Search
6,516 CVEs · High severity
CVEs (6,516, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 6,516 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-87667 | HIGH | Patched | 4.5 | 2026-10-08 | An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Whe… |
| CVE-2026-100640 | HIGH | 4.7 | 2026-09-26 | SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking cli… | |
| CVE-2026-13224 | HIGH | Patched | 4.9 | 2026-09-30 | A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by se… |
| CVE-2026-114110 | HIGH | Patched | 5.3 | 2026-10-21 | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD … |
| CVE-2026-104438 | HIGH | Patched | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying re… |
| CVE-2026-104439 | HIGH | Patched | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through… |
| CVE-2026-67239 | HIGH | Patched | 5.4 | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-manageme… |
| CVE-2026-111890 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions w… |
| CVE-2026-111891 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints… |
| CVE-2026-111885 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target gro… |
| CVE-2026-107211 | HIGH | Patched | 5.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index … |
| CVE-2026-107213 | HIGH | Patched | 5.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing witho… |
| CVE-2026-90913 | HIGH | Patched | 5.5 | 2026-09-29 | Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthoriz… |
| CVE-2026-102569 | HIGH | 5.5 | 2026-09-29 | ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into a… | |
| CVE-2026-100687 | HIGH | Patched | 5.5 | 2026-09-26 | Budibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder collaboration websocket room. Attac… |
| CVE-2026-100629 | HIGH | Patched | 5.5 | 2026-09-26 | Capgo (capgo.app backend) before 12.127.5 contains an authorization flaw in the PATCH /private/role_bindings/:binding_id endpoint. The handler verifies that the newly assig… |
| CVE-2026-100616 | HIGH | 5.5 | 2026-09-26 | capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an or… | |
| CVE-2026-5047 | HIGH | Patched | 5.7 | 2026-10-08 | A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated a… |
| CVE-2026-114644 | HIGH | 5.9 | 2026-10-22 | The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that dese… | |
| CVE-2026-115333 | HIGH | 5.9 | 2026-10-22 | Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the sec… | |
| CVE-2026-112381 | HIGH | Patched | 5.9 | 2026-10-21 | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed fro… |
| CVE-2026-114400 | HIGH | 5.9 | 2026-10-21 | Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because … | |
| CVE-2026-114117 | HIGH | 5.9 | 2026-10-21 | Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the… | |
| CVE-2026-114104 | HIGH | Patched | 5.9 | 2026-10-21 | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate ent… |
| CVE-2020-37287 | HIGH | Patched | 5.9 | 2026-10-21 | Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. C… |