Browse All CVEs
13,933 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-15585 |
high | 7.5 | 0.0050 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-74904 |
high | 8.7 | 0.0045 | 2026-10-29 | SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoint | |
CVE-2026-74906 |
high | 8.7 | 0.0038 | 2026-10-29 | SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mo | |
CVE-2026-74907 |
high | 8.2 | 0.0043 | 2026-10-29 | Grav before 2.0.15 contains a path traversal vulnerability in the static asset server with | |
CVE-2026-75829 |
high | 8.6 | 0.0041 | 2026-10-29 | grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() en | |
CVE-2026-75830 |
high | 7.1 | 0.0039 | 2026-10-29 | grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain | |
CVE-2026-75833 |
high | 8.6 | 0.0022 | 2026-10-29 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack | |
CVE-2026-75836 |
high | 8.7 | 0.0047 | 2026-10-29 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) be | |
CVE-2026-75840 |
high | 8.7 | 0.0043 | 2026-10-29 | ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaSc | |
CVE-2026-75842 |
high | 8.3 | 0.0046 | 2026-10-29 | ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCy | |
CVE-2026-75844 |
high | 7.1 | 0.0032 | 2026-10-29 | ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the | |
CVE-2026-75846 |
high | 7.1 | 0.0035 | 2026-10-29 | ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vuln | |
CVE-2026-75853 |
high | 8.7 | 0.0059 | 2026-10-29 | ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26. | |
CVE-2026-75855 |
high | 8.4 | 0.0055 | 2026-10-29 | ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server | |
CVE-2026-74946 |
high | 8.8 | 0.0050 | 2026-10-29 | Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL c | |
CVE-2026-74949 |
high | 8.8 | 0.0047 | 2026-10-29 | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefo | |
CVE-2026-74969 |
high | 8.8 | 0.0048 | 2026-10-29 | Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability | |
CVE-2026-75783 |
high | 8.6 | 0.0060 | 2026-10-29 | A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by t | |
CVE-2026-24301 |
high | 8.8 | 0.0111 | 2026-10-29 | 1 PoC | Improper neutralization of special elements used in a command ('command injection') in Mic |
CVE-2026-28191 |
high | 8.8 | 0.0042 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalat | |
CVE-2026-28567 |
high | 7.5 | 0.0039 | 2026-10-29 | Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. | |
CVE-2026-28568 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions. | |
CVE-2026-28569 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions. | |
CVE-2026-28570 |
high | 8.1 | 0.0047 | 2026-10-29 | Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions. | |
CVE-2026-28571 |
high | 7.5 | 0.0039 | 2026-10-29 | Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. | |
CVE-2026-32333 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions. | |
CVE-2026-32464 |
high | 8.1 | 0.0047 | 2026-10-29 | Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions. | |
CVE-2026-32465 |
high | 8.8 | 0.0052 | 2026-10-29 | Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. | |
CVE-2026-32466 |
high | 8.5 | 0.0036 | 2026-10-29 | Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions. | |
CVE-2026-32468 |
high | 7.5 | 0.0042 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions. | |
CVE-2026-50575 |
high | 7.7 | 0.0022 | 2026-10-29 | BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 impr | |
CVE-2026-18534 |
high | 7.4 | 0.0034 | 2026-10-29 | ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page- | |
CVE-2026-32472 |
high | 7.5 | 0.0039 | 2026-10-29 | Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions. | |
CVE-2026-32473 |
high | 7.2 | 0.0027 | 2026-10-29 | Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1. | |
CVE-2026-32547 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions. | |
CVE-2026-32549 |
high | 7.5 | 0.0039 | 2026-10-29 | Unauthenticated Broken Access Control in ThumbPress < 6.5 versions. | |
CVE-2026-32553 |
high | 7.2 | 0.0027 | 2026-10-29 | Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions. | |
CVE-2026-45733 |
high | 8.3 | 0.0043 | 2026-10-29 | Trilium Notes is a cross-platform, hierarchical note taking application focused on buildin | |
CVE-2026-48798 |
high | 7.1 | 0.0042 | 2026-10-29 | SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Downl | |
CVE-2026-50138 |
high | 8.1 | 0.0038 | 2026-10-29 | goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launche | |
CVE-2026-56684 |
high | 7.5 | 0.0052 | 2026-10-29 | Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1 | |
CVE-2026-61407 |
high | 8.8 | 0.0015 | 2026-10-29 | Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insuffi | |
CVE-2026-63639 |
high | 8.8 | 0.0089 | 2026-10-29 | Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1 | |
CVE-2026-66046 |
high | 8.7 | 0.0074 | 2026-10-29 | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorit | |
CVE-2026-66620 |
high | 7.2 | 0.0054 | 2026-10-29 | Editor PHP Object Injection in OptionTree <= 2.7.3 versions. | |
CVE-2026-66622 |
high | 7.5 | 0.0032 | 2026-10-29 | Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions. | |
CVE-2026-66629 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions. | |
CVE-2026-66633 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versio | |
CVE-2026-66667 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions. | |
CVE-2026-68567 |
high | 7.1 | 0.0025 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne |