Browse All CVEs
9,222 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-107445 |
medium | 5.4 | 0.0017 | 2026-10-29 | A flaw was found in Katello where the Flatpak Remote Repositories API does not properly en | |
CVE-2026-102682 |
medium | 5.6 | 0.0023 | 2026-10-29 | Pipecat is an open-source Python framework for building real-time voice and multimodal con | |
CVE-2026-104109 |
medium | 6.8 | 0.0032 | 2026-10-29 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batc | |
CVE-2026-113697 |
medium | 4.8 | — | 2026-10-29 | Reflected cross-site scripting in the agent query feature of BMC Helix Operations Manageme | |
CVE-2026-113696 |
medium | 5.3 | — | 2026-10-29 | Improper authorization in the SmartIT change approval feature of BMC IT Service Management | |
CVE-2026-39782 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting I | |
CVE-2026-48202 |
medium | 5.3 | — | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-116857 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-25467 |
medium | 5.3 | — | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-93009 |
medium | 4.3 | — | 2026-10-29 | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the | |
CVE-2026-93010 |
medium | 4.3 | — | 2026-10-29 | A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed sourc | |
CVE-2026-48195 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-54862 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119054 |
medium | 5.1 | — | 2026-10-29 | Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting | |
CVE-2026-42707 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim- | |
CVE-2026-119053 |
medium | 6.9 | — | 2026-10-29 | lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerab | |
CVE-2026-113694 |
medium | 5.3 | — | 2026-10-29 | Improper authorization in the SmartIT user attachment feature of BMC IT Service Management | |
CVE-2026-113695 |
medium | 4.8 | — | 2026-10-29 | Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Se | |
CVE-2026-113692 |
medium | 6.9 | — | 2026-10-29 | Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite v | |
CVE-2026-113693 |
medium | 5.3 | — | 2026-10-29 | Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service | |
CVE-2026-113691 |
medium | 5.1 | — | 2026-10-29 | Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Man | |
CVE-2026-113688 |
medium | 5.3 | — | 2026-10-29 | Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service | |
CVE-2026-113689 |
medium | 5.1 | — | 2026-10-29 | Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management | |
CVE-2026-113690 |
medium | 4.8 | — | 2026-10-29 | Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management | |
CVE-2026-118087 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-118093 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerc | |
CVE-2026-118094 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-22386 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting | |
CVE-2026-24533 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-39735 |
medium | 6.5 | — | 2026-10-29 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting I | |
CVE-2026-39741 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflar | |
CVE-2026-42703 |
medium | 6.5 | — | 2026-10-29 | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting I | |
CVE-2026-48196 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-52709 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-56056 |
medium | 6.5 | — | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-93008 |
medium | 6.8 | — | 2026-10-29 | A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can ca | |
CVE-2026-93007 |
medium | 5.3 | — | 2026-10-29 | A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processe | |
CVE-2026-93011 |
medium | 5.3 | — | 2026-10-29 | A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the D | |
CVE-2026-93006 |
medium | 6.8 | — | 2026-10-29 | A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a r | |
CVE-2026-43840 |
medium | 6.9 | 0.0034 | 2026-10-29 | A NULL pointer dereference vulnerability in the license manager service could allow an una | |
CVE-2026-107686 |
medium | 4.3 | 0.0024 | 2026-10-29 | The Gitea web handlers for adding and removing reactions on issues and comments did not re | |
CVE-2026-101987 |
medium | 6.5 | 0.0027 | 2026-10-29 | An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon | |
CVE-2026-5702 |
medium | 4.8 | — | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an att | |
CVE-2026-5699 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an att | |
CVE-2026-5700 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an att | |
CVE-2026-5697 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an att | |
CVE-2026-5698 |
medium | 4.8 | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an att | |
CVE-2026-27401 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce y | |
CVE-2026-92086 |
medium | 5.3 | — | 2026-10-29 | The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all | |
CVE-2026-109216 |
medium | 4.9 | — | 2026-10-29 | The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stor |