Export limit exceeded: 413485 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 413485 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ',' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (413485 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-79865 2026-10-23 9.6 Critical
No description provided
CVE-2026-79866 2026-10-23 9.6 Critical
No description provided
CVE-2026-79867 2026-10-23 9.6 Critical
No description provided
CVE-2026-79868 2026-10-23 9.6 Critical
No description provided
CVE-2026-79871 2026-10-23 9.6 Critical
No description provided
CVE-2026-79873 2026-10-23 9.3 Critical
No description provided
CVE-2026-79875 2026-10-23 9.3 Critical
No description provided
CVE-2026-79878 2026-10-23 8.8 High
No description provided
CVE-2026-79879 2026-10-23 8.8 High
No description provided
CVE-2026-79881 2026-10-23 8.5 High
No description provided
CVE-2026-79883 2026-10-23 8.3 High
No description provided
CVE-2026-79884 2026-10-23 8.2 High
No description provided
CVE-2026-79885 2026-10-23 8.2 High
No description provided
CVE-2026-79886 2026-10-23 8.2 High
No description provided
CVE-2026-79889 2026-10-23 8.1 High
No description provided
CVE-2026-79892 2026-10-23 7.8 High
No description provided
CVE-2026-79895 2026-10-23 7.5 High
No description provided
CVE-2026-115349 2 Lepture, Mistune Project 2 Mistune, Mistune 2026-10-23 7.5 High
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
CVE-2026-115371 2 Linuxcontainers, Lxc 2 Incus, Incus 2026-10-23 7.1 High
Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read, modify or delete objects in those buckets.
CVE-2026-55835 2026-10-23 N/A
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The /json/<uuid>/report API endpoint (CaptureReport) is incorrectly passing the email and comment parameters, overwriting as_admin. When True, as_admin will trigger a search query on a MISP instance (if configured) and add a list of matching URLs in the email sent to the analyst (not the submitter, so there is no risk of leaking information) . It could potentially cause a DoS on the MISP instance. This issue has been patched in version 1.39.4.