Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-124449 |
high | 7.1 | 0.0027 | 2026-11-08 | OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid an | |
CVE-2026-124448 |
high | 8.6 | 0.0026 | 2026-11-08 | OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD | |
CVE-2026-124447 |
high | 8.6 | 0.0029 | 2026-11-08 | OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteP | |
CVE-2026-124446 |
high | 8.7 | 0.0035 | 2026-11-08 | OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxC | |
CVE-2026-124445 |
critical | 9.3 | 0.0035 | 2026-11-08 | OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ig | |
CVE-2026-124444 |
high | 7.1 | 0.0024 | 2026-11-08 | OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal Onsite | |
CVE-2026-124443 |
medium | 5.3 | 0.0022 | 2026-11-08 | Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control | |
CVE-2026-124442 |
high | 7.1 | 0.0037 | 2026-11-08 | AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows u | |
CVE-2026-124441 |
high | 8.7 | 0.0041 | 2026-11-08 | Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespace | |
CVE-2026-124440 |
critical | 9.4 | 0.0055 | 2026-11-08 | Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the ap | |
CVE-2026-124439 |
high | 8.7 | 0.0045 | 2026-11-08 | Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which post | |
CVE-2026-124438 |
critical | 9.1 | 0.0036 | 2026-11-08 | Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerabil | |
CVE-2026-124437 |
high | 8.7 | 0.0042 | 2026-11-08 | Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted te | |
CVE-2026-124436 |
high | 8.6 | 0.0037 | 2026-11-08 | OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows real | |
CVE-2026-124435 |
medium | 4.6 | 0.0018 | 2026-11-08 | OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows | |
CVE-2026-124434 |
high | 7.1 | 0.0030 | 2026-11-08 | Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named | |
CVE-2026-124433 |
high | 7.0 | 0.0030 | 2026-11-08 | phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows de | |
CVE-2026-124432 |
medium | 6.9 | 0.0032 | 2026-11-08 | phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account | |
CVE-2026-124431 |
medium | 5.3 | 0.0030 | 2026-11-08 | Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that al | |
CVE-2026-124430 |
high | 8.7 | 0.0058 | 2026-11-08 | Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that al | |
CVE-2026-124429 |
high | 8.7 | 0.0030 | 2026-11-08 | Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allo | |
CVE-2026-124428 |
high | 7.1 | 0.0034 | 2026-11-08 | Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allo | |
CVE-2026-124427 |
critical | 9.3 | 0.0037 | 2026-11-08 | Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that all | |
CVE-2026-124426 |
medium | 6.9 | 0.0027 | 2026-11-08 | Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that all | |
CVE-2026-124425 |
low | 2.3 | 0.0021 | 2026-11-08 | Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an i | |
CVE-2026-124424 |
high | 7.1 | 0.0038 | 2026-11-08 | WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php tha | |
CVE-2026-124330 |
low | 1.3 | 0.0031 | 2026-11-08 | A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the funct | |
CVE-2026-124329 |
low | 2.3 | 0.0031 | 2026-11-08 | A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the | |
CVE-2026-124328 |
low | 2.1 | 0.0038 | 2026-11-08 | A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element i | |
CVE-2026-73440 |
low | 2.3 | 0.0027 | 2026-11-08 | On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) co | |
CVE-2026-124326 |
low | 2.1 | 0.0045 | 2026-11-08 | A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOr | |
CVE-2025-68040 |
medium | 6.5 | 0.0026 | 2026-11-08 | Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manag | |
CVE-2024-44006 |
high | 8.8 | 0.0036 | 2026-11-08 | Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurr | |
CVE-2026-97195 |
low | 3.5 | 0.0014 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field | |
CVE-2026-97194 |
low | 2.7 | 0.0019 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission | |
CVE-2026-97193 |
low | 2.7 | 0.0017 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allo | |
CVE-2026-97192 |
low | 2.7 | 0.0017 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group l | |
CVE-2026-96963 |
low | 2.7 | 0.0017 | 2026-11-08 | The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation chec | |
CVE-2026-96961 |
medium | 6.5 | 0.0025 | 2026-11-08 | The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce | |
CVE-2026-85344 |
medium | 4.3 | 0.0015 | 2026-11-08 | The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any au | |
CVE-2026-122085 |
medium | 6.5 | 0.0016 | 2026-11-08 | The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform a | |
CVE-2026-122062 |
medium | 5.3 | 0.0021 | 2026-11-08 | The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress | |
CVE-2026-122060 |
medium | 5.3 | 0.0021 | 2026-11-08 | The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recip | |
CVE-2026-114432 |
critical | 9.8 | 0.0046 | 2026-11-08 | The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension o | |
CVE-2026-110963 |
critical | 9.8 | 0.0028 | 2026-11-08 | The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an | |
CVE-2026-110132 |
medium | 4.9 | 0.0019 | 2026-11-08 | The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a | |
CVE-2026-109925 |
high | 8.6 | 0.0026 | 2026-11-08 | The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a par | |
CVE-2026-106015 |
high | 8.1 | 0.0023 | 2026-11-08 | The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password | |
CVE-2026-105970 |
medium | 5.3 | 0.0024 | 2026-11-08 | The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly v | |
CVE-2026-104639 |
medium | 4.1 | 0.0019 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a |