Browse All CVEs
13,614 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-114730 |
high | 7.2 | 0.0037 | 2026-10-29 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side | |
CVE-2026-109927 |
high | 7.2 | 0.0040 | 2026-10-29 | The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when han | |
CVE-2026-109987 |
high | 7.2 | 0.0024 | 2026-10-29 | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin befo | |
CVE-2026-111958 |
high | 7.5 | 0.0025 | 2026-10-29 | The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the si | |
CVE-2026-97328 |
high | 7.5 | 0.0028 | 2026-10-29 | The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled H | |
CVE-2026-105270 |
high | 8.7 | 0.0053 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dro | |
CVE-2026-114177 |
high | 8.8 | 0.0018 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-element | |
CVE-2026-111830 |
high | 7.1 | 0.0020 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-111851 |
high | 7.6 | 0.0027 | 2026-10-29 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnera | |
CVE-2026-112242 |
high | 8.8 | 0.0033 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder | |
CVE-2026-112312 |
high | 7.5 | 0.0034 | 2026-10-29 | Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Explo | |
CVE-2026-112379 |
high | 7.1 | 0.0019 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-115253 |
high | 7.3 | 0.0013 | 2026-10-29 | An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory a | |
CVE-2026-86696 |
high | 8.2 | 0.0066 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esa | |
CVE-2026-93471 |
high | 8.7 | 0.0066 | 2026-10-29 | Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropb | |
CVE-2026-112085 |
high | 8.2 | 0.0015 | 2026-10-29 | webpack-dev-server is a development server that provides live reloading for webpack projec | |
CVE-2017-20287 |
high | 8.7 | 0.0070 | 2026-10-29 | Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that al | |
CVE-2017-20289 |
high | 7.7 | 0.0093 | 2026-10-29 | Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclu | |
CVE-2018-25438 |
high | 8.7 | 0.0054 | 2026-10-29 | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulne | |
CVE-2018-25439 |
high | 8.7 | 0.0047 | 2026-10-29 | MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.p | |
CVE-2019-25778 |
high | 8.8 | 0.0046 | 2026-10-29 | SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows rem | |
CVE-2019-25779 |
high | 8.7 | 0.0045 | 2026-10-29 | WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthentic | |
CVE-2021-48013 |
high | 8.7 | 0.0074 | 2026-10-29 | Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated at | |
CVE-2021-48015 |
high | 8.7 | 0.0056 | 2026-10-29 | JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that | |
CVE-2021-48017 |
high | 8.7 | 0.0043 | 2026-10-29 | OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated pat | |
CVE-2022-51021 |
high | 8.8 | 0.0046 | 2026-10-29 | NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL inj | |
CVE-2022-51022 |
high | 8.8 | 0.0079 | 2026-10-29 | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path trav | |
CVE-2022-51023 |
high | 8.8 | 0.0026 | 2026-10-29 | PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthent | |
CVE-2022-51024 |
high | 8.7 | 0.0061 | 2026-10-29 | Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenti | |
CVE-2022-51025 |
high | 7.1 | 0.0046 | 2026-10-29 | Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that | |
CVE-2024-58393 |
high | 8.8 | 0.0027 | 2026-10-29 | i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injectio | |
CVE-2024-58396 |
high | 8.7 | 0.0050 | 2026-10-29 | YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that al | |
CVE-2025-71434 |
high | 8.8 | 0.0032 | 2026-10-29 | Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injectio | |
CVE-2026-111079 |
high | 7.4 | 0.0030 | 2026-10-29 | A flaw was found in Goose. When the terminal integration feature is enabled, the applicati | |
CVE-2026-112313 |
high | 7.1 | 0.0019 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-112820 |
high | 8.1 | 0.0044 | 2026-10-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote Fil | |
CVE-2026-112822 |
high | 8.5 | 0.0029 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-114665 |
high | 7.1 | 0.0035 | 2026-10-29 | Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDif | |
CVE-2026-115325 |
high | 8.7 | 0.0036 | 2026-10-29 | Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClie | |
CVE-2026-115328 |
high | 8.7 | 0.0029 | 2026-10-29 | JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/se | |
CVE-2026-115330 |
high | 8.7 | 0.0030 | 2026-10-29 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated org | |
CVE-2026-115331 |
high | 8.7 | 0.0042 | 2026-10-29 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated org | |
CVE-2026-115332 |
high | 8.7 | 0.0045 | 2026-10-29 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated org | |
CVE-2026-115333 |
high | 8.2 | 0.0036 | 2026-10-29 | Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ing | |
CVE-2026-115334 |
high | 7.6 | 0.0024 | 2026-10-29 | Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizat | |
CVE-2026-113582 |
high | 8.7 | 0.0046 | 2026-10-29 | UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache | |
CVE-2026-66279 |
high | 7.2 | 0.0024 | 2026-10-29 | In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid se | |
CVE-2026-85079 |
high | 7.5 | 0.0066 | 2026-10-29 | In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out- | |
CVE-2026-92709 |
high | 8.1 | 0.0037 | 2026-10-29 | Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsys | |
CVE-2026-94502 |
high | 7.5 | 0.0066 | 2026-10-29 | In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an |