Browse All CVEs
14,894 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-86409 |
high | 8.1 | 0.0110 | 2026-10-29 | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to | |
CVE-2026-86410 |
high | 8.1 | 0.0077 | 2026-10-29 | A flaw in the curl command line tool's logic makes it only set SSH host verification optio | |
CVE-2026-86412 |
high | 8.1 | 0.0083 | 2026-10-29 | A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie ja | |
CVE-2012-20002 |
high | 8.7 | 0.0053 | 2026-10-29 | TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vuln | |
CVE-2014-125133 |
high | 8.7 | 0.0112 | 2026-10-29 | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that | |
CVE-2014-125134 |
high | 8.7 | 0.0082 | 2026-10-29 | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allo | |
CVE-2015-20123 |
high | 8.7 | 0.0041 | 2026-10-29 | Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerabilit | |
CVE-2015-20124 |
high | 8.7 | 0.0050 | 2026-10-29 | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulne | |
CVE-2015-20125 |
high | 8.7 | 0.0041 | 2026-10-29 | Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerabilit | |
CVE-2015-20128 |
high | 8.8 | 0.0034 | 2026-10-29 | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthent | |
CVE-2016-20100 |
high | 8.7 | 0.0053 | 2026-10-29 | Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vuln | |
CVE-2016-20103 |
high | 8.7 | 0.0061 | 2026-10-29 | Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allo | |
CVE-2016-20104 |
high | 8.7 | 0.0061 | 2026-10-29 | EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vul | |
CVE-2026-107928 |
high | 8.1 | 0.0070 | 2026-10-29 | When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory pas | |
CVE-2026-107929 |
high | 8.1 | 0.0067 | 2026-10-29 | When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one | |
CVE-2026-111758 |
high | 7.5 | 0.0055 | 2026-10-29 | markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to bef | |
CVE-2026-112407 |
high | 8.8 | 0.0046 | 2026-10-29 | Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-appl | |
CVE-2026-86415 |
high | 7.5 | 0.0042 | 2026-10-29 | libcurl's connection cache match function never considers the automatic client certificate | |
CVE-2026-87862 |
high | 8.1 | 0.0100 | 2026-10-29 | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silen | |
CVE-2026-87863 |
high | 8.1 | 0.0083 | 2026-10-29 | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, | |
CVE-2026-87864 |
high | 8.1 | 0.0083 | 2026-10-29 | Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APP | |
CVE-2026-87865 |
high | 7.4 | 0.0060 | 2026-10-29 | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can | |
CVE-2026-92386 |
high | 8.1 | 0.0083 | 2026-10-29 | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server c | |
CVE-2026-92387 |
high | 8.1 | 0.0104 | 2026-10-29 | By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or S | |
CVE-2026-92389 |
high | 8.1 | 0.0072 | 2026-10-29 | libcurl's TFTP state machine fails to validate state transitions against the requested tra | |
CVE-2026-92390 |
high | 7.5 | 0.0059 | 2026-10-29 | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented ant | |
CVE-2026-92391 |
high | 7.5 | 0.0117 | 2026-10-29 | A deeply nested multipart MIME structure constructed via the public API causes a stack ove | |
CVE-2026-94266 |
high | 7.5 | 0.0056 | 2026-10-29 | libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_UR | |
CVE-2026-101387 |
high | 7.6 | 0.0030 | 2026-10-29 | Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern | |
CVE-2026-101388 |
high | 7.1 | 0.0036 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101390 |
high | 8.1 | 0.0041 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101398 |
high | 7.6 | 0.0033 | 2026-10-29 | Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Intern | |
CVE-2026-101410 |
high | 7.5 | 0.0035 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101411 |
high | 8.1 | 0.0041 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101416 |
high | 7.5 | 0.0031 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101428 |
high | 7.5 | 0.0031 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101429 |
high | 7.0 | 0.0014 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101431 |
high | 8.7 | 0.0033 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101450 |
high | 7.1 | 0.0030 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101481 |
high | 8.8 | 0.0017 | 2026-10-29 | Vulnerability in Oracle Secure Backup (component: Device Management and Support). Support | |
CVE-2026-101482 |
high | 7.8 | 0.0017 | 2026-10-29 | Vulnerability in Oracle Secure Backup (component: Device Management and Support). Support | |
CVE-2026-101508 |
high | 7.5 | 0.0051 | 2026-10-29 | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). | |
CVE-2026-101520 |
high | 7.5 | 0.0051 | 2026-10-29 | Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of O | |
CVE-2026-101557 |
high | 8.8 | 0.0046 | 2026-10-29 | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Inte | |
CVE-2026-101567 |
high | 8.8 | 0.0046 | 2026-10-29 | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: | |
CVE-2026-101572 |
high | 7.5 | 0.0049 | 2026-10-29 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webcl | |
CVE-2026-101635 |
high | 8.8 | 0.0043 | 2026-10-29 | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo | |
CVE-2026-101648 |
high | 8.4 | 0.0032 | 2026-10-29 | Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (compone | |
CVE-2026-101653 |
high | 8.8 | 0.0043 | 2026-10-29 | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo | |
CVE-2026-101654 |
high | 8.8 | 0.0043 | 2026-10-29 | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (compo |