CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
249128 CVEs matched. Showing 51–100 (page 2 of 4983).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-120416 |
AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery | MEDIUM | 6.9 | — | — | VulDB | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-111048 |
FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes | HIGH | 8.4 | — | — | GitHub_M | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-119085 |
Template injection in the publishing component of awslabs Virtual Engineering Workbench | CRITICAL | 9.4 | — | — | AMZN | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120630 |
CVE-2026-120630 | — | — | — | — | certcc | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120627 |
CVE-2026-120627 | — | — | — | — | certcc | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120596 |
CVE-2026-120596 | — | — | — | — | certcc | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-105769 |
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts | CRITICAL | 9.3 | — | — | chainguard | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-119301 |
Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas | MEDIUM | 5.0 | — | — | AMZN | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-109142 |
Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same ser… | HIGH | 8.4 | — | — | NLnet Labs | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-109141 |
Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import | HIGH | 8.4 | — | — | NLnet Labs | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-109140 |
Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin"… | HIGH | 8.4 | — | — | NLnet Labs | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-16306 |
CVE-2026-16306 | — | — | — | — | certcc | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120500 |
An Otter Wiki before 2.26.2 Stored XSS via Math Code Block | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-104080 |
Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token | HIGH | 8.6 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-115654 |
User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own | MEDIUM | 6.9 | — | — | eclipse | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-115653 |
Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privil… | HIGH | 7.0 | — | — | eclipse | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-114408 |
NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full | HIGH | 8.7 | — | — | eclipse | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-118052 |
Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module… | MEDIUM | 6.8 | — | — | eclipse | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120492 |
Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls | MEDIUM | 6.3 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120491 |
Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120489 |
Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120488 |
LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120487 |
LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades | HIGH | 8.6 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120461 |
Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch | HIGH | 8.7 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120460 |
Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers | HIGH | 8.7 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120459 |
python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key | CRITICAL | 9.1 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120458 |
Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser | MEDIUM | 6.8 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120457 |
libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder | MEDIUM | 5.8 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120456 |
L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120455 |
rapidyaml through 0.16.0 Out-of-Bounds Write via ParseEngine::_add_annotation() | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120454 |
The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression | MEDIUM | 6.8 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120453 |
The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header | MEDIUM | 4.8 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120452 |
libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion | MEDIUM | 5.2 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120451 |
libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver | HIGH | 7.0 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120450 |
LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120449 |
Outline before 1.12.0 Improper Access Control via Public Document Shares | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120448 |
DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint | HIGH | 8.6 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120447 |
HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code | CRITICAL | 9.2 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120446 |
madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API | HIGH | 8.8 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120445 |
madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware | HIGH | 8.7 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120444 |
GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop | HIGH | 7.2 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120443 |
GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120442 |
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass | CRITICAL | 9.3 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120441 |
OwnTone Server through 29.3 SQL Injection via MPD sticker find Command | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120440 |
QuickJS-NG before 0.16.0 Memory Leak via Atomics.store | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120439 |
QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort | HIGH | 8.3 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120438 |
QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration | HIGH | 8.5 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120437 |
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds Read via tgatoppm | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-02 | — | — | raw · ⬇ |
CVE-2026-120436 |
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm | HIGH | 8.5 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120435 |
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm | HIGH | 8.5 | — | — | VulnCheck | 2026-11-02 | — | ⚠ Threat | raw · ⬇ |