Search
37,262 CVEs · Critical severity
EOL hidden · Show all products
CVEs (37,262, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 37,262 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2023-54356 | CRITICAL | Patched | 3.7 | 2026-09-01 | Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These… |
| CVE-2026-75832 | CRITICAL | Patched | 4.3 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPath… |
| CVE-2026-75835 | CRITICAL | Patched | 4.3 | 2026-08-18 | Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fa… |
| CVE-2026-72785 | CRITICAL | Patched | 4.3 | 2026-08-11 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategorie… |
| CVE-2025-34211 | CRITICAL | Patched | 4.9 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) contain a privat… |
| CVE-2026-72699 | CRITICAL | Patched | 5.3 | 2026-08-25 | The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exce… |
| CVE-2026-72702 | CRITICAL | Patched | 5.4 | 2026-08-25 | Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored… |
| CVE-2026-74890 | CRITICAL | Patched | 5.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CU… |
| CVE-2025-12216 | CRITICAL | Patched | 5.5 | 2025-10-25 | Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-34210 | CRITICAL | 5.5 | 2025-10-02 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passwords, MySQL r… | |
| CVE-2025-36939 | CRITICAL | 5.7 | 2026-08-24 | Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a… | |
| CVE-2026-102469 | CRITICAL | Patched | 5.9 | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling co… |
| CVE-2025-71401 | CRITICAL | Patched | 5.9 | 2026-08-02 | better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make t… |
| CVE-2026-32645 | CRITICAL | 6.0 | 2026-10-09 | Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. | |
| CVE-2026-53579 | CRITICAL | Patched | 6.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text no… |
| CVE-2026-53578 | CRITICAL | Patched | 6.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text no… |
| CVE-2026-48996 | CRITICAL | Patched | 6.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, … |
| CVE-2025-12001 | CRITICAL | Patched | 6.1 | 2025-10-20 | Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. |
| CVE-2025-11925 | CRITICAL | Patched | 6.1 | 2025-10-17 | Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potentially allow injection of HTML/JavaScript into reply.This issu… |
| CVE-2026-68582 | CRITICAL | Patched | 6.5 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/vie… |
| CVE-2026-107806 | CRITICAL | Patched | 7.2 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controll… |
| CVE-2025-34286 | CRITICAL | Patched | 7.2 | 2025-10-30 | Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of pa… |
| CVE-2024-14008 | CRITICAL | Patched | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input al… |
| CVE-2024-14009 | CRITICAL | Patched | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnos… |
| CVE-2025-34134 | CRITICAL | Patched | 7.2 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanit… |