |
| CVE-2026-39757 | CRITICAL | 9.9 | 2026-10-06 | Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions. | |
| CVE-2026-39759 | CRITICAL | 9.9 | 2026-10-06 | Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions. | |
| CVE-2026-32568 | CRITICAL | 9.9 | 2026-10-06 | Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions. | |
| CVE-2026-105778 | HIGH | 9.9 | 2026-10-06 | A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handl… | |
| CVE-2026-105697 | CRITICAL | Patched | 9.9 | 2026-10-05 | Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put i… |
| CVE-2026-105740 | CRITICAL | Patched | 9.9 | 2026-10-05 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on th… |
| CVE-2026-105691 | CRITICAL | Patched | 9.9 | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask… |
| CVE-2026-105636 | CRITICAL | Patched | 9.9 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_red… |
| CVE-2026-105080 | CRITICAL | Patched | 9.9 | 2026-10-03 | In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable cod… |
| CVE-2026-82041 | MEDIUM | Patched | 9.9 | 2026-10-02 | UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP … |
| CVE-2026-90970 | CRITICAL | Patched | 9.9 | 2026-10-02 | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 be… |
| CVE-2026-93698 | CRITICAL | 9.9 | 2026-10-02 | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | |
| CVE-2026-79901 | CRITICAL | 9.9 | 2026-10-01 | In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequenc… | |
| CVE-2026-102911 | CRITICAL | 9.9 | 2026-09-30 | A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing… | |
| CVE-2026-84154 | CRITICAL | 9.9 | 2026-09-29 | A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to exec… | |
| CVE-2026-87799 | CRITICAL | Patched | 9.9 | 2026-09-28 | Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated c… |
| CVE-2026-85526 | CRITICAL | 9.9 | 2026-09-28 | Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbi… |