Search
16,949 CVEs
CVEs (16,949, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 51–75 of 16,949 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115863 | HIGH | 7.6 | 2026-10-23 | ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes f… | |
| CVE-2026-115813 | MEDIUM | 5.8 | 2026-10-23 | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal n… | |
| CVE-2026-115812 | CRITICAL | 9.8 | 2026-10-23 | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via… | |
| CVE-2026-115567 | MEDIUM | Patched | — | 2026-10-23 | Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded… |
| CVE-2026-110975 | HIGH | 7.4 | 2026-10-23 | A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpo… | |
| CVE-2026-87901 | HIGH | 8.3 | 2026-10-23 | Improper sanitization in the registration module allows reflected Cross-Site Scripting. | |
| CVE-2026-115810 | MEDIUM | Patched | 7.7 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server … |
| CVE-2026-106074 | MEDIUM | 4.8 | 2026-10-23 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land st… | |
| CVE-2026-106073 | LOW | 3.3 | 2026-10-23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-2171… | |
| CVE-2026-106072 | MEDIUM | 6.7 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spel… | |
| CVE-2026-106071 | LOW | 3.6 | 2026-10-23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the req… | |
| CVE-2026-106070 | LOW | 3.7 | 2026-10-23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `… | |
| CVE-2026-106069 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the hos… | |
| CVE-2026-105483 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written … | |
| CVE-2026-105482 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fi… | |
| CVE-2026-105481 | MEDIUM | 6.5 | 2026-10-23 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete f… | |
| CVE-2026-57845 | HIGH | 8.8 | 2026-10-23 | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle… | |
| CVE-2026-52356 | NONE | — | 2026-10-23 | An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecti… | |
| CVE-2026-50787 | NONE | — | 2026-10-23 | e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied param… | |
| CVE-2025-45528 | NONE | — | 2026-10-23 | An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF | |
| CVE-2026-58497 | HIGH | Patched | — | 2026-10-23 | Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the lega… |
| CVE-2026-55486 | CRITICAL | Patched | 9.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoin… |
| CVE-2026-55465 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST … |
| CVE-2026-55463 | MEDIUM | Patched | 6.5 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocke… |
| CVE-2026-55459 | HIGH | Patched | 7.4 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.ve… |