Browse All CVEs
10,708 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-74975 |
medium | 5.4 | 0.0025 | 2026-10-29 | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was f | |
CVE-2026-74980 |
medium | 6.5 | 0.0027 | 2026-10-29 | Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability w | |
CVE-2026-75778 |
medium | 5.5 | 0.0043 | 2026-10-29 | A vulnerability was identified in code-projects Task Management System 1.0. This affects t | |
CVE-2026-17084 |
medium | 6.0 | 0.0073 | 2026-10-29 | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correct | |
CVE-2026-32467 |
medium | 6.0 | 0.0021 | 2026-10-29 | Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 v | |
CVE-2026-50139 |
medium | 5.9 | 0.0026 | 2026-10-29 | goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads th | |
CVE-2026-59949 |
medium | 6.5 | 0.0047 | 2026-10-29 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash impl | |
CVE-2026-66634 |
medium | 4.3 | 0.0027 | 2026-10-29 | Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions. | |
CVE-2026-66637 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions. | |
CVE-2026-66638 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions | |
CVE-2026-66639 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg | |
CVE-2026-66640 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions. | |
CVE-2026-66641 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions. | |
CVE-2026-66643 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions. | |
CVE-2026-66644 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions. | |
CVE-2026-66645 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions. | |
CVE-2026-66646 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions. | |
CVE-2026-66679 |
medium | 6.5 | 0.0035 | 2026-10-29 | Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions. | |
CVE-2026-68565 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions. | |
CVE-2026-68568 |
medium | 6.3 | 0.0026 | 2026-10-29 | Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions. | |
CVE-2026-70657 |
medium | 4.3 | 0.0033 | 2026-10-29 | Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dk | |
CVE-2026-73348 |
medium | 6.5 | 0.0027 | 2026-10-29 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | |
CVE-2026-73352 |
medium | 6.5 | 0.0027 | 2026-10-29 | Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. | |
CVE-2026-73359 |
medium | 6.5 | 0.0022 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consen | |
CVE-2026-73379 |
medium | 6.5 | 0.0029 | 2026-10-29 | Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. | |
CVE-2026-73383 |
medium | 4.9 | 0.0047 | 2026-10-29 | Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions. | |
CVE-2026-73395 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment | |
CVE-2026-73398 |
medium | 6.5 | 0.0042 | 2026-10-29 | Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 ve | |
CVE-2026-73399 |
medium | 6.5 | 0.0042 | 2026-10-29 | Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions. | |
CVE-2026-73404 |
medium | 6.5 | 0.0034 | 2026-10-29 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions. | |
CVE-2026-73426 |
medium | 4.6 | 0.0032 | 2026-10-29 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1 | |
CVE-2026-73995 |
medium | 5.4 | 0.0036 | 2026-10-29 | Subscriber Broken Authentication in User Registration <= 5.2.6 versions. | |
CVE-2026-74003 |
medium | 4.3 | 0.0025 | 2026-10-29 | Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions. | |
CVE-2026-74004 |
medium | 5.4 | 0.0023 | 2026-10-29 | Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravi | |
CVE-2026-74006 |
medium | 4.3 | 0.0025 | 2026-10-29 | Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions. | |
CVE-2026-74007 |
medium | 5.3 | 0.0033 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Ima | |
CVE-2026-74009 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4. | |
CVE-2026-75872 |
medium | 6.9 | 0.0074 | 2026-10-29 | HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows una | |
CVE-2026-15806 |
medium | 6.0 | 0.0053 | 2026-10-29 | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPass | |
CVE-2026-63328 |
medium | 6.8 | 0.0019 | 2026-10-29 | Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plug | |
CVE-2026-71477 |
medium | 6.7 | 0.0013 | 2026-10-29 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release | |
CVE-2026-72532 |
medium | 5.1 | 0.0026 | 2026-10-29 | Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Jooml | |
CVE-2026-73371 |
medium | 5.1 | 0.0029 | 2026-10-29 | Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4 | |
CVE-2026-75904 |
medium | 4.8 | 0.0019 | 2026-10-29 | libmodplug through 0.8.9.1 contains an out-of-bounds read in pat_smplooped in src/load_pat | |
CVE-2026-50126 |
medium | 4.0 | 0.0018 | 2026-10-29 | Adaguc-server is an open source geographical information system to visualize, combine, com | |
CVE-2026-50576 |
medium | 6.8 | 0.0049 | 2026-10-29 | ePA 3.x Integration implements the authorization workflow and writes Medical Information O | |
CVE-2026-55106 |
medium | 5.3 | 0.0044 | 2026-10-29 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnosti | |
CVE-2026-63335 |
medium | 6.3 | 0.0052 | 2026-10-29 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and | |
CVE-2026-63336 |
medium | 5.1 | 0.0031 | 2026-10-29 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and | |
CVE-2026-71572 |
medium | 4.8 | 0.0024 | 2026-10-29 | Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5. |