Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 419new in the last 7 days
- 8added as actively exploited
- 37critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-61850 | Critical CVSS 9.3 |
- Identity & access |
Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two… | 30 Oct 2026 |
| CVE-2026-61694 | Low CVSS 3.7 |
- Operating systems & software |
go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified… | 30 Oct 2026 |
| CVE-2026-61620 | Critical CVSS 9.8 |
- Applications & supply chain |
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other… | 30 Oct 2026 |
| CVE-2026-61618 | Medium CVSS 6.9 |
- Operating systems & software |
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded… | 30 Oct 2026 |
| CVE-2026-55598 | Critical CVSS 9.1 |
- Identity & access |
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user… | 30 Oct 2026 |
| CVE-2026-55493 | Medium CVSS 6.5 |
- Identity & access |
HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible… | 30 Oct 2026 |
| CVE-2026-55098 | Medium CVSS 6.5 |
- Applications & supply chain |
Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the… | 30 Oct 2026 |
| CVE-2026-119730 | Medium CVSS 5.1 |
- Applications & supply chain |
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote… | 30 Oct 2026 |
| CVE-2026-119337 | High CVSS 7.1 |
- Applications & supply chain |
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST… | 30 Oct 2026 |
| CVE-2026-119336 | High CVSS 7.8 |
- Network & security devices |
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.… | 30 Oct 2026 |
| CVE-2026-119335 | High CVSS 7.8 |
- Network & security devices |
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.… | 30 Oct 2026 |
| CVE-2026-119334 | Low CVSS 2.2 |
- Network & security devices |
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software.… | 30 Oct 2026 |
| CVE-2026-119333 | High CVSS 7.8 |
- Operating systems & software |
draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched… | 30 Oct 2026 |
| CVE-2026-119332 | High CVSS 8.8 |
- Operating systems & software |
Ladybird is a truly independent web browser. Prior to 209579c96473c75bd5eba9701fcadb841a045964,… | 30 Oct 2026 |
| CVE-2026-119331 | High CVSS 7.1 |
- Operating systems & software |
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit,… | 30 Oct 2026 |
| CVE-2026-119330 | Low CVSS 3.5 |
- Applications & supply chain |
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation… | 30 Oct 2026 |
| CVE-2026-119329 | Medium CVSS 4.3 |
- Applications & supply chain |
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers… | 30 Oct 2026 |
| CVE-2026-119328 | Medium CVSS 6.5 |
- Operating systems & software |
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated… | 30 Oct 2026 |
| CVE-2026-116252 | High CVSS 7.1 |
- Operating systems & software |
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq… | 30 Oct 2026 |
| CVE-2026-116251 | Low CVSS 2.3 |
- Operating systems & software |
pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own… | 30 Oct 2026 |
| CVE-2026-116250 | High CVSS 7.3 |
- Operating systems & software |
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with… | 30 Oct 2026 |
| CVE-2026-116249 | High CVSS 7.2 |
- Identity & access |
In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file… | 30 Oct 2026 |
| CVE-2026-116248 | Medium CVSS 6.0 |
- Network & security devices |
In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the… | 30 Oct 2026 |
| CVE-2026-116247 | High CVSS 7.1 |
- Operating systems & software |
When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one… | 30 Oct 2026 |
| CVE-2026-116246 | High CVSS 7.0 |
- Operating systems & software |
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.