Browse All CVEs
29,323 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-97854 |
critical | 9.8 | — | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command in | |
CVE-2026-97860 |
medium | 6.7 | — | 2026-10-29 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unq | |
CVE-2026-103665 |
high | 7.8 | — | 2026-10-29 | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecu | |
CVE-2026-109822 |
medium | 6.5 | — | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with in | |
CVE-2026-119028 |
high | 8.7 | — | 2026-10-29 | oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attack | |
CVE-2026-119027 |
high | 7.7 | — | 2026-10-29 | oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attack | |
CVE-2026-5702 |
medium | 4.8 | — | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an att | |
CVE-2026-5699 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an att | |
CVE-2026-5700 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an att | |
CVE-2026-5697 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an att | |
CVE-2026-5698 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an att | |
CVE-2026-96767 |
high | 7.2 | — | 2026-10-29 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to | |
CVE-2026-27401 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce y | |
CVE-2026-92086 |
medium | 5.3 | — | 2026-10-29 | The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all | |
CVE-2026-115821 |
high | 7.2 | — | 2026-10-29 | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' | |
CVE-2026-119025 |
high | 7.7 | — | 2026-10-29 | open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attack | |
CVE-2026-109216 |
medium | 4.9 | — | 2026-10-29 | The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stor | |
CVE-2026-110184 |
high | 7.5 | — | 2026-10-29 | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' para | |
CVE-2026-112827 |
high | 7.1 | — | 2026-10-29 | Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and Woo | |
CVE-2026-114193 |
high | 7.5 | — | 2026-10-29 | Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exp | |
CVE-2026-115592 |
high | 7.1 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-115599 |
high | 7.5 | — | 2026-10-29 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting I | |
CVE-2026-115611 |
high | 7.1 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-115962 |
medium | 4.3 | — | 2026-10-29 | Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Sp | |
CVE-2026-115963 |
high | 7.1 | — | 2026-10-29 | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper- | |
CVE-2026-115964 |
critical | 9.3 | — | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-115965 |
high | 8.5 | — | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-115967 |
high | 8.8 | — | 2026-10-29 | Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone | |
CVE-2026-116409 |
high | 7.1 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-118989 |
medium | 5.1 | — | 2026-10-29 | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side | |
CVE-2026-71569 |
medium | 4.8 | — | 2026-10-29 | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This is | |
CVE-2026-118984 |
high | 7.0 | — | 2026-10-29 | OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that al | |
CVE-2026-33923 |
high | 7.5 | — | 2026-10-29 | A signature verification vulnerability was discovered in the update installation functiona | |
CVE-2026-33924 |
high | 7.5 | — | 2026-10-29 | Two OS command injection vulnerabilities were discovered in the update installation functi | |
CVE-2026-73581 |
— | — | 0.0016 | 2026-10-29 | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL | |
CVE-2026-115942 |
— | — | — | 2026-10-29 | A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does | |
CVE-2026-105192 |
critical | 9.8 | 0.0077 | 2026-10-29 | 1 PoC | LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ R |
CVE-2026-105042 |
— | — | — | 2026-10-29 | A message body that is deeply nested and decoded by pn_message_body() could overflow the s | |
CVE-2026-114230 |
— | — | — | 2026-10-29 | When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP fram | |
CVE-2026-105031 |
— | — | — | 2026-10-29 | When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn | |
CVE-2026-91152 |
medium | 6.1 | — | 2026-10-29 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | |
CVE-2026-91153 |
medium | 5.3 | — | 2026-10-29 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | |
CVE-2026-116763 |
medium | 5.4 | — | 2026-10-29 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-118192 |
medium | 6.5 | — | 2026-10-29 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is | |
CVE-2026-110707 |
medium | 4.7 | — | 2026-10-29 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggr | |
CVE-2026-111318 |
medium | 5.4 | — | 2026-10-29 | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPre | |
CVE-2026-107743 |
high | 7.2 | — | 2026-10-29 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in v | |
CVE-2026-109215 |
medium | 6.4 | — | 2026-10-29 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-107627 |
medium | 5.4 | — | 2026-10-29 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to S | |
CVE-2026-107629 |
medium | 5.4 | — | 2026-10-29 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to S |