Browse All CVEs
13,369 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-65493 |
high | 7.5 | 0.0040 | 2026-10-29 | Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions. | |
CVE-2026-65494 |
high | 7.1 | 0.0029 | 2026-10-29 | Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. | |
CVE-2026-65495 |
high | 7.5 | 0.0043 | 2026-10-29 | Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. | |
CVE-2026-65497 |
high | 7.2 | 0.0054 | 2026-10-29 | Administrator PHP Object Injection in Complianz <= 7.5.0 versions. | |
CVE-2026-65500 |
high | 7.5 | 0.0039 | 2026-10-29 | Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Educatio | |
CVE-2026-65510 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions. | |
CVE-2026-65511 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Edu | |
CVE-2026-65516 |
high | 7.2 | 0.0027 | 2026-10-29 | Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 v | |
CVE-2026-65526 |
high | 8.5 | 0.0036 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-65532 |
high | 7.6 | 0.0038 | 2026-10-29 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | |
CVE-2026-65539 |
high | 7.1 | 0.0013 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. | |
CVE-2026-65540 |
high | 7.1 | 0.0013 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6 | |
CVE-2026-65607 |
high | 7.1 | 0.0059 | 2026-10-29 | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-ci | |
CVE-2026-65608 |
high | 8.7 | 0.0112 | 2026-10-29 | Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. Fle | |
CVE-2026-65895 |
high | 8.2 | 0.0029 | 2026-10-29 | Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical | |
CVE-2026-65896 |
high | 7.1 | 0.0032 | 2026-10-29 | Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly | |
CVE-2026-65897 |
high | 8.7 | 0.0046 | 2026-10-29 | Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsCon | |
CVE-2026-65908 |
high | 8.6 | 0.0019 | 2026-10-29 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python | |
CVE-2026-14257 |
high | 7.5 | 0.0064 | 2026-10-29 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. Th | |
CVE-2026-65690 |
high | 8.7 | 0.0090 | 2026-10-29 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-43820 |
high | 7.7 | 0.0011 | 2026-10-29 | NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's S | |
CVE-2026-43823 |
high | 7.5 | 0.0043 | 2026-10-29 | When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* i | |
CVE-2026-16584 |
high | 7.3 | 0.0023 | 2026-10-29 | Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1 | |
CVE-2026-65916 |
high | 7.2 | 0.0049 | 2026-10-29 | CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulner | |
CVE-2026-65917 |
high | 8.7 | 0.0051 | 2026-10-29 | CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object refe | |
CVE-2026-44909 |
high | 7.5 | 0.0057 | 2026-10-29 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session l | |
CVE-2026-65695 |
high | 7.6 | 0.0048 | 2026-10-29 | Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its docum | |
CVE-2026-65759 |
high | 8.7 | 0.0043 | 2026-10-29 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store ex | |
CVE-2026-47743 |
high | 8.7 | 0.0038 | 2026-10-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on adm | |
CVE-2026-65702 |
high | 8.8 | 0.0058 | 2026-10-29 | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationS | |
CVE-2026-65918 |
high | 7.1 | 0.0044 | 2026-10-29 | PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds hea | |
CVE-2026-16756 |
high | 8.7 | 0.0075 | 2026-10-29 | Missing connection and header-read timeouts and the absence of a concurrent-connection cap | |
CVE-2026-25800 |
high | 7.5 | 0.0084 | 2026-10-29 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. | |
CVE-2026-47722 |
high | 8.7 | 0.0047 | 2026-10-29 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. | |
CVE-2026-65703 |
high | 8.5 | 0.0033 | 2026-10-29 | FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC | |
CVE-2026-65705 |
high | 7.3 | 0.0019 | 2026-10-29 | FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_f | |
CVE-2026-65706 |
high | 8.5 | 0.0019 | 2026-10-29 | FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_s | |
CVE-2026-16002 |
high | 8.8 | 0.0043 | 2026-10-29 | The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker t | |
CVE-2026-16796 |
high | 8.4 | 0.0073 | 2026-10-29 | Improper neutralization of argument delimiters in the install_packages() method in AWS Bed | |
CVE-2026-21653 |
high | 7.2 | 0.0039 | 2026-10-29 | Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server all | |
CVE-2026-21655 |
high | 8.7 | 0.0049 | 2026-10-29 | Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, John | |
CVE-2026-34496 |
high | 7.1 | 0.0033 | 2026-10-29 | Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This is | |
CVE-2026-47723 |
high | 7.1 | 0.0053 | 2026-10-29 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. | |
CVE-2026-50032 |
high | 8.7 | 0.0046 | 2026-10-29 | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a | |
CVE-2026-50039 |
high | 8.7 | 0.0046 | 2026-10-29 | The affected product is vulnerable to a stack-based buffer overflow, which may allow an at | |
CVE-2026-50103 |
high | 7.1 | 0.0027 | 2026-10-29 | A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a ne | |
CVE-2026-6924 |
high | 8.7 | 0.0044 | 2026-10-29 | A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. | |
CVE-2026-16804 |
high | 8.3 | 0.0030 | 2026-10-29 | Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker | |
CVE-2026-16805 |
high | 8.8 | 0.0041 | 2026-10-29 | Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker | |
CVE-2026-16806 |
high | 8.8 | 0.0052 | 2026-10-29 | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacke |