All CVEs — page 339 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

HIGH 7.5CVE-2014-125130public exploit available2026-10-02
The vulnerability allows remote attackers to read arbitrary files on the server by exploiting a path traversal flaw in the Google MP3 Audio Player plugin's direct_download.php endpoint. This enables attackers to access sensitive configuration files like wp-config.php without authentication, potentially leading to complete site compromise.
UNSCOREDCVE-2026-648182026-10-02
HIGH 8.8CVE-2026-59265public exploit available2026-10-02
A code execution vulnerability in Apache OpenOffice versions 4.1.16 and earlier allows attackers to execute arbitrary code via crafted documents, posing a significant risk.
HIGH 7.5CVE-2026-104861public exploit available2026-10-02
The probe-image-size library has a denial-of-service vulnerability where attacker-controlled SVG data can cause excessive CPU usage and event loop blocking. This occurs because the parsing regex repeatedly scans to the end of input when malformed SVG contains many unclosed tags, leading to full buffer scanning without limits.
UNSCOREDCVE-2026-104859public exploit available2026-10-02
UNSCOREDCVE-2026-104855public exploit available2026-10-02
CRITICAL 9.3CVE-2026-1027952026-10-02
Improper access control allows unauthorized users to access sensitive information or perform actions they should not be able to.
UNSCOREDCVE-2026-102626public exploit available2026-10-02
UNSCOREDCVE-2026-104854public exploit available2026-10-02
UNSCOREDCVE-2026-104853public exploit available2026-10-02
HIGH 8.8CVE-2026-104851public exploit available2026-10-02
The flaw allows attackers to execute arbitrary Python code by manipulating template expressions in Kerchunk reference JSON documents, posing a high risk due to the potential for remote code execution.
UNSCOREDCVE-2026-104849public exploit available2026-10-02
UNSCOREDCVE-2026-104848public exploit available2026-10-02
MEDIUM 6.5CVE-2026-96613public exploit available2026-10-02
MEDIUM 4.2CVE-2026-94544public exploit available2026-10-02
MEDIUM 5.3CVE-2026-94543public exploit available2026-10-02
MEDIUM 5.4CVE-2026-94486public exploit available2026-10-02
MEDIUM 5.3CVE-2026-94485public exploit available2026-10-02
MEDIUM 4.8CVE-2026-94484public exploit available2026-10-02
MEDIUM 6.5CVE-2026-94483public exploit available2026-10-02
HIGH 7.5CVE-2026-67989public exploit available2026-10-02
A polynomial-time regular expression denial-of-service vulnerability exists in the Mistral model capability matching functionality of crmne/ruby_llm, which can be exploited by attackers to cause high CPU consumption and system unresponsiveness when processing malicious input patterns.
CRITICAL 9.8CVE-2026-51922public exploit available2026-10-02
The flaw allows code injection in agentscope v1.0.20, enabling attackers to execute arbitrary commands, which can lead to full system compromise.
CRITICAL 9.8CVE-2026-51918public exploit available2026-10-02
The flaw allows code injection in FinRobot 1.0.0, enabling attackers to execute arbitrary code on the system.
HIGH 7.3CVE-2026-51917public exploit available2026-10-02
HIGH 7.5CVE-2026-51916public exploit available2026-10-02
The TransformerOptimus SuperAGI application has an access control flaw that allows unauthenticated users to delete any knowledge object by calling the delete_user_knowledge endpoint without proper authentication or organization ownership verification.