Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 330new in the last 7 days
- 8added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-119339 | Medium CVSS 5.5 |
- Applications & supply chain |
Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a… | 30 Oct 2026 |
| CVE-2026-119338 | Medium CVSS 6.9 |
- Applications & supply chain |
Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys… | 30 Oct 2026 |
| CVE-2026-117645 | Medium CVSS 5.3 |
- Operating systems & software |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework… | 30 Oct 2026 |
| CVE-2026-62337 | Medium CVSS 6.9 |
- Identity & access |
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof… | 30 Oct 2026 |
| CVE-2026-62335 | Medium CVSS 6.9 |
- Operating systems & software |
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x… | 30 Oct 2026 |
| CVE-2026-61618 | Medium CVSS 6.9 |
- Operating systems & software |
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded… | 30 Oct 2026 |
| CVE-2026-55493 | Medium CVSS 6.5 |
- Identity & access |
HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible… | 30 Oct 2026 |
| CVE-2026-55098 | Medium CVSS 6.5 |
- Applications & supply chain |
Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the… | 30 Oct 2026 |
| CVE-2026-119730 | Medium CVSS 5.1 |
- Applications & supply chain |
Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote… | 30 Oct 2026 |
| CVE-2026-119329 | Medium CVSS 4.3 |
- Applications & supply chain |
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers… | 30 Oct 2026 |
| CVE-2026-119328 | Medium CVSS 6.5 |
- Operating systems & software |
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated… | 30 Oct 2026 |
| CVE-2026-116248 | Medium CVSS 6.0 |
- Network & security devices |
In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the… | 30 Oct 2026 |
| CVE-2026-115828 | Medium CVSS 5.1 |
- Operating systems & software |
In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.