Search
151,267 CVEs · High severity
EOL hidden · Show all products
CVEs (151,267, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 151,267 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-106069 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the hos… | |
| CVE-2026-105483 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written … | |
| CVE-2026-105482 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fi… | |
| CVE-2026-57845 | HIGH | 8.8 | 2026-10-23 | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle… | |
| CVE-2026-58497 | HIGH | Patched | — | 2026-10-23 | Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the lega… |
| CVE-2026-55459 | HIGH | Patched | 7.4 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.ve… |
| CVE-2026-55457 | HIGH | Patched | 7.4 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empt… |
| CVE-2026-54668 | HIGH | Patched | — | 2026-10-23 | Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.… |
| CVE-2026-39902 | HIGH | Patched | 7.2 | 2026-10-23 | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirec… |
| CVE-2026-115478 | HIGH | Patched | — | 2026-10-23 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlin… |
| CVE-2026-115477 | HIGH | Patched | — | 2026-10-23 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` co… |
| CVE-2026-106765 | HIGH | 7.5 | 2026-10-23 | An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. | |
| CVE-2026-106764 | HIGH | 7.5 | 2026-10-23 | An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. | |
| CVE-2026-106763 | HIGH | 7.5 | 2026-10-23 | An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. | |
| CVE-2026-102786 | HIGH | — | 2026-10-23 | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 | |
| CVE-2026-93640 | HIGH | 7.8 | 2026-10-23 | A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root pri… | |
| CVE-2026-93639 | HIGH | 8.7 | 2026-10-23 | A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet… | |
| CVE-2026-93631 | HIGH | 7.1 | 2026-10-23 | A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled exte… | |
| CVE-2026-55826 | HIGH | Patched | — | 2026-10-23 | The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tr… |
| CVE-2026-53920 | HIGH | Patched | — | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or… |
| CVE-2026-53918 | HIGH | Patched | — | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer … |
| CVE-2026-50057 | HIGH | 7.8 | 2026-10-23 | A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The ins… | |
| CVE-2026-50056 | HIGH | 7.8 | 2026-10-23 | A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as… | |
| CVE-2026-50053 | HIGH | 8.7 | 2026-10-23 | A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted i… | |
| CVE-2026-115481 | HIGH | — | 2026-10-23 | baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `con… |