Search
35,912 CVEs · Medium severity
CVEs (35,912, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 35,912 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-46346 | MEDIUM | Patched | 6.5 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based… |
| CVE-2026-112333 | MEDIUM | Patched | 5.4 | 2026-10-23 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inj… |
| CVE-2026-93638 | MEDIUM | 6.1 | 2026-10-23 | A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zr… | |
| CVE-2026-93636 | MEDIUM | 4.3 | 2026-10-23 | An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources throu… | |
| CVE-2026-93634 | MEDIUM | 4.3 | 2026-10-23 | A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbo… | |
| CVE-2026-93633 | MEDIUM | 5.4 | 2026-10-23 | A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-control… | |
| CVE-2026-93630 | MEDIUM | 4.3 | 2026-10-23 | A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on for… | |
| CVE-2026-93629 | MEDIUM | 5.3 | 2026-10-23 | An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another us… | |
| CVE-2026-93628 | MEDIUM | 5.3 | 2026-10-23 | An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's r… | |
| CVE-2026-93627 | MEDIUM | 5.3 | 2026-10-23 | An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an exist… | |
| CVE-2026-57208 | MEDIUM | Patched | — | 2026-10-23 | Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access t… |
| CVE-2026-57207 | MEDIUM | Patched | 5.9 | 2026-10-23 | NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentica… |
| CVE-2026-55606 | MEDIUM | 6.5 | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a netwo… | |
| CVE-2026-115786 | MEDIUM | 6.5 | 2026-10-23 | A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and … | |
| CVE-2026-115785 | MEDIUM | 4.3 | 2026-10-23 | An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account opti… | |
| CVE-2026-115480 | MEDIUM | Patched | 5.3 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.jso… |
| CVE-2026-115479 | MEDIUM | Patched | 5.3 | 2026-10-23 | baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in … |
| CVE-2026-114623 | MEDIUM | Patched | 6.5 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse … |
| CVE-2026-55422 | MEDIUM | 4.6 | 2026-10-23 | conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings dir… | |
| CVE-2026-55190 | MEDIUM | 6.5 | 2026-10-23 | Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the … | |
| CVE-2026-115751 | MEDIUM | Patched | 3.7 | 2026-10-23 | Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist usin… |
| CVE-2026-115750 | MEDIUM | Patched | 3.7 | 2026-10-23 | mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() … |
| CVE-2026-115749 | MEDIUM | Patched | 3.3 | 2026-10-23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passi… |
| CVE-2026-94263 | MEDIUM | 4.8 | 2026-10-23 | The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in … | |
| CVE-2026-115722 | MEDIUM | 6.1 | 2026-10-23 | RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_property() that accepts list as a list property's length or value type. Atta… |