Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 476–500 of 172,839 (capped at 500)
| CVE ID | Severity ↓ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114064 | MEDIUM | Patched | 5.5 | 2026-10-21 | Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses,… |
| CVE-2026-114056 | MEDIUM | Patched | 4.3 | 2026-10-21 | ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags witho… |
| CVE-2026-114057 | MEDIUM | Patched | 4.3 | 2026-10-21 | ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database na… |
| CVE-2026-114058 | MEDIUM | Patched | 4.3 | 2026-10-21 | ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema m… |
| CVE-2026-114048 | MEDIUM | Patched | 3.5 | 2026-10-21 | WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check… |
| CVE-2026-114049 | MEDIUM | Patched | 3.7 | 2026-10-21 | vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_tok… |
| CVE-2026-114038 | MEDIUM | 5.1 | 2026-10-21 | A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character… | |
| CVE-2026-114041 | MEDIUM | Patched | 6.5 | 2026-10-21 | FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a byte count as wide-character printf precision. A mal… |
| CVE-2026-114044 | MEDIUM | Patched | 5.3 | 2026-10-21 | FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying u… |
| CVE-2021-48019 | MEDIUM | Patched | 4.8 | 2026-10-21 | Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return da… |
| CVE-2020-37288 | MEDIUM | Patched | 3.7 | 2026-10-21 | Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing… |
| CVE-2020-37289 | MEDIUM | Patched | 3.7 | 2026-10-21 | Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checki… |
| CVE-2026-113707 | MEDIUM | 5.4 | 2026-10-21 | A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/i… | |
| CVE-2026-113706 | MEDIUM | 3.5 | 2026-10-21 | A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the … | |
| CVE-2026-109682 | MEDIUM | Patched | 4.7 | 2026-10-21 | Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect desti… |
| CVE-2026-109681 | MEDIUM | 4.7 | 2026-10-21 | The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Pas… | |
| CVE-2026-113705 | MEDIUM | 5.3 | 2026-10-20 | A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation ca… | |
| CVE-2026-93744 | MEDIUM | 6.5 | 2026-10-20 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HT… | |
| CVE-2026-94402 | MEDIUM | 6.1 | 2026-10-20 | IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supp… | |
| CVE-2026-91657 | MEDIUM | 4.3 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attack… | |
| CVE-2026-91660 | MEDIUM | 4.3 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attack… | |
| CVE-2026-91662 | MEDIUM | 6.4 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privile… | |
| CVE-2026-91648 | MEDIUM | 5.3 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticat… | |
| CVE-2026-91649 | MEDIUM | 6.0 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileg… | |
| CVE-2026-91652 | MEDIUM | 5.0 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attack… |