Browse All CVEs
11,466 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-96666 |
high | 7.2 | — | 2026-10-29 | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scr | |
CVE-2026-96669 |
high | 7.2 | — | 2026-10-29 | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Store | |
CVE-2026-96741 |
high | 7.2 | — | 2026-10-29 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Script | |
CVE-2026-74047 |
high | 7.1 | 0.0032 | 2026-10-29 | Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allow | |
CVE-2026-74043 |
high | 8.5 | 0.0036 | 2026-10-29 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file | |
CVE-2026-74045 |
high | 7.1 | 0.0034 | 2026-10-29 | Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() wh | |
CVE-2026-74037 |
high | 8.6 | 0.0049 | 2026-10-29 | Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero sta | |
CVE-2026-74035 |
high | 8.6 | 0.0050 | 2026-10-29 | Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability whe | |
CVE-2026-74036 |
high | 8.6 | 0.0083 | 2026-10-29 | Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA po | |
CVE-2026-74034 |
high | 8.7 | 0.0043 | 2026-10-29 | Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that al | |
CVE-2026-74033 |
high | 8.4 | 0.0034 | 2026-10-29 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() | |
CVE-2026-74031 |
high | 7.0 | 0.0051 | 2026-10-29 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_ | |
CVE-2026-96202 |
high | 8.8 | 0.0093 | 2026-10-29 | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker | |
CVE-2026-88094 |
high | 8.1 | 0.0082 | 2026-10-29 | Improper neutralization of special elements in output used by a downstream component ('inj | |
CVE-2026-101459 |
high | 8.3 | 0.0039 | 2026-10-29 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server | |
CVE-2026-101583 |
high | 7.0 | 0.0023 | 2026-10-29 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-commo | |
CVE-2026-101593 |
high | 8.3 | 0.0039 | 2026-10-29 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac | |
CVE-2026-91238 |
high | 7.1 | 0.0035 | 2026-10-29 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-113387 |
high | 8.6 | — | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update req | |
CVE-2026-66090 |
high | 7.1 | — | 2026-10-29 | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable exter | |
CVE-2026-62688 |
high | 7.8 | 0.0033 | 2026-10-29 | Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to | |
CVE-2026-61346 |
high | 7.0 | 0.0026 | 2026-10-29 | Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privile | |
CVE-2026-85917 |
high | 7.5 | 0.0097 | 2026-10-29 | Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to | |
CVE-2026-85892 |
high | 7.8 | 0.0020 | 2026-10-29 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2026-85360 |
high | 7.0 | 0.0026 | 2026-10-29 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges local | |
CVE-2026-77482 |
high | 8.8 | 0.0082 | 2026-10-29 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code o | |
CVE-2026-70178 |
high | 8.5 | 0.0063 | 2026-10-29 | Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privile | |
CVE-2026-69857 |
high | 8.5 | 0.0063 | 2026-10-29 | Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized a | |
CVE-2026-69782 |
high | 8.1 | 0.0054 | 2026-10-29 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2026-69522 |
high | 8.8 | 0.0084 | 2026-10-29 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute cod | |
CVE-2026-68791 |
high | 8.6 | 0.0054 | 2026-10-29 | Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to discl | |
CVE-2026-69341 |
high | 7.0 | 0.0026 | 2026-10-29 | Use after free in Windows Image Acquisition allows an authorized attacker to elevate privi | |
CVE-2026-66304 |
high | 7.5 | 0.0097 | 2026-10-29 | Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker t | |
CVE-2026-65818 |
high | 8.5 | 0.0063 | 2026-10-29 | Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elev | |
CVE-2026-62744 |
high | 8.8 | 0.0082 | 2026-10-29 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized at | |
CVE-2026-62895 |
high | 8.8 | 0.0080 | 2026-10-29 | Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized | |
CVE-2026-62694 |
high | 7.0 | 0.0026 | 2026-10-29 | Use after free in Windows Installer allows an authorized attacker to elevate privileges lo | |
CVE-2026-62706 |
high | 8.8 | 0.0082 | 2026-10-29 | Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker t | |
CVE-2026-57098 |
high | 7.5 | 0.0064 | 2026-10-29 | Improper verification of cryptographic signature in Windows RDP Client allows an unauthori | |
CVE-2026-67373 |
high | 8.8 | 0.0091 | 2026-10-29 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code ove | |
CVE-2026-67368 |
high | 8.8 | 0.0102 | 2026-10-29 | Improper link resolution before file access ('link following') in SQL Server allows an aut | |
CVE-2026-67370 |
high | 8.8 | 0.0099 | 2026-10-29 | Improper neutralization of special elements used in an sql command ('sql injection') in SQ | |
CVE-2026-50349 |
high | 7.0 | 0.0020 | 2026-10-29 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2019-25776 |
high | 8.7 | — | 2026-10-29 | Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote | |
CVE-2019-25733 |
high | 8.6 | — | 2026-10-29 | NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerabil | |
CVE-2019-25765 |
high | 8.7 | — | 2026-10-29 | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows | |
CVE-2019-25705 |
high | 8.6 | — | 2026-10-29 | Echo Mirage 3.1 contains a stack buffer overflow vulnerability that allows local attackers | |
CVE-2019-25654 |
high | 8.7 | — | 2026-10-29 | Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows attackers to | |
CVE-2019-25269 |
high | 8.5 | — | 2026-10-29 | Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows se | |
CVE-2019-25276 |
high | 8.5 | — | 2026-10-29 | Studio 5000 Logix Designer 30.01.00 contains an unquoted service path vulnerability in the |