Search
43,390 CVEs
EOL hidden · Show all products
CVEs (43,390, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 76–100 of 43,390 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-55457 | HIGH | Patched | 7.4 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empt… |
| CVE-2026-55444 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss… |
| CVE-2026-55442 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() … |
| CVE-2026-55222 | MEDIUM | 5.1 | 2026-10-23 | Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be … | |
| CVE-2026-54668 | HIGH | Patched | — | 2026-10-23 | Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.… |
| CVE-2026-53942 | CRITICAL | 9.9 | 2026-10-23 | Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain … | |
| CVE-2026-49442 | MEDIUM | Patched | 5.3 | 2026-10-23 | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames… |
| CVE-2026-46652 | CRITICAL | Patched | 9.8 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.g… |
| CVE-2026-46651 | CRITICAL | Patched | 9.8 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint … |
| CVE-2026-46531 | MEDIUM | Patched | 5.5 | 2026-10-23 | Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL in… |
| CVE-2026-46347 | MEDIUM | Patched | 6.8 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the ap… |
| CVE-2026-46346 | MEDIUM | Patched | 6.5 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based… |
| CVE-2026-39902 | HIGH | Patched | 7.2 | 2026-10-23 | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirec… |
| CVE-2026-115478 | HIGH | Patched | — | 2026-10-23 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlin… |
| CVE-2026-115477 | HIGH | Patched | — | 2026-10-23 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` co… |
| CVE-2026-112333 | MEDIUM | Patched | 5.4 | 2026-10-23 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inj… |
| CVE-2026-106765 | HIGH | 7.5 | 2026-10-23 | An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. | |
| CVE-2026-106764 | HIGH | 7.5 | 2026-10-23 | An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. | |
| CVE-2026-106763 | HIGH | 7.5 | 2026-10-23 | An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. | |
| CVE-2026-102786 | HIGH | — | 2026-10-23 | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 | |
| CVE-2026-93640 | HIGH | 7.8 | 2026-10-23 | A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root pri… | |
| CVE-2026-93639 | HIGH | 8.7 | 2026-10-23 | A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet… | |
| CVE-2026-93638 | MEDIUM | 6.1 | 2026-10-23 | A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zr… | |
| CVE-2026-93636 | MEDIUM | 4.3 | 2026-10-23 | An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources throu… | |
| CVE-2026-93634 | MEDIUM | 4.3 | 2026-10-23 | A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbo… |