Search
172,815 CVEs · Medium severity
CVEs (172,815, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 172,815 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115845 | MEDIUM | 6.4 | 2026-10-23 | An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary … | |
| CVE-2026-115813 | MEDIUM | 5.8 | 2026-10-23 | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal n… | |
| CVE-2026-115567 | MEDIUM | Patched | — | 2026-10-23 | Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded… |
| CVE-2026-115810 | MEDIUM | Patched | 7.7 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server … |
| CVE-2026-106074 | MEDIUM | 4.8 | 2026-10-23 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land st… | |
| CVE-2026-106072 | MEDIUM | 6.7 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spel… | |
| CVE-2026-105481 | MEDIUM | 6.5 | 2026-10-23 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete f… | |
| CVE-2026-55465 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST … |
| CVE-2026-55463 | MEDIUM | Patched | 6.5 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocke… |
| CVE-2026-55444 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss… |
| CVE-2026-55442 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() … |
| CVE-2026-55222 | MEDIUM | 5.1 | 2026-10-23 | Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be … | |
| CVE-2026-49442 | MEDIUM | Patched | 5.3 | 2026-10-23 | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames… |
| CVE-2026-46531 | MEDIUM | Patched | 5.5 | 2026-10-23 | Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL in… |
| CVE-2026-46347 | MEDIUM | Patched | 6.8 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the ap… |
| CVE-2026-46346 | MEDIUM | Patched | 6.5 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based… |
| CVE-2026-112333 | MEDIUM | Patched | 5.4 | 2026-10-23 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inj… |
| CVE-2026-93638 | MEDIUM | 6.1 | 2026-10-23 | A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zr… | |
| CVE-2026-93636 | MEDIUM | 4.3 | 2026-10-23 | An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources throu… | |
| CVE-2026-93634 | MEDIUM | 4.3 | 2026-10-23 | A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbo… | |
| CVE-2026-93633 | MEDIUM | 5.4 | 2026-10-23 | A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-control… | |
| CVE-2026-93630 | MEDIUM | 4.3 | 2026-10-23 | A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on for… | |
| CVE-2026-93629 | MEDIUM | 5.3 | 2026-10-23 | An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another us… | |
| CVE-2026-93628 | MEDIUM | 5.3 | 2026-10-23 | An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's r… | |
| CVE-2026-93627 | MEDIUM | 5.3 | 2026-10-23 | An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an exist… |