Browse All CVEs
10,478 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54430 |
medium | 5.1 | 0.0017 | 2026-10-29 | liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve | |
CVE-2026-54431 |
medium | 5.1 | 0.0018 | 2026-10-29 | In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose J | |
CVE-2026-27433 |
medium | 6.5 | 0.0033 | 2026-10-29 | Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Inco | |
CVE-2026-49779 |
medium | 6.5 | 0.0044 | 2026-10-29 | Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path | |
CVE-2026-57342 |
medium | 6.5 | 0.0022 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions. | |
CVE-2026-57347 |
medium | 6.5 | 0.0037 | 2026-10-29 | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. | |
CVE-2026-57352 |
medium | 4.8 | 0.0026 | 2026-10-29 | Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress | |
CVE-2026-57353 |
medium | 6.5 | 0.0030 | 2026-10-29 | Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. | |
CVE-2026-57354 |
medium | 6.5 | 0.0022 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions. | |
CVE-2026-57355 |
medium | 6.5 | 0.0030 | 2026-10-29 | Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions. | |
CVE-2026-57669 |
medium | 6.5 | 0.0034 | 2026-10-29 | Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions. | |
CVE-2026-57680 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions. | |
CVE-2026-57681 |
medium | 6.4 | 0.0023 | 2026-10-29 | Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions. | |
CVE-2026-57684 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions. | |
CVE-2026-57685 |
medium | 4.3 | 0.0025 | 2026-10-29 | Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= | |
CVE-2026-57689 |
medium | 4.3 | 0.0027 | 2026-10-29 | Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions. | |
CVE-2026-57690 |
medium | 4.3 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions. | |
CVE-2026-57730 |
medium | 4.3 | 0.0027 | 2026-10-29 | Subscriber Broken Access Control in Flatsome <= 3.20.5 versions. | |
CVE-2026-57731 |
medium | 6.5 | 0.0034 | 2026-10-29 | Contributor Broken Access Control in Flatsome <= 3.20.5 versions. | |
CVE-2026-57747 |
medium | 6.5 | 0.0017 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions. | |
CVE-2026-57750 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions. | |
CVE-2026-57753 |
medium | 5.3 | 0.0033 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2. | |
CVE-2026-57754 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery Page Builder <= 3.9 | |
CVE-2026-57755 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Mosaic Gallery – Advanced Gallery <= 1.2.0 | |
CVE-2026-57760 |
medium | 5.3 | 0.0029 | 2026-10-29 | Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Inco | |
CVE-2026-57762 |
medium | 5.9 | 0.0024 | 2026-10-29 | Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions. | |
CVE-2026-57763 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions. | |
CVE-2026-57764 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 v | |
CVE-2026-4770 |
medium | 4.6 | 0.0023 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-4772 |
medium | 5.4 | 0.0023 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-12166 |
medium | 5.5 | 0.0015 | 2026-10-29 | A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFA | |
CVE-2026-50282 |
medium | 4.9 | 0.0035 | 2026-10-29 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9 | |
CVE-2026-54886 |
medium | 5.3 | 0.0033 | 2026-10-29 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ss | |
CVE-2026-54887 |
medium | 6.3 | 0.0024 | 2026-10-29 | Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows pred | |
CVE-2026-54891 |
medium | 6.3 | 0.0014 | 2026-10-29 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel v | |
CVE-2026-58579 |
medium | 5.1 | 0.0030 | 2026-10-29 | RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the a | |
CVE-2026-59097 |
medium | 6.9 | 0.0043 | 2026-10-29 | Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthentic | |
CVE-2026-59101 |
medium | 6.9 | 0.0050 | 2026-10-29 | AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that | |
CVE-2026-52188 |
medium | 6.5 | 0.0035 | 2026-10-29 | Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote a | |
CVE-2026-50721 |
medium | 5.9 | 0.0039 | 2026-10-29 | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly v | |
CVE-2026-50722 |
medium | 5.9 | 0.0035 | 2026-10-29 | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not corre | |
CVE-2026-26145 |
medium | 4.8 | 0.0070 | 2026-10-29 | Improper access control in Azure Synapse allows an authorized attacker to elevate privileg | |
CVE-2026-13371 |
medium | 6.9 | 0.0059 | 2026-10-29 | An authenticated administrator can trigger a denial-of-service condition in the Fireware M | |
CVE-2026-13373 |
medium | 4.8 | 0.0027 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting' | |
CVE-2026-13374 |
medium | 4.8 | 0.0027 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting' | |
CVE-2026-13375 |
medium | 4.8 | 0.0027 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting' | |
CVE-2026-13376 |
medium | 4.8 | 0.0027 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting' | |
CVE-2026-13377 |
medium | 4.8 | 0.0027 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting' | |
CVE-2026-13728 |
medium | 5.9 | 0.0023 | 2026-10-29 | In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded e | |
CVE-2026-12960 |
medium | 6.0 | 0.0016 | 2026-10-29 | An Improper Export of Android Application Components vulnerability in ASUS Router App allo |