Browse All CVEs
37,080 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-39738 |
critical | 9.8 | 0.0041 | 2026-10-30 | Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing | |
CVE-2026-28160 |
high | 7.1 | 0.0023 | 2026-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-39732 |
critical | 9.3 | 0.0032 | 2026-10-30 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | |
CVE-2026-119729 |
medium | 6.5 | 0.0040 | 2026-10-30 | A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variabl | |
CVE-2026-27061 |
medium | 6.5 | 0.0024 | 2026-10-30 | Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | |
CVE-2026-119526 |
critical | 9.8 | 0.0041 | 2026-10-30 | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Inje | |
CVE-2026-119728 |
medium | 6.5 | 0.0033 | 2026-10-30 | A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially | |
CVE-2026-118086 |
high | 8.8 | 0.0036 | 2026-10-30 | Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. | |
CVE-2026-116852 |
critical | 9.1 | 0.0060 | 2026-10-30 | Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. | |
CVE-2026-116401 |
high | 7.5 | 0.0032 | 2026-10-30 | Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. | |
CVE-2026-107868 |
medium | 5.3 | 0.0030 | 2026-10-30 | Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 version | |
CVE-2026-105077 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. | |
CVE-2026-101363 |
medium | 5.3 | 0.0030 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that | |
CVE-2026-101364 |
medium | 5.4 | 0.0019 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versi | |
CVE-2026-101361 |
medium | 4.2 | 0.0018 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-101362 |
medium | 6.9 | 0.0022 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-66026 |
— | — | — | 2026-10-30 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | |
CVE-2026-101360 |
medium | 5.4 | 0.0022 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-61845 |
high | 8.9 | 0.0039 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-66025 |
— | — | — | 2026-10-30 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | |
CVE-2026-61848 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-61846 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-61847 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-18477 |
medium | 4.4 | 0.0008 | 2026-10-30 | A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' re | |
CVE-2026-118089 |
high | 7.2 | 0.0039 | 2026-10-30 | Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | |
CVE-2026-118090 |
high | 8.8 | 0.0045 | 2026-10-30 | Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | |
CVE-2026-116861 |
high | 7.5 | 0.0034 | 2026-10-30 | Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. | |
CVE-2026-116862 |
high | 7.5 | 0.0032 | 2026-10-30 | Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. | |
CVE-2026-116853 |
medium | 6.5 | 0.0021 | 2026-10-30 | Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | |
CVE-2026-116854 |
medium | 6.5 | 0.0020 | 2026-10-30 | Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. | |
CVE-2026-116847 |
high | 7.1 | 0.0019 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. | |
CVE-2026-116851 |
high | 7.1 | 0.0019 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. | |
CVE-2026-116405 |
high | 7.1 | 0.0019 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. | |
CVE-2026-116410 |
medium | 6.5 | 0.0021 | 2026-10-30 | Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. | |
CVE-2026-116386 |
critical | 9.8 | 0.0035 | 2026-10-30 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. | |
CVE-2026-115604 |
medium | 5.0 | 0.0043 | 2026-10-30 | Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. | |
CVE-2026-115947 |
medium | 6.5 | 0.0022 | 2026-10-30 | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | |
CVE-2026-114711 |
medium | 6.5 | 0.0024 | 2026-10-30 | Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. | |
CVE-2026-59978 |
high | 7.5 | 0.0065 | 2026-10-30 | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5. | |
CVE-2012-5605 |
low | 3.3 | 0.0032 | 2026-10-30 | A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows | |
CVE-2026-120007 |
medium | 6.9 | 0.0034 | 2026-10-30 | NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows un | |
CVE-2026-120046 |
medium | 6.0 | 0.0030 | 2026-10-30 | Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSenti | |
CVE-2026-119727 |
medium | 6.5 | 0.0025 | 2026-10-30 | A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a special | |
CVE-2026-119842 |
medium | 6.5 | 0.0033 | 2026-10-30 | A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing | |
CVE-2026-48382 |
critical | 10.0 | 0.0097 | 2026-10-30 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that coul | |
CVE-2026-101986 |
critical | 9.3 | 0.0055 | 2026-10-30 | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos | |
CVE-2026-101990 |
critical | 9.3 | 0.0057 | 2026-10-30 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Junipe | |
CVE-2025-13204 |
critical | 9.8 | 0.0085 | 2026-10-30 | npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to e | |
CVE-2025-0750 |
medium | 6.6 | 0.0027 | 2026-10-30 | A vulnerability was found in CRI-O. A path traversal issue in the log management functions | |
CVE-2024-9341 |
medium | 5.4 | 0.0103 | 2026-10-30 | A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may inco |