Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 151–175 of 172,839 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-114608 | MEDIUM | Patched | — | 2026-10-22 | Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pick… |
| CVE-2026-114606 | MEDIUM | Patched | — | 2026-10-22 | draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main proce… |
| CVE-2026-115496 | MEDIUM | — | 2026-10-22 | Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow name… | |
| CVE-2026-115494 | MEDIUM | — | 2026-10-22 | A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with pass… | |
| CVE-2026-115454 | MEDIUM | — | 2026-10-22 | An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust re… | |
| CVE-2026-114603 | MEDIUM | Patched | 5.3 | 2026-10-22 | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.p… |
| CVE-2026-114515 | MEDIUM | Patched | 6.5 | 2026-10-22 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service … |
| CVE-2026-89410 | MEDIUM | — | 2026-10-22 | In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information. | |
| CVE-2026-89409 | MEDIUM | — | 2026-10-22 | In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the ZWAVE_CMD_NODES_EXIST handler can resul… | |
| CVE-2026-85080 | MEDIUM | — | 2026-10-22 | In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written us… | |
| CVE-2026-66282 | MEDIUM | — | 2026-10-22 | In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages m… | |
| CVE-2026-66281 | MEDIUM | — | 2026-10-22 | In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from … | |
| CVE-2026-115411 | MEDIUM | 5.0 | 2026-10-22 | crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6… | |
| CVE-2026-115400 | MEDIUM | 4.4 | 2026-10-22 | crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens st… | |
| CVE-2026-13411 | MEDIUM | 4.3 | 2026-10-22 | Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks … | |
| CVE-2026-115329 | MEDIUM | 5.9 | 2026-10-22 | Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filt… | |
| CVE-2026-115327 | MEDIUM | 5.3 | 2026-10-22 | libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers… | |
| CVE-2026-115326 | MEDIUM | 5.4 | 2026-10-22 | QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated custom… | |
| CVE-2026-115323 | MEDIUM | Patched | 7.3 | 2026-10-22 | EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addr… |
| CVE-2026-115322 | MEDIUM | Patched | 4.3 | 2026-10-22 | Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to acce… |
| CVE-2026-115321 | MEDIUM | Patched | 4.3 | 2026-10-22 | Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other… |
| CVE-2026-115207 | MEDIUM | 5.5 | 2026-10-22 | A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a sp… | |
| CVE-2026-112842 | MEDIUM | 6.5 | 2026-10-22 | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Level… | |
| CVE-2024-58394 | MEDIUM | Patched | 6.1 | 2026-10-22 | Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/ima… |
| CVE-2023-54413 | MEDIUM | Patched | 6.1 | 2026-10-22 | WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by su… |