Search
6,058 CVEs · Medium severity
CVEs (6,058, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 6,058 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115892 | MEDIUM | Patched | — | 2026-10-23 | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payloa… |
| CVE-2026-115886 | MEDIUM | Patched | 6.5 | 2026-10-23 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, a… |
| CVE-2026-115885 | MEDIUM | Patched | — | 2026-10-23 | The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on stand… |
| CVE-2026-115883 | MEDIUM | Patched | — | 2026-10-23 | LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langg… |
| CVE-2026-75525 | MEDIUM | 5.3 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can sto… | |
| CVE-2026-75524 | MEDIUM | Patched | 5.4 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing … |
| CVE-2026-115877 | MEDIUM | Patched | 5.4 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte i… |
| CVE-2026-115774 | MEDIUM | Patched | 4.9 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseN… |
| CVE-2026-79981 | MEDIUM | 6.5 | 2026-10-23 | The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() -> regi… | |
| CVE-2026-79980 | MEDIUM | 5.6 | 2026-10-23 | The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transaction random va… | |
| CVE-2026-115845 | MEDIUM | 6.4 | 2026-10-23 | An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary … | |
| CVE-2026-115813 | MEDIUM | 5.8 | 2026-10-23 | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal n… | |
| CVE-2026-115567 | MEDIUM | Patched | — | 2026-10-23 | Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded… |
| CVE-2026-115810 | MEDIUM | Patched | 7.7 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server … |
| CVE-2026-106074 | MEDIUM | 4.8 | 2026-10-23 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land st… | |
| CVE-2026-106072 | MEDIUM | 6.7 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spel… | |
| CVE-2026-105481 | MEDIUM | 6.5 | 2026-10-23 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete f… | |
| CVE-2026-55465 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST … |
| CVE-2026-55463 | MEDIUM | Patched | 6.5 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocke… |
| CVE-2026-55444 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss… |
| CVE-2026-55442 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() … |
| CVE-2026-55222 | MEDIUM | 5.1 | 2026-10-23 | Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be … | |
| CVE-2026-49442 | MEDIUM | Patched | 5.3 | 2026-10-23 | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames… |
| CVE-2026-46531 | MEDIUM | Patched | 5.5 | 2026-10-23 | Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL in… |
| CVE-2026-46347 | MEDIUM | Patched | 6.8 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the ap… |