Browse All CVEs
50,460 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-35107 |
medium | 4.7 | 0.0025 | 2026-11-06 | HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web i | |
CVE-2026-21850 |
medium | 6.5 | 0.0022 | 2026-11-06 | HCL AION is affected by a vulnerability where user-controlled input could be included in H | |
CVE-2026-21849 |
low | 3.7 | 0.0009 | 2026-11-06 | HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set | |
CVE-2026-35111 |
medium | 4.8 | 0.0019 | 2026-11-06 | HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) head | |
CVE-2026-35113 |
medium | 4.8 | 0.0019 | 2026-11-06 | HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header | |
CVE-2026-35112 |
medium | 4.2 | 0.0017 | 2026-11-06 | HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) head | |
CVE-2026-92080 |
medium | 4.3 | 0.0028 | 2026-11-06 | 1 PoC | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili |
CVE-2026-35115 |
low | 3.7 | 0.0018 | 2026-11-06 | HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) he | |
CVE-2026-35114 |
low | 3.7 | 0.0023 | 2026-11-06 | HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missin | |
CVE-2026-115952 |
medium | 6.5 | 0.0017 | 2026-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-115431 |
high | 7.1 | 0.0024 | 2026-11-06 | Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce u | |
CVE-2026-123746 |
low | 2.3 | 0.0028 | 2026-11-06 | The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run | |
CVE-2026-105422 |
medium | 6.6 | 0.0018 | 2026-11-06 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-109884 |
high | 7.1 | 0.0023 | 2026-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-109883 |
high | 7.1 | 0.0019 | 2026-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-76171 |
critical | 9.1 | 0.0037 | 2026-11-06 | In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF valida | |
CVE-2026-49939 |
high | 7.5 | 0.0036 | 2026-11-06 | In Apache James server prior version 3.9.1 improper Access Control List processing is expo | |
CVE-2025-66621 |
— | — | 0.0014 | 2026-11-06 | Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD | |
CVE-2026-85108 |
high | 7.5 | 0.0042 | 2026-11-06 | Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior | |
CVE-2026-76168 |
critical | 9.8 | 0.0055 | 2026-11-06 | In Apache James server prior version 3.9.1 relying on the SieveFileRepository incorect val | |
CVE-2026-74756 |
critical | 9.1 | 0.0039 | 2026-11-06 | Some docker-compose shipped by the project exposes by default Webadmin REST API publically | |
CVE-2026-123655 |
high | 7.5 | 0.0062 | 2026-11-06 | A flaw was found in Moodle. Insufficient access control checks on H5P content files allow | |
CVE-2026-85111 |
high | 8.7 | 0.0039 | 2026-11-06 | Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior | |
CVE-2026-92895 |
high | 8.1 | 0.0092 | 2026-11-06 | The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all ver | |
CVE-2026-89101 |
medium | 6.5 | 0.0041 | 2026-11-06 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | |
CVE-2026-120035 |
medium | 5.4 | 0.0028 | 2026-11-06 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggr | |
CVE-2026-119211 |
medium | 4.9 | 0.0023 | 2026-11-06 | The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripti | |
CVE-2026-119178 |
medium | 5.4 | 0.0033 | 2026-11-06 | The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-116624 |
high | 8.8 | 0.0050 | 2026-11-06 | The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in | |
CVE-2026-116551 |
medium | 6.4 | 0.0029 | 2026-11-06 | The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-116545 |
medium | 6.4 | 0.0025 | 2026-11-06 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted V | |
CVE-2026-114630 |
critical | 9.1 | 0.0132 | 2026-11-06 | 1 PoC | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable |
CVE-2026-107658 |
medium | 5.4 | 0.0033 | 2026-11-06 | The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' | |
CVE-2026-107622 |
critical | 9.8 | 0.0074 | 2026-11-06 | The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions | |
CVE-2026-104010 |
high | 7.5 | 0.0058 | 2026-11-06 | The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugi | |
CVE-2026-103908 |
medium | 5.4 | 0.0028 | 2026-11-06 | The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitr | |
CVE-2026-103479 |
high | 7.6 | 0.0037 | 2026-11-06 | The Pubjet | پابجت plugin for WordPress is vulnerable to Privilege Escalation in all vers | |
CVE-2026-77812 |
critical | 9.4 | 0.0012 | 2026-11-06 | 1 PoC | DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluet |
CVE-2026-94257 |
high | 8.1 | 0.0023 | 2026-11-06 | The SMS Alert WordPress plugin before 4.0.3 does not bind the account whose password is be | |
CVE-2026-84164 |
none | — | 0.0027 | 2026-11-06 | The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd di | |
CVE-2025-52970 |
high | 8.1 | 0.0932 | 2026-11-06 | 3 PoC | A improper handling of parameters vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, |
CVE-2026-84161 |
medium | 4.9 | 0.0031 | 2026-11-06 | When an operator enables store.analysis_statistics_dir, a network client with PRODUCT_STOR | |
CVE-2026-66295 |
low | 2.1 | 0.0017 | 2026-11-06 | Saxy's XML encoder writes the target and the content of a processing instruction into the | |
CVE-2026-66294 |
low | 2.1 | 0.0017 | 2026-11-06 | XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characte | |
CVE-2026-66293 |
low | 2.1 | 0.0017 | 2026-11-06 | XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in | |
CVE-2026-116630 |
medium | 5.9 | 0.0015 | 2026-11-06 | undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8 | |
CVE-2026-93565 |
high | 7.5 | 0.0086 | 2026-11-06 | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly st | |
CVE-2026-93564 |
high | 7.5 | 0.0106 | 2026-11-06 | A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder | |
CVE-2026-93558 |
high | 7.5 | 0.0122 | 2026-11-06 | A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated att | |
CVE-2026-93491 |
high | 7.5 | 0.0088 | 2026-11-06 | A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploi |