Search
4,651 CVEs
CVEs (4,651, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 151–175 of 4,651 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-112000 | HIGH | 7.6 | 2026-10-18 | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods … | |
| CVE-2026-112001 | HIGH | Patched | 7.2 | 2026-10-18 | ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH … |
| CVE-2026-112002 | HIGH | Patched | 6.8 | 2026-10-18 | ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set lo… |
| CVE-2026-112003 | MEDIUM | Patched | 5.9 | 2026-10-18 | ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as o… |
| CVE-2026-112004 | LOW | Patched | 3.1 | 2026-10-18 | Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a forei… |
| CVE-2026-112005 | CRITICAL | Patched | 7.7 | 2026-10-18 | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functi… |
| CVE-2026-112006 | HIGH | Patched | 6.5 | 2026-10-18 | OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_… |
| CVE-2026-112007 | MEDIUM | 6.1 | 2026-10-18 | Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_S… | |
| CVE-2026-112008 | MEDIUM | 6.1 | 2026-10-18 | libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are size… | |
| CVE-2026-112009 | MEDIUM | 5.5 | 2026-10-18 | smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a cra… | |
| CVE-2026-112010 | MEDIUM | 5.5 | 2026-10-18 | smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized pa… | |
| CVE-2026-112011 | MEDIUM | 5.3 | 2026-10-18 | libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unva… | |
| CVE-2026-112012 | MEDIUM | 5.3 | 2026-10-18 | libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never r… | |
| CVE-2026-112013 | MEDIUM | 5.5 | 2026-10-18 | libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sampl… | |
| CVE-2026-112014 | MEDIUM | Patched | 5.5 | 2026-10-18 | LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-A… |
| CVE-2026-112015 | HIGH | Patched | 7.5 | 2026-10-18 | Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Att… |
| CVE-2026-112016 | MEDIUM | 6.5 | 2026-10-18 | Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite upd… | |
| CVE-2026-112017 | HIGH | Patched | 6.5 | 2026-10-18 | JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline cha… |
| CVE-2026-112018 | HIGH | 7.0 | 2026-10-18 | cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecke… | |
| CVE-2026-112019 | MEDIUM | 6.1 | 2026-10-18 | cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStri… | |
| CVE-2026-112020 | MEDIUM | 6.1 | 2026-10-18 | LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompresse… | |
| CVE-2026-112021 | HIGH | Patched | 7.5 | 2026-10-18 | snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sendin… |
| CVE-2026-78497 | HIGH | Patched | 8.4 | 2026-10-18 | JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test(), match(), o… |
| CVE-2026-111986 | LOW | 6.3 | 2026-10-18 | A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the compo… | |
| CVE-2026-112046 | MEDIUM | Patched | 5.5 | 2026-10-18 | OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64… |