Search
43,390 CVEs
EOL hidden · Show all products
CVEs (43,390, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 101–125 of 43,390 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-93633 | MEDIUM | 5.4 | 2026-10-23 | A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-control… | |
| CVE-2026-93631 | HIGH | 7.1 | 2026-10-23 | A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled exte… | |
| CVE-2026-93630 | MEDIUM | 4.3 | 2026-10-23 | A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on for… | |
| CVE-2026-93629 | MEDIUM | 5.3 | 2026-10-23 | An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another us… | |
| CVE-2026-93628 | MEDIUM | 5.3 | 2026-10-23 | An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's r… | |
| CVE-2026-93627 | MEDIUM | 5.3 | 2026-10-23 | An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an exist… | |
| CVE-2026-57208 | MEDIUM | Patched | — | 2026-10-23 | Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access t… |
| CVE-2026-57207 | MEDIUM | Patched | 5.9 | 2026-10-23 | NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentica… |
| CVE-2026-55826 | HIGH | Patched | — | 2026-10-23 | The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tr… |
| CVE-2026-55606 | MEDIUM | 6.5 | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a netwo… | |
| CVE-2026-53921 | CRITICAL | Patched | 9.8 | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 51… |
| CVE-2026-53920 | HIGH | Patched | — | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or… |
| CVE-2026-53918 | HIGH | Patched | — | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer … |
| CVE-2026-50057 | HIGH | 7.8 | 2026-10-23 | A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The ins… | |
| CVE-2026-50056 | HIGH | 7.8 | 2026-10-23 | A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as… | |
| CVE-2026-50053 | HIGH | 8.7 | 2026-10-23 | A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted i… | |
| CVE-2026-115786 | MEDIUM | 6.5 | 2026-10-23 | A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and … | |
| CVE-2026-115785 | MEDIUM | 4.3 | 2026-10-23 | An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account opti… | |
| CVE-2026-115754 | LOW | Patched | 4.7 | 2026-10-23 | serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized f… |
| CVE-2026-115481 | HIGH | — | 2026-10-23 | baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `con… | |
| CVE-2026-115480 | MEDIUM | Patched | 5.3 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.jso… |
| CVE-2026-115479 | MEDIUM | Patched | 5.3 | 2026-10-23 | baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in … |
| CVE-2026-115457 | HIGH | Patched | 7.1 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, includi… |
| CVE-2026-114624 | HIGH | Patched | 7.2 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value … |
| CVE-2026-114623 | MEDIUM | Patched | 6.5 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse … |