Search
4,651 CVEs
EOL hidden · Show all products
CVEs (4,651, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 4,651 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115931 | CRITICAL | 9.9 | 2026-10-23 | Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user … | |
| CVE-2026-110814 | NONE | — | 2026-10-23 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-108793 | NONE | — | 2026-10-23 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-108537 | NONE | — | 2026-10-23 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-115938 | HIGH | 8.8 | 2026-10-23 | Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s… | |
| CVE-2026-115937 | HIGH | 7.5 | 2026-10-23 | The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects wh… | |
| CVE-2026-115935 | HIGH | 8.8 | 2026-10-23 | The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can pl… | |
| CVE-2026-115897 | LOW | Patched | — | 2026-10-23 | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic … |
| CVE-2026-115895 | HIGH | Patched | 8.8 | 2026-10-23 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleComp… |
| CVE-2026-115893 | CRITICAL | Patched | 9.9 | 2026-10-23 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more tha… |
| CVE-2026-115892 | MEDIUM | Patched | — | 2026-10-23 | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payloa… |
| CVE-2026-115889 | CRITICAL | Patched | 9.9 | 2026-10-23 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in releas… |
| CVE-2026-115887 | HIGH | Patched | 7.5 | 2026-10-23 | GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumbe… |
| CVE-2026-115886 | MEDIUM | Patched | 6.5 | 2026-10-23 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, a… |
| CVE-2026-115885 | MEDIUM | Patched | — | 2026-10-23 | The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on stand… |
| CVE-2026-115883 | MEDIUM | Patched | — | 2026-10-23 | LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langg… |
| CVE-2026-115801 | LOW | 5.3 | 2026-10-23 | A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp o… | |
| CVE-2026-83813 | LOW | Patched | 3.1 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response… |
| CVE-2026-75525 | MEDIUM | 5.3 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can sto… | |
| CVE-2026-75524 | MEDIUM | Patched | 5.4 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing … |
| CVE-2026-65825 | HIGH | 7.5 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit book… | |
| CVE-2026-65824 | HIGH | Patched | 7.4 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invit… |
| CVE-2026-58202 | HIGH | Patched | 8.3 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails … |
| CVE-2026-57849 | NONE | — | 2026-10-23 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-115877 | MEDIUM | Patched | 5.4 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte i… |