Search
151,643 CVEs · High severity
CVEs (151,643, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 51–75 of 151,643 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115457 | HIGH | Patched | 7.1 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, includi… |
| CVE-2026-114624 | HIGH | Patched | 7.2 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value … |
| CVE-2026-114622 | HIGH | Patched | 7.2 | 2026-10-23 | baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in Them… |
| CVE-2026-114621 | HIGH | Patched | 8.8 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request… |
| CVE-2026-114356 | HIGH | — | 2026-10-23 | Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application w… | |
| CVE-2026-114355 | HIGH | — | 2026-10-23 | OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged pro… | |
| CVE-2026-114354 | HIGH | — | 2026-10-23 | Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allow… | |
| CVE-2026-114353 | HIGH | — | 2026-10-23 | Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physi… | |
| CVE-2026-10632 | HIGH | 8.7 | 2026-10-23 | A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages pa… | |
| CVE-2026-63120 | HIGH | Patched | 8.4 | 2026-10-23 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoar… |
| CVE-2026-57210 | HIGH | Patched | — | 2026-10-23 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extra… |
| CVE-2026-57209 | HIGH | Patched | — | 2026-10-23 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwa… |
| CVE-2026-57146 | HIGH | Patched | 7.5 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event stream… |
| CVE-2026-57144 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforc… |
| CVE-2026-57142 | HIGH | Patched | 7.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block defa… |
| CVE-2026-57121 | HIGH | Patched | 8.1 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects… |
| CVE-2026-57117 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and … |
| CVE-2026-57114 | HIGH | Patched | 7.2 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and ag… |
| CVE-2026-57113 | HIGH | Patched | 8.1 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github… |
| CVE-2026-55889 | HIGH | Patched | — | 2026-10-23 | XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.RetrieveFiles method to redirect drag… |
| CVE-2026-55888 | HIGH | Patched | — | 2026-10-23 | XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary fil… |
| CVE-2026-115729 | HIGH | Patched | 6.8 | 2026-10-23 | @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. … |
| CVE-2026-115728 | HIGH | Patched | 7.5 | 2026-10-23 | @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213.… |
| CVE-2026-112863 | HIGH | 7.1 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS… | |
| CVE-2026-112852 | HIGH | 8.1 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. |