Search
133,141 CVEs · High severity
EOL hidden · Show all products
CVEs (133,141, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 133,141 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-16756 | HIGH | Patched | 7.5 | 2026-07-23 | Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote a… |
| CVE-2026-65919 | HIGH | Patched | 7.5 | 2026-07-23 | Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-suppli… |
| CVE-2026-65918 | HIGH | Patched | 7.1 | 2026-07-23 | PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes un… |
| CVE-2026-65702 | HIGH | 8.6 | 2026-07-23 | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write… | |
| CVE-2026-47743 | HIGH | 8.7 | 2026-07-23 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stor… | |
| CVE-2026-44909 | HIGH | 7.5 | 2026-07-23 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by sett… | |
| CVE-2026-65917 | HIGH | Patched | 8.8 | 2026-07-23 | CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup hand… |
| CVE-2026-65916 | HIGH | Patched | 8.1 | 2026-07-23 | CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kil… |
| CVE-2026-16584 | HIGH | Patched | 7.0 | 2026-07-23 | Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execu… |
| CVE-2026-43823 | HIGH | Patched | 7.5 | 2026-07-23 | When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a c… |
| CVE-2026-65898 | HIGH | Patched | 7.2 | 2026-07-23 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the s… |
| CVE-2026-65690 | HIGH | Patched | 8.8 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attac… |
| CVE-2026-14257 | HIGH | Patched | 7.5 | 2026-07-23 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,00… |
| CVE-2026-65908 | HIGH | Patched | 8.6 | 2026-07-23 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open |
| CVE-2026-65906 | HIGH | Patched | 8.8 | 2026-07-23 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible |
| CVE-2026-65897 | HIGH | Patched | 8.8 | 2026-07-23 | Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invite… |
| CVE-2026-65896 | HIGH | Patched | 7.1 | 2026-07-23 | Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController… |
| CVE-2026-65895 | HIGH | Patched | 8.5 | 2026-07-23 | Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write pr… |
| CVE-2026-65608 | HIGH | Patched | 8.8 | 2026-07-23 | Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling c… |
| CVE-2026-65540 | HIGH | 7.1 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions. | |
| CVE-2026-65539 | HIGH | 7.1 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. | |
| CVE-2026-65532 | HIGH | 7.6 | 2026-07-23 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | |
| CVE-2026-65526 | HIGH | 8.5 | 2026-07-23 | Contributor SQL Injection in Visualizer <= 4.0.6 versions. | |
| CVE-2026-65516 | HIGH | 7.2 | 2026-07-23 | Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions. | |
| CVE-2026-65511 | HIGH | 7.1 | 2026-07-23 | Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. |