Search
4,651 CVEs
CVEs (4,651, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 151–175 of 4,651 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-109442 | CRITICAL | 9.8 | 2026-10-20 | piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication… | |
| CVE-2026-109444 | CRITICAL | 9.8 | 2026-10-20 | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless … | |
| CVE-2026-112779 | CRITICAL | Patched | 9.8 | 2026-10-19 | Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/tran… |
| CVE-2026-112776 | CRITICAL | Patched | 9.8 | 2026-10-19 | Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllow… |
| CVE-2026-109437 | CRITICAL | Patched | 9.8 | 2026-10-19 | Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authe… |
| CVE-2026-111862 | CRITICAL | 9.8 | 2026-10-19 | Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC… | |
| CVE-2026-107083 | CRITICAL | 9.8 | 2026-10-19 | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID. | |
| CVE-2026-111058 | CRITICAL | Patched | 9.8 | 2026-10-19 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to cre… |
| CVE-2026-109432 | CRITICAL | Patched | 9.8 | 2026-10-19 | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query express… |
| CVE-2026-107081 | CRITICAL | 9.8 | 2026-10-19 | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, adm… | |
| CVE-2026-112296 | CRITICAL | 9.8 | 2026-10-19 | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms a… | |
| CVE-2026-112292 | CRITICAL | 9.8 | 2026-10-19 | CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase co… | |
| CVE-2026-71253 | CRITICAL | Patched | 9.8 | 2026-10-19 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker… |
| CVE-2026-90910 | CRITICAL | Patched | 9.8 | 2026-10-19 | Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content… |
| CVE-2026-108983 | CRITICAL | 9.8 | 2026-10-19 | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | |
| CVE-2026-111998 | CRITICAL | 9.8 | 2026-10-18 | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admi… | |
| CVE-2026-110886 | CRITICAL | 9.8 | 2026-10-18 | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversatio… | |
| CVE-2026-110372 | CRITICAL | 9.8 | 2026-10-18 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. | |
| CVE-2026-111911 | CRITICAL | Patched | 9.8 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication o… |
| CVE-2026-104736 | CRITICAL | 9.8 | 2026-10-17 | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout… | |
| CVE-2026-111823 | CRITICAL | Patched | 9.8 | 2026-10-17 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. |
| CVE-2026-55981 | CRITICAL | 9.6 | 2026-10-23 | A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an … | |
| CVE-2026-54630 | CRITICAL | Patched | 9.6 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the… |
| CVE-2026-79867 | CRITICAL | 9.6 | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and… | |
| CVE-2026-79868 | CRITICAL | 9.6 | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Su… |