Search
1,599 CVEs · Medium severity
CVEs (1,599, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,599 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-112249 | MEDIUM | 2.4 | 2026-10-19 | A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml… | |
| CVE-2026-111888 | MEDIUM | Patched | 2.7 | 2026-10-17 | phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /ad… |
| CVE-2026-115749 | MEDIUM | Patched | 3.3 | 2026-10-23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passi… |
| CVE-2026-113609 | MEDIUM | Patched | 3.3 | 2026-10-20 | Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attacker… |
| CVE-2026-112284 | MEDIUM | 3.3 | 2026-10-19 | libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound … | |
| CVE-2026-111926 | MEDIUM | Patched | 3.3 | 2026-10-17 | Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including te… |
| CVE-2026-111932 | MEDIUM | Patched | 3.4 | 2026-10-17 | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and Lo… |
| CVE-2026-115507 | MEDIUM | Patched | 3.5 | 2026-10-22 | Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and … |
| CVE-2026-114070 | MEDIUM | Patched | 3.5 | 2026-10-21 | Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-reada… |
| CVE-2026-114048 | MEDIUM | Patched | 3.5 | 2026-10-21 | WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check… |
| CVE-2026-113706 | MEDIUM | 3.5 | 2026-10-21 | A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the … | |
| CVE-2026-113357 | MEDIUM | Patched | 3.5 | 2026-10-20 | @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the pre… |
| CVE-2026-112097 | MEDIUM | 3.5 | 2026-10-19 | A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of t… | |
| CVE-2026-115750 | MEDIUM | Patched | 3.7 | 2026-10-23 | mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() … |
| CVE-2026-115751 | MEDIUM | Patched | 3.7 | 2026-10-23 | Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist usin… |
| CVE-2026-115359 | MEDIUM | Patched | 3.7 | 2026-10-22 | OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with form-encoded bodies or forwarded… |
| CVE-2026-114641 | MEDIUM | Patched | 3.7 | 2026-10-22 | Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round… |
| CVE-2026-114115 | MEDIUM | 3.7 | 2026-10-21 | Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type'… | |
| CVE-2026-114049 | MEDIUM | Patched | 3.7 | 2026-10-21 | vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_tok… |
| CVE-2020-37288 | MEDIUM | Patched | 3.7 | 2026-10-21 | Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing… |
| CVE-2020-37289 | MEDIUM | Patched | 3.7 | 2026-10-21 | Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checki… |
| CVE-2026-112274 | MEDIUM | 3.7 | 2026-10-19 | libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lack… | |
| CVE-2026-112105 | MEDIUM | 3.7 | 2026-10-19 | A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Han… | |
| CVE-2026-112106 | MEDIUM | 3.7 | 2026-10-19 | A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown … | |
| CVE-2026-112103 | MEDIUM | 3.7 | 2026-10-19 | A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such … |