Search
5,074 CVEs
CVEs (5,074, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 5,074 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-91093 | HIGH | — | 2026-10-23 | A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbit… | |
| CVE-2026-115845 | MEDIUM | 6.4 | 2026-10-23 | An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary … | |
| CVE-2026-115570 | HIGH | Patched | 7.4 | 2026-10-23 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does … |
| CVE-2026-115569 | LOW | Patched | 3.3 | 2026-10-23 | Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project r… |
| CVE-2026-112342 | HIGH | Patched | 7.1 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permi… |
| CVE-2026-115863 | HIGH | 7.6 | 2026-10-23 | ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message. This occurs in get_domains in gdhcp/client.c. It copies a fixed NS_MAXDNAME (1025) bytes f… | |
| CVE-2026-115813 | MEDIUM | 5.8 | 2026-10-23 | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal n… | |
| CVE-2026-115812 | CRITICAL | 9.8 | 2026-10-23 | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via… | |
| CVE-2026-115567 | MEDIUM | Patched | — | 2026-10-23 | Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded… |
| CVE-2026-110975 | HIGH | 7.4 | 2026-10-23 | A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpo… | |
| CVE-2026-87901 | HIGH | 8.3 | 2026-10-23 | Improper sanitization in the registration module allows reflected Cross-Site Scripting. | |
| CVE-2026-115810 | MEDIUM | Patched | 7.7 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server … |
| CVE-2026-106074 | MEDIUM | 4.8 | 2026-10-23 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land st… | |
| CVE-2026-106073 | LOW | 3.3 | 2026-10-23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-2171… | |
| CVE-2026-106072 | MEDIUM | 6.7 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spel… | |
| CVE-2026-106071 | LOW | 3.6 | 2026-10-23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the req… | |
| CVE-2026-106070 | LOW | 3.7 | 2026-10-23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `… | |
| CVE-2026-106069 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the hos… | |
| CVE-2026-105483 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written … | |
| CVE-2026-105482 | HIGH | 7.4 | 2026-10-23 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fi… | |
| CVE-2026-105481 | MEDIUM | 6.5 | 2026-10-23 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete f… | |
| CVE-2026-57845 | HIGH | 8.8 | 2026-10-23 | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle… | |
| CVE-2026-52356 | NONE | — | 2026-10-23 | An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecti… | |
| CVE-2026-50787 | NONE | — | 2026-10-23 | e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied param… | |
| CVE-2025-45528 | NONE | — | 2026-10-23 | An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF |