Export limit exceeded: 53630 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (53630 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-79856 2026-10-23 9.8 Critical
No description provided
CVE-2026-79862 2026-10-23 9.6 Critical
No description provided
CVE-2026-95707 2026-10-23 7.2 High
No description provided
CVE-2026-95713 2026-10-23 7 High
No description provided
CVE-2026-95714 2026-10-23 6.8 Medium
No description provided
CVE-2026-79872 2026-10-23 9.4 Critical
No description provided
CVE-2026-79877 2026-10-23 8.8 High
No description provided
CVE-2026-114649 1 Mongodb 1 C# Driver 2026-10-23 6.8 Medium
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.
CVE-2026-115508 1 Unclecode 1 Crawl4ai 2026-10-23 6.5 Medium
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
CVE-2026-114615 1 Authlib 1 Authlib 2026-10-23 7.4 High
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.
CVE-2026-79859 2026-10-23 9.8 Critical
No description provided
CVE-2026-79888 2026-10-23 8.1 High
No description provided
CVE-2026-79891 2026-10-23 8.1 High
No description provided
CVE-2026-79893 2026-10-23 7.5 High
No description provided
CVE-2026-79955 2026-10-23 7.5 High
No description provided
CVE-2026-95720 2026-10-23 4.4 Medium
No description provided
CVE-2026-95721 2026-10-23 3.3 Low
No description provided
CVE-2026-115484 2 Red Hat, Redhat 2 Enterprise Linux, Enterprise Linux 2026-10-23 7.6 High
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
CVE-2026-79860 2026-10-23 9.8 Critical
No description provided
CVE-2026-79863 2026-10-23 9.6 Critical
No description provided