Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-119480 | Medium CVSS 6.5 |
- Operating systems & software |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock… | 1 Nov 2026 |
| CVE-2026-120192 | Medium CVSS 5.5 |
- Operating systems & software |
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file… | 1 Nov 2026 |
| CVE-2026-120252 | Medium CVSS 6.8 |
- Operating systems & software |
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG… | 1 Nov 2026 |
| CVE-2026-120250 | Medium CVSS 6.0 |
- Operating systems & software |
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and… | 1 Nov 2026 |
| CVE-2026-120249 | Medium CVSS 6.9 |
- Operating systems & software |
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the… | 1 Nov 2026 |
| CVE-2026-120248 | Medium CVSS 4.6 |
- Operating systems & software |
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office… | 1 Nov 2026 |
| CVE-2026-120247 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows… | 1 Nov 2026 |
| CVE-2026-120246 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack… | 1 Nov 2026 |
| CVE-2026-120245 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks… | 1 Nov 2026 |
| CVE-2026-120244 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows… | 1 Nov 2026 |
| CVE-2026-120243 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows… | 1 Nov 2026 |
| CVE-2026-120206 | Medium CVSS 5.9 |
- Operating systems & software |
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to… | 31 Oct 2026 |
| CVE-2026-120204 | Medium CVSS 6.3 |
- Operating systems & software |
DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows… | 31 Oct 2026 |
| CVE-2026-120200 | Medium CVSS 5.3 |
- Operating systems & software |
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to… | 31 Oct 2026 |
| CVE-2026-118598 | Medium CVSS 6.5 |
- Operating systems & software |
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the… | 31 Oct 2026 |
| CVE-2026-77152 | Medium CVSS 5.3 |
- Operating systems & software |
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field… | 31 Oct 2026 |
| CVE-2026-63410 | Medium CVSS 5.9 |
- Operating systems & software |
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time… | 30 Oct 2026 |
| CVE-2026-63402 | Medium CVSS 5.9 |
- Operating systems & software |
i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js`… | 30 Oct 2026 |
| CVE-2026-61725 | Medium CVSS 6.1 |
- Operating systems & software |
sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z… | 30 Oct 2026 |
| CVE-2026-63115 | Medium CVSS 5.3 |
- Operating systems & software |
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo`… | 30 Oct 2026 |
| CVE-2026-62347 | Medium CVSS 5.9 |
- Operating systems & software |
Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call… | 30 Oct 2026 |
| CVE-2026-55614 | Medium CVSS 6.9 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases… | 30 Oct 2026 |
| CVE-2026-55613 | Medium CVSS 6.9 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize… | 30 Oct 2026 |
| CVE-2026-117645 | Medium CVSS 5.3 |
- Operating systems & software |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework… | 30 Oct 2026 |
| CVE-2026-62335 | Medium CVSS 6.9 |
- Operating systems & software |
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.