Search
15,976 CVEs
CVEs (15,976, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 15,976 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-95209 | NONE | — | 2026-10-08 | An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS). | |
| CVE-2026-88648 | NONE | — | 2026-10-08 | Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unautho… | |
| CVE-2026-84290 | MEDIUM | 5.1 | 2026-10-08 | IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL … | |
| CVE-2026-84278 | HIGH | 7.2 | 2026-10-08 | IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can … | |
| CVE-2026-84276 | HIGH | 7.5 | 2026-10-08 | IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the e… | |
| CVE-2026-67693 | NONE | — | 2026-10-08 | An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination … | |
| CVE-2026-40804 | HIGH | 7.1 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aB… | |
| CVE-2026-107704 | CRITICAL | 9.8 | 2026-10-08 | The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands … | |
| CVE-2026-107703 | CRITICAL | 9.8 | 2026-10-08 | @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and… | |
| CVE-2026-107701 | HIGH | 8.2 | 2026-10-08 | dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attacker… | |
| CVE-2026-107700 | CRITICAL | 9.8 | 2026-10-08 | dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is c… | |
| CVE-2026-107699 | CRITICAL | 9.8 | 2026-10-08 | ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output pat… | |
| CVE-2026-107388 | MEDIUM | Patched | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag bo… |
| CVE-2026-107387 | MEDIUM | Patched | 6.2 | 2026-10-08 | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Arra… |
| CVE-2026-107386 | MEDIUM | Patched | — | 2026-10-08 | amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune complete… |
| CVE-2026-107385 | HIGH | Patched | 7.4 | 2026-10-08 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escapi… |
| CVE-2026-107384 | HIGH | Patched | 8.1 | 2026-10-08 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications… |
| CVE-2026-107383 | HIGH | Patched | 7.5 | 2026-10-08 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon … |
| CVE-2026-107382 | MEDIUM | Patched | 5.9 | 2026-10-08 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprin… |
| CVE-2026-107325 | HIGH | 5.9 | 2026-10-08 | Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or b… | |
| CVE-2026-107324 | HIGH | 5.9 | 2026-10-08 | An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An… | |
| CVE-2026-107322 | HIGH | Patched | 7.8 | 2026-10-08 | An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary… |
| CVE-2026-106438 | MEDIUM | 4.0 | 2026-10-08 | An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. T… | |
| CVE-2026-106437 | MEDIUM | 6.2 | 2026-10-08 | The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow uns… | |
| CVE-2026-106434 | MEDIUM | 4.3 | 2026-10-08 | The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can … |