Filter and search through 392,438 vulnerabilities
| CVE ID | Description | CVSS | Priority | Trend | Exploit | Patch |
|---|---|---|---|---|---|---|
| CVE-2026-23527 | I was digging into h3 v1 (specifically v1.15.4) and found a critical HTTP Request Smuggling vulnerability. Basically, `readRawBody` is doing a strict... | 9.8 | 588 | Neutral | No |
| Yes |
| CVE-2026-23526 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff st... | 0.0 | 0 | Neutral | No | No |
| CVE-2026-23525 | 1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel ... | 6.4 | 188 | Neutral | No | No |
| CVE-2026-23524 | ### Impact This vulnerability affects Laravel Reverb versions prior to v1.7.0 when horizontal scaling is enabled (`REVERB_SCALING_ENABLED=true`). Th... | 9.8 | 717 | Neutral | No | Yes |
| CVE-2026-23523 | Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0, crafted deeplink can install... | 9.6 | 586 | Neutral | No | No |
| CVE-2026-23522 | ### Summary `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticated users to delete files from any knowledge base without verifying... | 3.7 | 145 | Neutral | No | Yes |
| CVE-2026-23520 | ## Summary Arcane’s updater service supported lifecycle labels `com.getarcaneapp.arcane.lifecycle.pre-update` and `com.getarcaneapp.arcane.lifecycle.... | 9.0 | 714 | Neutral | No | Yes |
| CVE-2026-23519 | ### Summary `thumbv6m-none-eabi` (Cortex M0, M0+ and M1) compiler emits non-constant time assembly when using `cmovnz` (portable version). I did not ... | 9.8 | 588 | Neutral | No | Yes |
| CVE-2026-23518 | ### Summary A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not proper... | 0.0 | 0 | Neutral | No | Yes |
| CVE-2026-23517 | ### Summary A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a resul... | 0.0 | 0 | Neutral | No | Yes |
| CVE-2026-23516 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execu... | 0.0 | 0 | Neutral | No | No |
| CVE-2026-23512 | SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability when Advanced Options setting is... | 8.6 | 538 | Neutral | No | No |
| CVE-2026-23511 | ### Summary A user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to ... | 5.3 | 124 | Neutral | No | Yes |
| CVE-2026-23499 | Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff u... | 0.0 | 0 | Neutral | No | No |
| CVE-2026-23498 | ### Impact We fixed with [CVE-2023-2017](https://github.com/advisories/GHSA-7v2v-9rm4-7m8f) Twig filters to only be executed with allowed functions. H... | 7.2 | 477 | Neutral | No | Yes |
| CVE-2026-23497 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and earlier, there is a stored XSS vu... | 5.4 | 116 | Neutral | No | Yes |
| CVE-2026-23496 | ### Summary The application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Ch... | 5.4 | 164 | Neutral | No | Yes |
| CVE-2026-23495 | ### Summary The API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Pro... | 4.3 | 142 | Neutral | No | Yes |
| CVE-2026-23494 | ### Summary The application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static rou... | 6.5 | 252 | Neutral | No | Yes |
| CVE-2026-23493 | ### Summary The http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie s... | 4.9 | 97 | Neutral | No | Yes |