Search
16,950 CVEs
CVEs (16,950, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 201–225 of 16,950 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-105697 | CRITICAL | Patched | 9.9 | 2026-10-05 | Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put i… |
| CVE-2026-105740 | CRITICAL | Patched | 9.9 | 2026-10-05 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on th… |
| CVE-2026-105691 | CRITICAL | Patched | 9.9 | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask… |
| CVE-2026-105636 | CRITICAL | Patched | 9.9 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_red… |
| CVE-2026-105080 | CRITICAL | Patched | 9.9 | 2026-10-03 | In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable cod… |
| CVE-2026-82041 | MEDIUM | Patched | 9.9 | 2026-10-02 | UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP … |
| CVE-2026-90970 | CRITICAL | Patched | 9.9 | 2026-10-02 | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 be… |
| CVE-2026-93698 | CRITICAL | 9.9 | 2026-10-02 | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | |
| CVE-2026-79901 | CRITICAL | 9.9 | 2026-10-01 | In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequenc… | |
| CVE-2026-102911 | CRITICAL | 9.9 | 2026-09-30 | A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing… | |
| CVE-2026-84154 | CRITICAL | 9.9 | 2026-09-29 | A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to exec… | |
| CVE-2026-87799 | CRITICAL | Patched | 9.9 | 2026-09-28 | Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated c… |
| CVE-2026-85526 | CRITICAL | 9.9 | 2026-09-28 | Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbi… | |
| CVE-2026-101038 | CRITICAL | 9.9 | 2026-09-28 | A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This man… | |
| CVE-2026-101037 | CRITICAL | 9.9 | 2026-09-28 | A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advertisement_frame of the component devdiscover Service. The manipulation res… | |
| CVE-2026-82377 | CRITICAL | Patched | 9.9 | 2026-09-28 | Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Bl… |
| CVE-2026-101002 | CRITICAL | 9.9 | 2026-09-28 | A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Ha… | |
| CVE-2026-100896 | CRITICAL | 9.9 | 2026-09-28 | A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Man… | |
| CVE-2026-100740 | CRITICAL | 9.9 | 2026-09-27 | A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Per… | |
| CVE-2026-100716 | CRITICAL | Patched | 9.9 | 2026-09-26 | Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the exp… |
| CVE-2026-100717 | CRITICAL | Patched | 9.9 | 2026-09-26 | froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and… |
| CVE-2026-100706 | CRITICAL | Patched | 9.9 | 2026-09-26 | kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and creat… |
| CVE-2026-93425 | CRITICAL | Patched | 9.9 | 2026-09-24 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from… |
| CVE-2026-19072 | CRITICAL | 9.9 | 2026-09-24 | Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_co… | |
| CVE-2026-89078 | CRITICAL | Patched | 9.9 | 2026-09-24 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions coul… |