Search
37,355 CVEs · High severity
CVEs (37,355, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 201–225 of 37,355 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-16477 | HIGH | Patched | — | 2026-10-22 | CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to c… |
| CVE-2026-114510 | HIGH | Patched | 7.1 | 2026-10-22 | Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 un… |
| CVE-2026-113872 | HIGH | Patched | 7.5 | 2026-10-22 | multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFi… |
| CVE-2026-111181 | HIGH | Patched | 7.5 | 2026-10-22 | body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any applicatio… |
| CVE-2026-94502 | HIGH | — | 2026-10-22 | In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages m… | |
| CVE-2026-92709 | HIGH | 8.1 | 2026-10-22 | Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible… | |
| CVE-2026-85079 | HIGH | — | 2026-10-22 | In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must c… | |
| CVE-2026-66279 | HIGH | — | 2026-10-22 | In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vu… | |
| CVE-2026-113582 | HIGH | 7.5 | 2026-10-22 | UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests w… | |
| CVE-2026-115334 | HIGH | 6.8 | 2026-10-22 | Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying… | |
| CVE-2026-115333 | HIGH | 5.9 | 2026-10-22 | Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the sec… | |
| CVE-2026-115332 | HIGH | 8.8 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that… | |
| CVE-2026-115331 | HIGH | 8.8 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name o… | |
| CVE-2026-115330 | HIGH | 8.8 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom… | |
| CVE-2026-115328 | HIGH | Patched | 8.8 | 2026-10-22 | JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via Hist… |
| CVE-2026-115325 | HIGH | 8.3 | 2026-10-22 | Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other ne… | |
| CVE-2026-114665 | HIGH | Patched | 6.5 | 2026-10-22 | Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbi… |
| CVE-2026-112822 | HIGH | Patched | 8.5 | 2026-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This… |
| CVE-2026-112820 | HIGH | 8.1 | 2026-10-22 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows … | |
| CVE-2026-112313 | HIGH | 7.1 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue af… | |
| CVE-2026-111079 | HIGH | 7.4 | 2026-10-22 | A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to co… | |
| CVE-2025-71434 | HIGH | 8.2 | 2026-10-22 | Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore paramet… | |
| CVE-2024-58396 | HIGH | 7.5 | 2026-10-22 | YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId … | |
| CVE-2024-58393 | HIGH | 8.2 | 2026-10-22 | i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queri… | |
| CVE-2022-51025 | HIGH | 6.5 | 2026-10-22 | Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter… |