Search
1,420 CVEs · High severity
CVEs (1,420, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,420 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114110 | HIGH | Patched | 5.3 | 2026-10-21 | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD … |
| CVE-2026-111890 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions w… |
| CVE-2026-111891 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints… |
| CVE-2026-111885 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target gro… |
| CVE-2026-114644 | HIGH | 5.9 | 2026-10-22 | The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that dese… | |
| CVE-2026-115333 | HIGH | 5.9 | 2026-10-22 | Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the sec… | |
| CVE-2026-112381 | HIGH | Patched | 5.9 | 2026-10-21 | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed fro… |
| CVE-2026-114400 | HIGH | 5.9 | 2026-10-21 | Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because … | |
| CVE-2026-114117 | HIGH | 5.9 | 2026-10-21 | Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the… | |
| CVE-2026-114104 | HIGH | Patched | 5.9 | 2026-10-21 | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate ent… |
| CVE-2020-37287 | HIGH | Patched | 5.9 | 2026-10-21 | Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. C… |
| CVE-2026-113351 | HIGH | 5.9 | 2026-10-20 | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Att… | |
| CVE-2026-112266 | HIGH | 5.9 | 2026-10-19 | SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-con… | |
| CVE-2026-111915 | HIGH | Patched | 5.9 | 2026-10-19 | Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/h… |
| CVE-2026-111905 | HIGH | Patched | 6.0 | 2026-10-17 | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns… |
| CVE-2026-115373 | HIGH | Patched | 6.3 | 2026-10-22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted cli… |
| CVE-2026-114660 | HIGH | Patched | 6.3 | 2026-10-22 | Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object m… |
| CVE-2026-111922 | HIGH | Patched | 6.3 | 2026-10-17 | Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set… |
| CVE-2026-96616 | HIGH | 6.5 | 2026-10-22 | Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them … | |
| CVE-2026-115508 | HIGH | Patched | 6.5 | 2026-10-22 | Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unb… |
| CVE-2026-115354 | HIGH | Patched | 6.5 | 2026-10-22 | Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute inc… |
| CVE-2026-114652 | HIGH | 6.5 | 2026-10-22 | A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted a… | |
| CVE-2026-114653 | HIGH | 6.5 | 2026-10-22 | A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern ex… | |
| CVE-2026-114665 | HIGH | Patched | 6.5 | 2026-10-22 | Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbi… |
| CVE-2022-51025 | HIGH | 6.5 | 2026-10-22 | Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter… |