Search
16,950 CVEs
CVEs (16,950, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 151–175 of 16,950 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111406 | CRITICAL | 9.9 | 2026-10-19 | Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web … | |
| CVE-2026-110887 | CRITICAL | 9.9 | 2026-10-19 | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a… | |
| CVE-2026-92262 | CRITICAL | Patched | 9.9 | 2026-10-16 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affec… |
| CVE-2026-85746 | CRITICAL | Patched | 9.9 | 2026-10-16 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an alloca… |
| CVE-2026-85748 | CRITICAL | Patched | 9.9 | 2026-10-16 | MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can … |
| CVE-2026-105037 | CRITICAL | 9.9 | 2026-10-15 | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying a… | |
| CVE-2026-110812 | CRITICAL | Patched | 9.9 | 2026-10-15 | Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permi… |
| CVE-2026-57155 | CRITICAL | Patched | 9.9 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnse… |
| CVE-2026-108390 | CRITICAL | Patched | 9.9 | 2026-10-14 | Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escap… |
| CVE-2026-77524 | CRITICAL | Patched | 9.9 | 2026-10-14 | KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObjec… |
| CVE-2026-89310 | CRITICAL | 9.9 | 2026-10-14 | A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL stateme… | |
| CVE-2026-97381 | CRITICAL | Patched | 9.9 | 2026-10-13 | Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermit… |
| CVE-2026-106612 | CRITICAL | 9.9 | 2026-10-13 | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attack… | |
| CVE-2026-105903 | CRITICAL | 9.9 | 2026-10-13 | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the cur… | |
| CVE-2026-75732 | CRITICAL | 9.9 | 2026-10-13 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potential… | |
| CVE-2026-105895 | CRITICAL | 9.9 | 2026-10-13 | Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potenti… | |
| CVE-2026-103848 | CRITICAL | 9.9 | 2026-10-13 | Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arb… | |
| CVE-2026-77459 | CRITICAL | Patched | 9.9 | 2026-10-13 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks … |
| CVE-2026-109412 | CRITICAL | 9.9 | 2026-10-13 | An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. | |
| CVE-2026-106042 | CRITICAL | 9.9 | 2026-10-13 | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated re… | |
| CVE-2026-109157 | HIGH | 9.9 | 2026-10-13 | A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a man… | |
| CVE-2026-109108 | HIGH | 9.9 | 2026-10-13 | A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the arg… | |
| CVE-2026-89107 | CRITICAL | 9.9 | 2026-10-13 | SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting… | |
| CVE-2026-89110 | CRITICAL | 9.9 | 2026-10-13 | SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operat… | |
| CVE-2026-96119 | CRITICAL | Patched | 9.9 | 2026-10-13 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data saniti… |