Search
37,354 CVEs · High severity
CVEs (37,354, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 37,354 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-115935 | HIGH | 8.8 | 2026-10-23 | The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can pl… | |
| CVE-2026-115937 | HIGH | 7.5 | 2026-10-23 | The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects wh… | |
| CVE-2026-115938 | HIGH | 8.8 | 2026-10-23 | Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s… | |
| CVE-2026-115895 | HIGH | Patched | 8.8 | 2026-10-23 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleComp… |
| CVE-2026-115887 | HIGH | Patched | 7.5 | 2026-10-23 | GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumbe… |
| CVE-2026-58202 | HIGH | Patched | 8.3 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails … |
| CVE-2026-65824 | HIGH | Patched | 7.4 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invit… |
| CVE-2026-65825 | HIGH | 7.5 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit book… | |
| CVE-2026-115775 | HIGH | Patched | — | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows a… |
| CVE-2026-115776 | HIGH | Patched | 7.5 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes r… |
| CVE-2026-115778 | HIGH | Patched | 7.5 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte rece… |
| CVE-2026-79982 | HIGH | 8.8 | 2026-10-23 | The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buf… | |
| CVE-2026-79977 | HIGH | 8.2 | 2026-10-23 | The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit r… | |
| CVE-2026-79979 | HIGH | 7.8 | 2026-10-23 | The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of v… | |
| CVE-2026-115580 | HIGH | Patched | — | 2026-10-23 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count excee… |
| CVE-2026-115585 | HIGH | Patched | — | 2026-10-23 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v co… |
| CVE-2026-115586 | HIGH | Patched | — | 2026-10-23 | virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt v… |
| CVE-2026-19741 | HIGH | 7.5 | 2026-10-23 | Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfi… | |
| CVE-2026-115572 | HIGH | Patched | — | 2026-10-23 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causi… |
| CVE-2026-91093 | HIGH | — | 2026-10-23 | A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbit… | |
| CVE-2026-115570 | HIGH | Patched | 7.4 | 2026-10-23 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does … |
| CVE-2026-112342 | HIGH | Patched | 7.1 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permi… |
| CVE-2026-115863 | HIGH | 7.6 | 2026-10-23 | ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes f… | |
| CVE-2026-110975 | HIGH | 7.4 | 2026-10-23 | A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpo… | |
| CVE-2026-87901 | HIGH | 8.3 | 2026-10-23 | Improper sanitization in the registration module allows reflected Cross-Site Scripting. |