Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 76–100 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-118778 | MEDIUM | Patched | 5.9 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnec… |
| CVE-2026-118777 | MEDIUM | Patched | 4.8 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths fro… |
| CVE-2026-118776 | LOW | Patched | 3.7 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC… |
| CVE-2026-118775 | LOW | Patched | 3.7 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the … |
| CVE-2026-118774 | LOW | Patched | 3.7 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(chi… |
| CVE-2026-118773 | MEDIUM | Patched | — | 2026-10-29 | Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCB… |
| CVE-2026-118772 | HIGH | Patched | 7.5 | 2026-10-29 | joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separat… |
| CVE-2026-103094 | HIGH | Patched | — | 2026-10-29 | ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext passw… |
| CVE-2026-103093 | CRITICAL | Patched | — | 2026-10-29 | ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the … |
| CVE-2026-60111 | NONE | — | 2026-10-29 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-51912 | NONE | — | 2026-10-29 | OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46). | |
| CVE-2026-51905 | NONE | — | 2026-10-29 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remo… | |
| CVE-2026-51903 | NONE | — | 2026-10-29 | SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attac… | |
| CVE-2026-51902 | NONE | — | 2026-10-29 | SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from… | |
| CVE-2026-51863 | NONE | — | 2026-10-29 | DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use th… | |
| CVE-2026-51851 | NONE | — | 2026-10-29 | modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_file. The save_text_file method a… | |
| CVE-2026-118769 | CRITICAL | Patched | — | 2026-10-29 | Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds c… |
| CVE-2026-118768 | MEDIUM | Patched | — | 2026-10-29 | Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access UR… |
| CVE-2026-118767 | MEDIUM | Patched | 4.8 | 2026-10-29 | Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently… |
| CVE-2026-118766 | MEDIUM | Patched | 6.1 | 2026-10-29 | Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's … |
| CVE-2026-116566 | MEDIUM | — | 2026-10-29 | socket.getaddrinfo() previously accepted null bytes within *host* and *port* parameters which can cause the values to be silently truncated. | |
| CVE-2026-107347 | HIGH | Patched | 8.4 | 2026-10-29 | HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files… |
| CVE-2026-102260 | MEDIUM | Patched | 4.3 | 2026-10-29 | HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with r… |
| CVE-2026-62374 | HIGH | Patched | — | 2026-10-29 | SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core… |
| CVE-2026-11587 | HIGH | 7.2 | 2026-10-29 | SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database |