Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 151–175 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-90861 | MEDIUM | 6.6 | 2026-10-29 | Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user's password in clear text to another administrator, who could use it to … | |
| CVE-2026-88090 | MEDIUM | 5.4 | 2026-10-29 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-88078 | MEDIUM | 4.3 | 2026-10-29 | Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | |
| CVE-2026-88077 | HIGH | 8.8 | 2026-10-29 | Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-85899 | HIGH | 8.1 | 2026-10-29 | Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-85897 | HIGH | 8.8 | 2026-10-29 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85890 | HIGH | 8.8 | 2026-10-29 | Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85330 | MEDIUM | 4.3 | 2026-10-29 | Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-84296 | MEDIUM | 6.8 | 2026-10-29 | Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticate… | |
| CVE-2026-84295 | CRITICAL | 10.0 | 2026-10-29 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensi… | |
| CVE-2026-84294 | HIGH | 7.7 | 2026-10-29 | Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authen… | |
| CVE-2026-77819 | MEDIUM | Patched | 6.5 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory. |
| CVE-2026-77817 | MEDIUM | Patched | 6.5 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and pr… |
| CVE-2026-66912 | MEDIUM | Patched | — | 2026-10-29 | Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the Fro… |
| CVE-2026-66911 | MEDIUM | Patched | — | 2026-10-29 | Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location hea… |
| CVE-2026-62131 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | |
| CVE-2026-62018 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | |
| CVE-2026-62017 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | |
| CVE-2026-62016 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
| CVE-2026-62015 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | |
| CVE-2026-62014 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | |
| CVE-2026-62013 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |
| CVE-2026-62012 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | |
| CVE-2026-62011 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | |
| CVE-2026-62010 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. |