Browse All CVEs
10,484 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57334 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. | |
CVE-2026-57335 |
medium | 6.5 | 0.0030 | 2026-10-29 | Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions. | |
CVE-2026-57339 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions. | |
CVE-2026-57340 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions. | |
CVE-2026-57341 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes | |
CVE-2026-13437 |
medium | 6.5 | 0.0044 | 2026-10-29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions P | |
CVE-2026-13742 |
medium | 5.9 | 0.0012 | 2026-10-29 | Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an impro | |
CVE-2026-13746 |
medium | 5.4 | 0.0022 | 2026-10-29 | Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 al | |
CVE-2026-13748 |
medium | 6.3 | 0.0019 | 2026-10-29 | Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allow | |
CVE-2026-13750 |
medium | 5.5 | 0.0015 | 2026-10-29 | Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 | |
CVE-2026-9105 |
medium | 6.8 | 0.0112 | 2026-10-29 | An authenticated stack-based buffer overflow vulnerability exists in the web management in | |
CVE-2026-13592 |
medium | 5.5 | 0.0064 | 2026-10-29 | A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6 | |
CVE-2026-56781 |
medium | 6.9 | 0.0040 | 2026-10-29 | Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability | |
CVE-2026-57942 |
medium | 6.9 | 0.0023 | 2026-10-29 | LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerabili | |
CVE-2026-57946 |
medium | 6.3 | 0.0035 | 2026-10-29 | Invidious before version 2.20260626.0 contains a broken access control vulnerability that | |
CVE-2026-57947 |
medium | 6.3 | 0.0033 | 2026-10-29 | Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook | |
CVE-2026-57952 |
medium | 6.0 | 0.0029 | 2026-10-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoin | |
CVE-2026-57953 |
medium | 5.3 | 0.0044 | 2026-10-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenti | |
CVE-2026-57954 |
medium | 5.3 | 0.0021 | 2026-10-29 | Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions | |
CVE-2026-57958 |
medium | 5.1 | 0.0021 | 2026-10-29 | Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows | |
CVE-2026-13593 |
medium | 6.5 | 0.0029 | 2026-10-29 | CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire documen | |
CVE-2026-31016 |
medium | 6.5 | 0.0022 | 2026-10-29 | Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before all | |
CVE-2026-53429 |
medium | 6.9 | 0.0019 | 2026-10-29 | Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mde | |
CVE-2026-54889 |
medium | 5.1 | 0.0039 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandro | |
CVE-2026-50229 |
medium | 6.1 | 0.0409 | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-55955 |
medium | 6.5 | 0.0044 | 2026-10-29 | Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the | |
CVE-2026-55956 |
medium | 6.5 | 0.0069 | 2026-10-29 | Improper Authorization vulnerability in Apache Tomcat leads to security constraints specif | |
CVE-2026-10647 |
medium | 5.3 | 0.0020 | 2026-10-29 | The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the ret | |
CVE-2026-57997 |
medium | 6.3 | 0.0025 | 2026-10-29 | Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permis | |
CVE-2026-10648 |
medium | 5.5 | 0.0015 | 2026-10-29 | mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_b | |
CVE-2026-7656 |
medium | 6.8 | 0.0033 | 2026-10-29 | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ | |
CVE-2026-14160 |
medium | 5.9 | 0.0012 | 2026-10-29 | Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Esc | |
CVE-2026-56809 |
medium | 5.1 | 0.0034 | 2026-10-29 | Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image | |
CVE-2026-45822 |
medium | 6.6 | 0.0051 | 2026-10-29 | decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() functi | |
CVE-2026-6953 |
medium | 5.1 | 0.0044 | 2026-10-29 | HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability all | |
CVE-2026-6954 |
medium | 5.1 | 0.0044 | 2026-10-29 | Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulne | |
CVE-2026-13316 |
medium | 4.4 | 0.0015 | 2026-10-29 | A flaw has been found in foreman when HTTP parameters are modified in http_proxies_control | |
CVE-2026-53692 |
medium | 5.9 | 0.0011 | 2026-10-29 | Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store user passwords. Be | |
CVE-2026-57079 |
medium | 5.3 | 0.0040 | 2026-10-29 | Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory | |
CVE-2026-57082 |
medium | 5.9 | 0.0023 | 2026-10-29 | Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key | |
CVE-2026-4629 |
medium | 6.5 | 0.0049 | 2026-10-29 | A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission ca | |
CVE-2026-8403 |
medium | 6.1 | 0.0025 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-35095 |
medium | 4.8 | 0.0021 | 2026-10-29 | KTM System e-BOK allows the session identifier to be set by the client prior to authentica | |
CVE-2026-35096 |
medium | 5.1 | 0.0022 | 2026-10-29 | KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-chan | |
CVE-2026-35097 |
medium | 6.9 | 0.0042 | 2026-10-29 | KTM System e-BOK enforces a maximum password length of six numeric digits and does not per | |
CVE-2026-35098 |
medium | 6.9 | 0.0056 | 2026-10-29 | KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, al | |
CVE-2026-27881 |
medium | 5.0 | 0.0027 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-27882 |
medium | 4.8 | 0.0023 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-27883 |
medium | 5.0 | 0.0026 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-27955 |
medium | 6.6 | 0.0027 | 2026-10-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d |