Search
6,517 CVEs · High severity
CVEs (6,517, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 176–200 of 6,517 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115348 | HIGH | Patched | 7.5 | 2026-10-22 | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers … |
| CVE-2026-115347 | HIGH | Patched | 7.5 | 2026-10-22 | Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalan… |
| CVE-2026-114653 | HIGH | 6.5 | 2026-10-22 | A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern ex… | |
| CVE-2026-114652 | HIGH | 6.5 | 2026-10-22 | A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted a… | |
| CVE-2026-114649 | HIGH | 6.8 | 2026-10-22 | The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application th… | |
| CVE-2026-114648 | HIGH | Patched | 7.6 | 2026-10-22 | The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them in… |
| CVE-2026-114644 | HIGH | 5.9 | 2026-10-22 | The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that dese… | |
| CVE-2026-114613 | HIGH | Patched | 7.5 | 2026-10-22 | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deser… |
| CVE-2026-114519 | HIGH | Patched | — | 2026-10-22 | Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of … |
| CVE-2026-97635 | HIGH | Patched | 8.1 | 2026-10-22 | The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface… |
| CVE-2026-93336 | HIGH | — | 2026-10-22 | Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit agent, or a user with on… | |
| CVE-2026-113874 | HIGH | 8.1 | 2026-10-22 | SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce storage partition entitl… | |
| CVE-2026-113873 | HIGH | 7.5 | 2026-10-22 | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust server heap or crash certa… | |
| CVE-2026-108359 | HIGH | Patched | — | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadshe… |
| CVE-2026-108358 | HIGH | Patched | — | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/R… |
| CVE-2026-108357 | HIGH | Patched | — | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlSc… |
| CVE-2026-75508 | HIGH | Patched | 7.5 | 2026-10-22 | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in Parser.advance_lexer counts… |
| CVE-2026-75507 | HIGH | Patched | 7.5 | 2026-10-22 | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specified_rules rep… |
| CVE-2026-114605 | HIGH | Patched | 7.5 | 2026-10-22 | dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious… |
| CVE-2026-104068 | HIGH | Patched | 7.2 | 2026-10-22 | JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write at… |
| CVE-2026-94482 | HIGH | Patched | — | 2026-10-22 | Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at leas… |
| CVE-2026-115482 | HIGH | Patched | 7.5 | 2026-10-22 | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPAC… |
| CVE-2026-115453 | HIGH | — | 2026-10-22 | Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delet… | |
| CVE-2026-115450 | HIGH | — | 2026-10-22 | External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no specia… | |
| CVE-2026-61791 | HIGH | Patched | 7.4 | 2026-10-22 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton(… |