Browse All CVEs
9,186 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-115299 |
medium | 5.4 | — | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce | |
CVE-2026-115300 |
medium | 4.3 | — | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF tok | |
CVE-2026-115302 |
medium | 5.3 | — | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to | |
CVE-2026-19610 |
medium | 6.5 | — | 2026-10-29 | A flaw was found in the platform-mbean component of JBoss EAP, which provides management a | |
CVE-2026-78395 |
medium | 5.3 | — | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's o | |
CVE-2026-78396 |
medium | 5.3 | — | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belo | |
CVE-2026-88928 |
medium | 6.5 | — | 2026-10-29 | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographi | |
CVE-2026-93293 |
medium | 6.4 | — | 2026-10-29 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | |
CVE-2026-40063 |
medium | 5.3 | — | 2026-10-29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality o | |
CVE-2026-42949 |
medium | 5.6 | — | 2026-10-29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (v | |
CVE-2026-93347 |
medium | 6.9 | 0.0042 | 2026-10-29 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_fil | |
CVE-2026-93346 |
medium | 6.9 | 0.0033 | 2026-10-29 | Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allo | |
CVE-2026-74032 |
medium | 5.3 | 0.0033 | 2026-10-29 | Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows | |
CVE-2026-118426 |
medium | 5.3 | — | 2026-10-29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any | |
CVE-2026-101365 |
medium | 4.7 | 0.0029 | 2026-10-29 | Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versi | |
CVE-2026-101407 |
medium | 5.5 | 0.0041 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101412 |
medium | 5.8 | 0.0012 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101432 |
medium | 5.3 | 0.0013 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101471 |
medium | 6.1 | 0.0014 | 2026-10-29 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co | |
CVE-2026-101474 |
medium | 5.9 | 0.0031 | 2026-10-29 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac | |
CVE-2026-101502 |
medium | 5.0 | 0.0011 | 2026-10-29 | Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported | |
CVE-2026-101524 |
medium | 5.6 | 0.0019 | 2026-10-29 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-101575 |
medium | 6.5 | 0.0019 | 2026-10-29 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Suppor | |
CVE-2026-101584 |
medium | 6.5 | 0.0027 | 2026-10-29 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webcl | |
CVE-2026-91247 |
medium | 5.9 | 0.0026 | 2026-10-29 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-113409 |
medium | 4.8 | — | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin s | |
CVE-2026-114173 |
medium | 5.3 | — | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data i | |
CVE-2026-16889 |
medium | 4.8 | — | 2026-10-29 | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/prelogi | |
CVE-2026-66089 |
medium | 6.1 | — | 2026-10-29 | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation w | |
CVE-2026-66091 |
medium | 6.9 | — | 2026-10-29 | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no a | |
CVE-2026-66092 |
medium | 4.8 | — | 2026-10-29 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the l | |
CVE-2026-77490 |
medium | 6.1 | 0.0041 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-70091 |
medium | 5.9 | 0.0066 | 2026-10-29 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2026-66308 |
medium | 6.5 | 0.0114 | 2026-10-29 | Out-of-bounds read in Skype for Business allows an authorized attacker to deny service ove | |
CVE-2026-66306 |
medium | 6.5 | 0.0092 | 2026-10-29 | Generation of error message containing sensitive information in Skype for Business allows | |
CVE-2026-55946 |
medium | 6.1 | 0.0039 | 2026-10-29 | Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose info | |
CVE-2026-68781 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove | |
CVE-2026-67633 |
medium | 6.5 | 0.0114 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a netw | |
CVE-2026-67630 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove | |
CVE-2026-67629 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove | |
CVE-2019-25712 |
medium | 6.9 | — | 2026-10-29 | BlueAuditor 1.7.2.0 contains a buffer overflow vulnerability in the registration key field | |
CVE-2015-20119 |
medium | 5.1 | — | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerabilit | |
CVE-2015-20117 |
medium | 6.9 | — | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains a cross-site request forgery vulnerability | |
CVE-2015-20118 |
medium | 5.1 | — | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerabilit | |
CVE-2015-20115 |
medium | 5.1 | — | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing a | |
CVE-2015-20116 |
medium | 5.1 | — | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize CSV file uploads, allowi | |
CVE-2015-20114 |
medium | 5.1 | — | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains a cross-site scripting vulnerability that | |
CVE-2015-20113 |
medium | 6.9 | — | 2026-10-29 | Next Click Ventures RealtyScript 4.0.2 contains cross-site request forgery and persistent | |
CVE-2026-111135 |
medium | 6.9 | 0.0020 | 2026-10-29 | libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_v | |
CVE-2026-110598 |
medium | 6.9 | 0.0017 | 2026-10-29 | Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_mu |