Browse All CVEs
3,373 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-61997 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | |
CVE-2026-61998 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | |
CVE-2026-61991 |
critical | 10.0 | — | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | |
CVE-2026-61992 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | |
CVE-2026-54859 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | |
CVE-2026-54860 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |
CVE-2026-54857 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | |
CVE-2026-54858 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | |
CVE-2026-54856 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | |
CVE-2026-107328 |
critical | 9.9 | — | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execu |
CVE-2026-107329 |
critical | 9.9 | — | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execu |
CVE-2026-107327 |
critical | 9.9 | — | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execu |
CVE-2026-104339 |
critical | 9.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary c | |
CVE-2026-58016 |
critical | 9.1 | 0.0054 | 2026-10-29 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() | |
CVE-2024-42360 |
critical | 9.8 | 0.0058 | 2026-10-29 | SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface fo | |
CVE-2026-55572 |
critical | 10.0 | 0.0052 | 2026-10-29 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's o | |
CVE-2026-92152 |
critical | 9.3 | 0.0067 | 2026-10-29 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and oth | |
CVE-2026-119050 |
critical | 9.2 | — | 2026-10-29 | Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows | |
CVE-2026-97854 |
critical | 9.3 | — | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command in | |
CVE-2026-115964 |
critical | 9.3 | — | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-105192 |
critical | 9.8 | 0.0077 | 2026-10-29 | 1 PoC | LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ R |
CVE-2026-114358 |
critical | 9.3 | 0.0050 | 2026-10-29 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation | |
CVE-2025-49794 |
critical | 9.1 | 0.0083 | 2026-10-29 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath | |
CVE-2026-32557 |
critical | 9.3 | 0.0037 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-103693 |
critical | 9.0 | 0.0024 | 2026-10-29 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before | |
CVE-2026-113616 |
critical | 9.8 | 0.0015 | 2026-10-29 | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-t | |
CVE-2026-113617 |
critical | 9.9 | 0.0016 | 2026-10-29 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a us | |
CVE-2026-115245 |
critical | 9.8 | 0.0020 | 2026-10-29 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploade | |
CVE-2026-109516 |
critical | 9.8 | 0.0057 | 2026-10-29 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication B | |
CVE-2026-42922 |
critical | 9.8 | 0.0053 | 2026-10-29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version | |
CVE-2026-74040 |
critical | 9.4 | 0.0072 | 2026-10-29 | Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability | |
CVE-2026-86868 |
critical | 9.1 | 0.0020 | 2026-10-29 | An authentication issue was addressed with improved state management. This issue is fixed | |
CVE-2026-66088 |
critical | 9.4 | 0.0069 | 2026-10-29 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting eng | |
CVE-2026-87701 |
critical | 9.6 | 0.0079 | 2026-10-29 | Improper neutralization of special elements in output used by a downstream component ('inj | |
CVE-2026-85885 |
critical | 9.9 | 0.0072 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in M36 | |
CVE-2026-85889 |
critical | 10.0 | 0.0067 | 2026-10-29 | Missing authentication for critical function in Azure AI Foundry allows an unauthorized at | |
CVE-2026-83944 |
critical | 10.0 | 0.0044 | 2026-10-29 | Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate pri | |
CVE-2026-83941 |
critical | 9.9 | 0.0078 | 2026-10-29 | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over | |
CVE-2026-77903 |
critical | 9.0 | 0.0037 | 2026-10-29 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker t | |
CVE-2026-70200 |
critical | 10.0 | 0.0060 | 2026-10-29 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Lo | |
CVE-2026-70009 |
critical | 9.3 | 0.0053 | 2026-10-29 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Ar | |
CVE-2026-69865 |
critical | 10.0 | 0.0080 | 2026-10-29 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an | |
CVE-2026-69399 |
critical | 10.0 | 0.0048 | 2026-10-29 | Azure Arc Elevation of Privilege Vulnerability | |
CVE-2026-66302 |
critical | 9.8 | 0.0097 | 2026-10-29 | External control of file name or path in Skype for Business allows an unauthorized attacke | |
CVE-2026-62916 |
critical | 9.1 | 0.0086 | 2026-10-29 | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an u | |
CVE-2026-67631 |
critical | 9.8 | 0.0097 | 2026-10-29 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code o | |
CVE-2018-25254 |
critical | 9.3 | 0.0091 | 2026-10-29 | NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability th | |
CVE-2026-109391 |
critical | 9.2 | 0.0048 | 2026-10-29 | Square Squash through commit e73f280 contains an insecure deserialization vulnerability th | |
CVE-2026-105223 |
critical | 9.1 | 0.0020 | 2026-10-29 | maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in par | |
CVE-2026-105216 |
critical | 9.1 | 0.0019 | 2026-10-29 | go-micro before 6.0.0 contains an improper certificate validation vulnerability that allow |