CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
248917 CVEs matched. Showing 1–50 (page 1 of 4979).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-120324 |
Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal | MEDIUM | 6.9 | 8.3 | — | VulDB | 2026-11-02 | 10 | — | raw · ⬇ |
CVE-2026-120317 |
http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity | HIGH | 8.2 | 5.9 | — | VulnCheck | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120316 |
http4k before 6.62.0.0-ee Path Traversal via ThymeleafTemplates Template Resolution | HIGH | 8.2 | 5.9 | — | VulnCheck | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120315 |
LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile | HIGH | 8.7 | 8.8 | — | VulnCheck | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120314 |
Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations | MEDIUM | 6.9 | 7.3 | — | VulnCheck | 2026-11-02 | 10 | — | raw · ⬇ |
CVE-2026-120313 |
Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath | HIGH | 8.7 | 7.5 | — | VulnCheck | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120312 |
Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name | HIGH | 8.7 | 8.8 | — | VulnCheck | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120311 |
Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID | HIGH | 8.7 | 8.8 | — | VulnCheck | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120310 |
Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response | LOW | 2.3 | 3.1 | — | VulnCheck | 2026-11-02 | 10 | — | raw · ⬇ |
CVE-2026-120309 |
Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam | MEDIUM | 6.3 | 3.7 | — | VulnCheck | 2026-11-02 | 10 | — | raw · ⬇ |
CVE-2026-120323 |
samanhappy MCPHub passthroughHeaders.ts information disclosure | MEDIUM | 5.3 | 4.3 | — | VulDB | 2026-11-02 | 10 | — | raw · ⬇ |
CVE-2026-120322 |
Termix-SSH Termix transferToHost path traversal | CRITICAL | 9.4 | 9.9 | — | VulDB | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120320 |
jxxghp MoviePilot Workflow Fork Endpoint workflow.py WorkflowExecutor.restore_context deserialization | MEDIUM | 5.1 | 4.7 | — | VulDB | 2026-11-02 | 10 | — | raw · ⬇ |
CVE-2026-120319 |
Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization | MEDIUM | 5.3 | — | — | VulDB | 2026-11-02 | 10 | — | raw · ⬇ |
CVE-2026-120283 |
Linksys E8450 portal.cgi strcpy stack-based overflow | CRITICAL | 10.0 | 10.0 | — | VulDB | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120282 |
WAVLINK WN536AX6-A protocol.csp host_black os command injection | CRITICAL | 9.4 | 9.9 | — | VulDB | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120280 |
WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection | CRITICAL | 10.0 | 10.0 | — | VulDB | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120279 |
WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection | CRITICAL | 10.0 | 10.0 | — | VulDB | 2026-11-02 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120278 |
WAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authentication | MEDIUM | 6.9 | 5.3 | — | VulDB | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-120277 |
WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection | CRITICAL | 10.0 | 10.0 | — | VulDB | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120276 |
WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection | CRITICAL | 10.0 | 10.0 | — | VulDB | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120275 |
Shanghai Xi Yu Ji Zhi Technology Minimax Code Find os command injection | MEDIUM | 5.1 | 5.5 | — | VulDB | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-111089 |
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup | HIGH | 7.6 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-95863 |
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup | HIGH | 7.6 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-87718 |
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates | LOW | 2.3 | — | — | apache | 2026-11-01 | — | — | raw · ⬇ |
CVE-2026-84231 |
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag | HIGH | 7.4 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-84177 |
Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore | MEDIUM | 6.3 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-84172 |
Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader | MEDIUM | 6.3 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-84170 |
Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource | HIGH | 8.3 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-83594 |
Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names | HIGH | 8.3 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-83559 |
Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal | HIGH | 7.4 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-83539 |
Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data | HIGH | 7.4 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-82956 |
Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name | HIGH | 7.6 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-82898 |
Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in | LOW | 2.1 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-82840 |
Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication | HIGH | 7.2 | — | — | apache | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-82705 |
Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component | MEDIUM | 6.3 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-82704 |
Apache Wicket: A listener is invoked on a page instance the request itself created and never configured | MEDIUM | 6.9 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-82559 |
Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation | LOW | 2.3 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-82558 |
Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke | LOW | 2.3 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-82557 |
Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission | MEDIUM | 6.9 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-82115 |
Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource | MEDIUM | 6.3 | — | — | apache | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-120274 |
beecue FastBee Groovy Script Executor script code injection | MEDIUM | 5.1 | 4.7 | — | VulDB | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-120242 |
Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting | MEDIUM | 4.8 | 2.4 | — | VulDB | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-120241 |
Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow | HIGH | 8.7 | 7.5 | — | VulDB | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120240 |
WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection | CRITICAL | 9.4 | 9.9 | — | VulDB | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120239 |
WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection | CRITICAL | 9.4 | 9.9 | — | VulDB | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120238 |
WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection | CRITICAL | 9.4 | 9.9 | — | VulDB | 2026-11-01 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120237 |
ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumption | MEDIUM | 5.3 | 4.3 | — | VulDB | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-120236 |
ag-ui-protocol ag-ui Transport Decoder input validation | MEDIUM | 5.3 | 6.3 | — | VulDB | 2026-11-01 | 10 | — | raw · ⬇ |
CVE-2026-74760 |
Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gc… | — | — | — | — | CPANSec | 2026-11-01 | 10 | — | raw · ⬇ |