Search
151,555 CVEs · High severity
CVEs (151,555, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 151,555 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-91093 | HIGH | — | 2026-10-23 | A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbit… | |
| CVE-2026-115570 | HIGH | Patched | 7.4 | 2026-10-23 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does … |
| CVE-2026-112342 | HIGH | Patched | 7.1 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permi… |
| CVE-2026-115863 | HIGH | 7.6 | 2026-10-23 | ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes f… | |
| CVE-2026-110975 | HIGH | 7.4 | 2026-10-23 | A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpo… | |
| CVE-2026-87901 | HIGH | 8.3 | 2026-10-23 | Improper sanitization in the registration module allows reflected Cross-Site Scripting. | |
| CVE-2026-106069 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the hos… | |
| CVE-2026-105483 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written … | |
| CVE-2026-105482 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fi… | |
| CVE-2026-57845 | HIGH | 8.8 | 2026-10-23 | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle… | |
| CVE-2026-58497 | HIGH | Patched | — | 2026-10-23 | Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the lega… |
| CVE-2026-55459 | HIGH | Patched | 7.4 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.ve… |
| CVE-2026-55457 | HIGH | Patched | 7.4 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empt… |
| CVE-2026-54668 | HIGH | Patched | — | 2026-10-23 | Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.… |
| CVE-2026-39902 | HIGH | Patched | 7.2 | 2026-10-23 | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirec… |
| CVE-2026-115478 | HIGH | Patched | — | 2026-10-23 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlin… |
| CVE-2026-115477 | HIGH | Patched | — | 2026-10-23 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` co… |
| CVE-2026-106765 | HIGH | 7.5 | 2026-10-23 | An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. | |
| CVE-2026-106764 | HIGH | 7.5 | 2026-10-23 | An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. | |
| CVE-2026-106763 | HIGH | 7.5 | 2026-10-23 | An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. | |
| CVE-2026-102786 | HIGH | — | 2026-10-23 | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5 | |
| CVE-2026-93640 | HIGH | 7.8 | 2026-10-23 | A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to access files with root pri… | |
| CVE-2026-93639 | HIGH | 8.7 | 2026-10-23 | A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet… | |
| CVE-2026-93631 | HIGH | 7.1 | 2026-10-23 | A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled exte… | |
| CVE-2026-55826 | HIGH | Patched | — | 2026-10-23 | The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tr… |