Search
4,651 CVEs
EOL hidden · Show all products
CVEs (4,651, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 476–500 of 4,651 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-59188 | MEDIUM | Patched | 5.4 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-contro… |
| CVE-2026-55835 | MEDIUM | Patched | — | 2026-10-23 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated… |
| CVE-2026-115497 | HIGH | 7.5 | 2026-10-23 | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter.… | |
| CVE-2026-109198 | HIGH | 7.2 | 2026-10-23 | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all version… | |
| CVE-2026-90458 | MEDIUM | Patched | 5.4 | 2026-10-23 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service. |
| CVE-2026-89419 | MEDIUM | Patched | 5.0 | 2026-10-23 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific m… |
| CVE-2026-55600 | MEDIUM | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |… |
| CVE-2026-54631 | MEDIUM | Patched | 6.3 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed… |
| CVE-2026-54630 | CRITICAL | Patched | 9.6 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the… |
| CVE-2026-54615 | MEDIUM | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column… |
| CVE-2026-115638 | MEDIUM | 4.3 | 2026-10-23 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb. | |
| CVE-2026-115547 | CRITICAL | 9.1 | 2026-10-23 | An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator c… | |
| CVE-2026-115546 | HIGH | 8.1 | 2026-10-23 | Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication so… | |
| CVE-2026-19678 | HIGH | — | 2026-10-23 | A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to acce… | |
| CVE-2026-19677 | CRITICAL | — | 2026-10-23 | An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbit… | |
| CVE-2026-115537 | LOW | 4.3 | 2026-10-23 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/mo… | |
| CVE-2026-115536 | LOW | 4.3 | 2026-10-23 | A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the fil… | |
| CVE-2026-115535 | LOW | 2.4 | 2026-10-23 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of … | |
| CVE-2026-115486 | HIGH | 7.1 | 2026-10-23 | A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the pa… | |
| CVE-2026-115485 | MEDIUM | 6.3 | 2026-10-23 | A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing … | |
| CVE-2026-115484 | HIGH | 7.6 | 2026-10-23 | A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allo… | |
| CVE-2026-115534 | LOW | 4.3 | 2026-10-23 | A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modu… | |
| CVE-2026-92450 | HIGH | 7.5 | 2026-10-22 | The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within… | |
| CVE-2026-110825 | HIGH | 7.5 | 2026-10-22 | The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regard… | |
| CVE-2026-110491 | MEDIUM | 7.5 | 2026-10-22 | The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connect… |