Browse All CVEs
9,933 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-113409 |
medium | 4.8 | 0.0020 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin s | |
CVE-2026-114173 |
medium | 5.3 | 0.0029 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data i | |
CVE-2026-16889 |
medium | 4.8 | 0.0032 | 2026-10-29 | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/prelogi | |
CVE-2026-66089 |
medium | 6.1 | 0.0027 | 2026-10-29 | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation w | |
CVE-2026-66091 |
medium | 6.9 | 0.0040 | 2026-10-29 | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no a | |
CVE-2026-66092 |
medium | 4.8 | 0.0033 | 2026-10-29 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the l | |
CVE-2026-77490 |
medium | 6.1 | 0.0041 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-70091 |
medium | 5.9 | 0.0066 | 2026-10-29 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2026-66308 |
medium | 6.5 | 0.0114 | 2026-10-29 | Out-of-bounds read in Skype for Business allows an authorized attacker to deny service ove | |
CVE-2026-66306 |
medium | 6.5 | 0.0092 | 2026-10-29 | Generation of error message containing sensitive information in Skype for Business allows | |
CVE-2026-55946 |
medium | 6.1 | 0.0039 | 2026-10-29 | Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose info | |
CVE-2026-68781 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove | |
CVE-2026-67633 |
medium | 6.5 | 0.0114 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a netw | |
CVE-2026-67630 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove | |
CVE-2026-67629 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove | |
CVE-2019-25712 |
medium | 6.9 | 0.0020 | 2026-10-29 | BlueAuditor 1.7.2.0 contains a buffer overflow vulnerability in the registration key field | |
CVE-2015-20119 |
medium | 5.1 | 0.0021 | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerabilit | |
CVE-2015-20117 |
medium | 6.9 | 0.0020 | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability | |
CVE-2015-20118 |
medium | 5.1 | 0.0033 | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerabilit | |
CVE-2015-20115 |
medium | 5.1 | 0.0027 | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing a | |
CVE-2015-20116 |
medium | 5.1 | 0.0024 | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowi | |
CVE-2015-20114 |
medium | 5.1 | 0.0029 | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains a cross-site scripting vulnerability that | |
CVE-2015-20113 |
medium | 6.9 | 0.0019 | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains cross-site request forgery and persistent | |
CVE-2026-111135 |
medium | 6.9 | 0.0020 | 2026-10-29 | libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_v | |
CVE-2026-110598 |
medium | 6.9 | 0.0017 | 2026-10-29 | Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_mu | |
CVE-2026-109425 |
medium | 6.9 | 0.0019 | 2026-10-29 | Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability whe | |
CVE-2026-109438 |
medium | 6.3 | 0.0036 | 2026-10-29 | 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack | |
CVE-2026-108706 |
medium | 5.3 | 0.0019 | 2026-10-29 | eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downl | |
CVE-2026-104083 |
medium | 5.3 | 0.0033 | 2026-10-29 | SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerabilit | |
CVE-2026-104079 |
medium | 5.3 | 0.0019 | 2026-10-29 | Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its ga | |
CVE-2026-104073 |
medium | 6.9 | 0.0037 | 2026-10-29 | NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability | |
CVE-2026-104074 |
medium | 6.9 | 0.0031 | 2026-10-29 | Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote | |
CVE-2023-54328 |
medium | 5.1 | 0.0047 | 2026-10-29 | AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its regi | |
CVE-2020-37202 |
medium | 4.6 | 0.0038 | 2026-10-29 | NetworkSleuth 3.0.0.0 contains a denial of service vulnerability that allows attackers to | |
CVE-2020-37200 |
medium | 4.6 | 0.0040 | 2026-10-29 | NetShareWatcher 1.5.8.0 contains a buffer overflow vulnerability in the registration key i | |
CVE-2020-37201 |
medium | 4.6 | 0.0040 | 2026-10-29 | NetShareWatcher 1.5.8.0 contains a buffer overflow vulnerability in the registration name | |
CVE-2026-88892 |
medium | 5.3 | 0.0033 | 2026-10-29 | In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fet | |
CVE-2026-85615 |
medium | 5.3 | 0.0024 | 2026-10-29 | Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the r | |
CVE-2026-85611 |
medium | 5.3 | 0.0024 | 2026-10-29 | OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerabi | |
CVE-2026-85609 |
medium | 6.9 | 0.0050 | 2026-10-29 | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery ( | |
CVE-2026-68765 |
medium | 5.2 | 0.0018 | 2026-10-29 | hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in | |
CVE-2026-63169 |
medium | 5.3 | 0.0029 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerabilit | |
CVE-2026-63171 |
medium | 5.1 | 0.0022 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerabilit | |
CVE-2026-63168 |
medium | 5.1 | 0.0028 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerabilit | |
CVE-2026-63157 |
medium | 5.1 | 0.0022 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerabilit | |
CVE-2026-63156 |
medium | 5.1 | 0.0030 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerabi | |
CVE-2026-63147 |
medium | 5.1 | 0.0021 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerabilit | |
CVE-2026-63148 |
medium | 5.1 | 0.0018 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerabilit | |
CVE-2026-56101 |
medium | 6.0 | 0.0060 | 2026-10-29 | OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee802 | |
CVE-2026-112328 |
medium | 5.3 | 0.0016 | 2026-10-29 | The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerabili |