Browse All CVEs
39,684 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-57735 |
critical | 9.1 | 0.0067 | 2026-11-03 | When user logged out, the JWT token the user had authtenticated with was not invalidated, | |
CVE-2025-54550 |
high | 8.1 | 0.0058 | 2026-11-03 | The example example_xcom that was included in airflow documentation implemented unsafe pat | |
CVE-2025-54831 |
medium | 6.5 | 0.0097 | 2026-11-03 | Apache Airflow 3 introduced a change to the handling of sensitive information in Connectio | |
CVE-2025-1397 |
medium | 4.8 | 0.0015 | 2026-11-03 | When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the st | |
CVE-2025-5769 |
medium | 6.1 | 0.0017 | 2026-11-03 | The authentication endpoint does not properly encode user-supplied input before rendering | |
CVE-2026-103379 |
medium | 5.3 | 0.0021 | 2026-11-03 | The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, no | |
CVE-2026-104647 |
low | 3.8 | 0.0015 | 2026-11-03 | The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in | |
CVE-2026-104648 |
medium | 4.9 | 0.0023 | 2026-11-03 | The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email | |
CVE-2026-105967 |
medium | 5.8 | 0.0020 | 2026-11-03 | The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-su | |
CVE-2026-105993 |
medium | 5.3 | 0.0019 | 2026-11-03 | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capabil | |
CVE-2026-106004 |
medium | 5.3 | 0.0019 | 2026-11-03 | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on on | |
CVE-2026-115205 |
medium | 6.5 | 0.0018 | 2026-11-03 | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or a | |
CVE-2026-101566 |
high | 7.8 | 0.0011 | 2026-11-03 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite | |
CVE-2026-101676 |
high | 7.8 | 0.0017 | 2026-11-03 | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (comp | |
CVE-2026-77799 |
high | 7.4 | 0.0118 | 2026-11-03 | ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authenti | |
CVE-2026-77800 |
high | 7.7 | 0.0096 | 2026-11-03 | ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication | |
CVE-2025-9566 |
high | 8.1 | 0.0121 | 2026-11-03 | There's a vulnerability in podman where an attacker may use the kube play command to overw | |
CVE-2026-120577 |
high | 8.1 | 0.0061 | 2026-11-03 | The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress | |
CVE-2026-120578 |
medium | 5.3 | 0.0026 | 2026-11-03 | The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in al | |
CVE-2026-120574 |
high | 8.1 | 0.0033 | 2026-11-03 | The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all | |
CVE-2026-120575 |
medium | 6.4 | 0.0021 | 2026-11-03 | The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Store | |
CVE-2026-120561 |
medium | 5.3 | 0.0025 | 2026-11-03 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to una | |
CVE-2026-120563 |
medium | 4.9 | 0.0030 | 2026-11-03 | The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable | |
CVE-2026-120558 |
high | 7.2 | 0.0035 | 2026-11-03 | The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL I | |
CVE-2026-120559 |
high | 7.5 | 0.0067 | 2026-11-03 | The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary | |
CVE-2026-120551 |
medium | 5.3 | 0.0025 | 2026-11-03 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnera | |
CVE-2026-120552 |
medium | 6.4 | 0.0020 | 2026-11-03 | The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPres | |
CVE-2026-120538 |
high | 8.1 | 0.0043 | 2026-11-03 | The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass lea | |
CVE-2026-120544 |
medium | 4.3 | 0.0034 | 2026-11-03 | The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPres | |
CVE-2026-120524 |
medium | 6.4 | 0.0019 | 2026-11-03 | The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site | |
CVE-2026-120534 |
critical | 9.8 | 0.0031 | 2026-11-03 | The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Cod | |
CVE-2026-120518 |
critical | 9.1 | 0.0078 | 2026-11-03 | The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file d | |
CVE-2026-3633 |
low | 3.9 | 0.0024 | 2026-11-03 | A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the | |
CVE-2026-95508 |
high | 7.4 | 0.0057 | 2026-11-03 | A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslir | |
CVE-2026-120971 |
medium | 5.3 | 0.0034 | 2026-11-03 | A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other | |
CVE-2026-111464 |
medium | 5.9 | 0.0042 | 2026-11-03 | The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure | |
CVE-2026-103399 |
medium | 5.3 | 0.0025 | 2026-11-03 | A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Exp | |
CVE-2026-3634 |
medium | 6.5 | 0.0019 | 2026-11-03 | A flaw was found in libsoup. An attacker controlling the value used to set the Content-Typ | |
CVE-2026-6324 |
medium | 4.8 | 0.0087 | 2026-11-03 | A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed convers | |
CVE-2026-107441 |
high | 8.8 | 0.0029 | 2026-11-03 | An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versi | |
CVE-2026-120831 |
medium | 6.5 | 0.0027 | 2026-11-03 | A flaw was found in libslirp in if_output(). When moving a session from the fast queue to | |
CVE-2026-76955 |
high | 8.8 | 0.0025 | 2026-11-03 | A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions | |
CVE-2026-105770 |
medium | 5.3 | 0.0026 | 2026-11-03 | Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to cal | |
CVE-2026-120833 |
high | 8.5 | 0.0014 | 2026-11-03 | labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read( | |
CVE-2026-120830 |
high | 7.4 | 0.0022 | 2026-11-03 | A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response | |
CVE-2026-109832 |
high | 7.5 | 0.0041 | 2026-11-03 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VN | |
CVE-2026-40895 |
medium | 6.9 | 0.0049 | 2026-11-02 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modu | |
CVE-2026-40176 |
high | 7.8 | 0.0104 | 2026-11-02 | 3 PoC | Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9. |
CVE-2023-32558 |
high | 7.5 | 0.0174 | 2026-11-02 | The use of the deprecated API `process.binding()` can bypass the permission model through | |
CVE-2023-29074 |
critical | 9.8 | 0.0112 | 2026-11-02 | A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can |