Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-124591 |
medium | 5.1 | 0.0022 | 2026-11-09 | A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of t | |
CVE-2026-123779 |
medium | 5.3 | 0.0034 | 2026-11-09 | Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMe | |
CVE-2026-120367 |
high | 7.5 | 0.0063 | 2026-11-09 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. T | |
CVE-2026-113702 |
medium | 5.3 | 0.0024 | 2026-11-09 | A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by | |
CVE-2026-124590 |
medium | 5.5 | 0.0029 | 2026-11-09 | A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96b | |
CVE-2026-118196 |
critical | 9.1 | 0.0041 | 2026-11-09 | OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: thr | |
CVE-2026-120832 |
medium | 6.5 | 0.0028 | 2026-11-09 | Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a | |
CVE-2026-120761 |
critical | 9.1 | 0.0043 | 2026-11-09 | Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. | |
CVE-2026-123770 |
high | 7.5 | 0.0055 | 2026-11-09 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. T | |
CVE-2026-123766 |
medium | 6.1 | 0.0027 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnera | |
CVE-2026-123753 |
critical | 9.1 | 0.0049 | 2026-11-09 | 1 PoC | Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated |
CVE-2026-115252 |
critical | 10.0 | 0.0042 | 2026-11-09 | The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any c | |
CVE-2026-106466 |
high | 7.5 | 0.0030 | 2026-11-09 | The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh | |
CVE-2026-106008 |
medium | 5.3 | 0.0031 | 2026-11-09 | The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform | |
CVE-2026-82440 |
high | 8.1 | 0.0045 | 2026-11-09 | Description Nimbus instantiates the class named by a topology's `topology.scheduler.strat | |
CVE-2026-82436 |
high | 8.8 | 0.0057 | 2026-11-09 | Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoin | |
CVE-2026-66675 |
medium | 6.5 | 0.0017 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-54863 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-40913 |
high | 8.2 | 0.0041 | 2026-11-09 | Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any | |
CVE-2026-124589 |
low | 2.1 | 0.0035 | 2026-11-09 | A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb86 | |
CVE-2026-123484 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-123465 |
high | 7.5 | 0.0034 | 2026-11-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability i | |
CVE-2026-123463 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-121780 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-121764 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-121763 |
medium | 6.5 | 0.0017 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-121760 |
high | 7.5 | 0.0032 | 2026-11-09 | Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly | |
CVE-2026-119514 |
medium | 6.3 | 0.0022 | 2026-11-09 | Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repa | |
CVE-2026-119505 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119504 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119503 |
medium | 6.5 | 0.0027 | 2026-11-09 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-119497 |
medium | 6.5 | 0.0017 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119483 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-111403 |
high | 7.1 | 0.0019 | 2026-11-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2024-2323 |
medium | 4.8 | 0.0023 | 2026-11-09 | The RemoteUserStoreManagerService does not sufficiently validate password change attempts | |
CVE-2024-58398 |
medium | 5.3 | 0.0027 | 2026-11-09 | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open | |
CVE-2024-58392 |
medium | 4.8 | 0.0017 | 2026-11-09 | PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codep | |
CVE-2024-58391 |
medium | 5.3 | 0.0026 | 2026-11-09 | Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability | |
CVE-2024-8122 |
medium | 5.9 | 0.0025 | 2026-11-09 | The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords | |
CVE-2024-58387 |
high | 8.7 | 0.0055 | 2026-11-09 | Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_re | |
CVE-2024-58386 |
high | 7.1 | 0.0037 | 2026-11-09 | ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the fil | |
CVE-2024-42002 |
high | 8.6 | 0.0016 | 2026-11-09 | A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) | |
CVE-2024-7953 |
high | 8.7 | 0.0035 | 2026-11-09 | A vulnerability exists in the affected products that allows a threat actor to create a pro | |
CVE-2024-9168 |
— | — | — | 2026-11-09 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was | |
CVE-2024-43028 |
critical | 9.8 | 0.0159 | 2026-11-09 | A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to | |
CVE-2024-40489 |
critical | 9.8 | 0.0054 | 2026-11-09 | There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax chara | |
CVE-2024-34157 |
— | — | — | 2026-11-09 | Rejected reason: reserved but not needed | |
CVE-2024-34154 |
— | — | — | 2026-11-09 | Rejected reason: reserved but not needed | |
CVE-2024-53252 |
— | — | — | 2026-11-09 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. | |
CVE-2024-53251 |
— | — | — | 2026-11-09 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. |