CVE Database
8818 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-118756 | MEDIUM | 5.5 | gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that … |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118754 | MEDIUM | 5.3 | Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recru… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-118693 | MEDIUM | 4.7 | CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_imag… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118538 | MEDIUM | 5.5 | A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Ro… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118537 | MEDIUM | 4.3 | A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file … |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-116641 | MEDIUM | 6.8 | The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the s… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118667 | MEDIUM | 4.3 | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118663 | MEDIUM | 5.3 | @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveSta… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-118661 | MEDIUM | 6.5 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prio… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-118658 | MEDIUM | 4.7 | Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarde… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118657 | MEDIUM | 5.9 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forward… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-118656 | MEDIUM | 6.1 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes o… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-61529 | MEDIUM | 4.7 | Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, th… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-54162 | MEDIUM | 4.7 | Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, i… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-11854 | MEDIUM | 6.1 | The authentication endpoint generates an error message that includes reflected data directly from th… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118655 | MEDIUM | 5.9 | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decod… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118654 | MEDIUM | 5.9 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-118653 | MEDIUM | 5.3 | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-F… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-118652 | MEDIUM | 6.1 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatena… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118651 | MEDIUM | 5.3 | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-su… |
T1190
T1203
|
|
2026-10-28 |