Search
1,420 CVEs · High severity
CVEs (1,420, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,420 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111812 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affect… |
| CVE-2026-111814 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to pre… |
| CVE-2026-111815 | HIGH | Patched | 10.0 | 2026-10-21 | Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy… |
| CVE-2026-114268 | HIGH | 9.9 | 2026-10-21 | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of … | |
| CVE-2026-113506 | HIGH | 9.9 | 2026-10-20 | A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The… | |
| CVE-2026-113390 | HIGH | 9.9 | 2026-10-20 | A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CG… | |
| CVE-2026-113391 | HIGH | 9.9 | 2026-10-20 | A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Uplo… | |
| CVE-2026-113389 | HIGH | 9.9 | 2026-10-20 | A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of t… | |
| CVE-2026-112371 | HIGH | 9.9 | 2026-10-19 | A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation… | |
| CVE-2026-112370 | HIGH | 9.9 | 2026-10-19 | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os comman… | |
| CVE-2026-113736 | HIGH | 9.8 | 2026-10-21 | A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the comp… | |
| CVE-2022-51022 | HIGH | Patched | 9.1 | 2026-10-22 | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers… |
| CVE-2026-109395 | HIGH | Patched | 9.1 | 2026-10-20 | Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references … |
| CVE-2026-114111 | HIGH | Patched | — | 2026-10-21 | sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to co… |
| CVE-2026-114112 | HIGH | Patched | — | 2026-10-21 | Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images… |
| CVE-2026-115935 | HIGH | 8.8 | 2026-10-23 | The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can pl… | |
| CVE-2026-115938 | HIGH | 8.8 | 2026-10-23 | Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s… | |
| CVE-2026-115895 | HIGH | Patched | 8.8 | 2026-10-23 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleComp… |
| CVE-2026-79982 | HIGH | 8.8 | 2026-10-23 | The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buf… | |
| CVE-2026-57845 | HIGH | 8.8 | 2026-10-23 | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle… | |
| CVE-2026-53918 | HIGH | Patched | — | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer … |
| CVE-2026-114621 | HIGH | Patched | 8.8 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request… |
| CVE-2026-57144 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforc… |
| CVE-2026-55888 | HIGH | Patched | — | 2026-10-23 | XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary fil… |
| CVE-2026-57117 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and … |