Browse All CVEs
50,472 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-123280 |
critical | 9.8 | 0.0039 | 2026-11-06 | In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via publish | |
CVE-2026-123279 |
high | 8.8 | 0.0031 | 2026-11-06 | In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computatio | |
CVE-2026-123278 |
medium | 6.7 | 0.0013 | 2026-11-06 | In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticat | |
CVE-2026-123277 |
medium | 5.0 | 0.0012 | 2026-11-06 | In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users t | |
CVE-2026-123276 |
high | 7.8 | 0.0019 | 2026-11-06 | In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via | |
CVE-2026-115701 |
high | 8.2 | 0.0054 | 2026-11-06 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy all | |
CVE-2026-113431 |
high | 8.7 | 0.0042 | 2026-11-06 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib all | |
CVE-2026-33379 |
high | 8.5 | 0.0021 | 2026-11-06 | A user with any role, including Viewer or a service account with no permissions, can creat | |
CVE-2026-120423 |
medium | 5.9 | 0.0013 | 2026-11-06 | undici is an HTTP client for Node.js. In versions 7.15.0 through 7.30.1 and 8.0.0 through | |
CVE-2026-120415 |
medium | 5.9 | 0.0030 | 2026-11-06 | undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8 | |
CVE-2026-120222 |
medium | 5.9 | 0.0031 | 2026-11-06 | undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8 | |
CVE-2026-116592 |
high | 7.4 | 0.0016 | 2026-11-06 | undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when a | |
CVE-2026-123087 |
high | 8.7 | 0.0025 | 2026-11-06 | SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field f | |
CVE-2026-97642 |
medium | 6.4 | 0.0030 | 2026-11-06 | The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | |
CVE-2026-87964 |
high | 7.2 | 0.0095 | 2026-11-06 | The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social C | |
CVE-2026-120659 |
medium | 5.3 | 0.0042 | 2026-11-06 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization byp | |
CVE-2026-120550 |
medium | 6.4 | 0.0034 | 2026-11-06 | The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directo | |
CVE-2026-115831 |
medium | 4.3 | 0.0033 | 2026-11-06 | The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versi | |
CVE-2026-110776 |
high | 7.2 | 0.0036 | 2026-11-06 | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cr | |
CVE-2026-109994 |
medium | 6.5 | 0.0034 | 2026-11-06 | The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for Wor | |
CVE-2026-109977 |
medium | 4.9 | 0.0040 | 2026-11-06 | The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vul | |
CVE-2026-120474 |
medium | 6.5 | 0.0029 | 2026-11-06 | undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8 | |
CVE-2026-19876 |
medium | 6.1 | 0.0019 | 2026-11-06 | A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINI | |
CVE-2026-103682 |
low | 2.0 | 0.0010 | 2026-11-06 | Invocation of the Jolokia special agent with the login password in the command line in Che | |
CVE-2026-103674 |
low | 2.0 | 0.0010 | 2026-11-06 | Invocation of the NetApp ONTAP special agent with the login password in the command line i | |
CVE-2026-19877 |
high | 7.5 | 0.0029 | 2026-11-06 | INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-ent | |
CVE-2026-122222 |
medium | 6.4 | 0.0019 | 2026-11-06 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripti | |
CVE-2026-121794 |
medium | 6.5 | 0.0028 | 2026-11-06 | The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulne | |
CVE-2026-120671 |
medium | 6.4 | 0.0021 | 2026-11-06 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory pl | |
CVE-2026-118189 |
medium | 6.4 | 0.0021 | 2026-11-06 | The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site | |
CVE-2026-110291 |
high | 7.2 | 0.0025 | 2026-11-06 | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Store | |
CVE-2026-123660 |
medium | 5.3 | 0.0029 | 2026-11-06 | In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make t | |
CVE-2026-108018 |
medium | 6.3 | 0.0016 | 2026-11-06 | The BigFix MCM admin portal is directly accessible from the internet without VPN or networ | |
CVE-2026-39744 |
high | 7.1 | 0.0015 | 2026-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-120844 |
critical | 9.8 | 0.0033 | 2026-11-06 | Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAu | |
CVE-2026-119516 |
critical | 9.8 | 0.0039 | 2026-11-06 | Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking | |
CVE-2026-119499 |
high | 7.5 | 0.0024 | 2026-11-06 | Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia Flor | |
CVE-2026-119488 |
high | 7.1 | 0.0018 | 2026-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119472 |
medium | 6.5 | 0.0016 | 2026-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-88801 |
high | 8.0 | 0.0028 | 2026-11-06 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do n | |
CVE-2026-88800 |
critical | 9.1 | 0.0031 | 2026-11-06 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act | |
CVE-2026-88799 |
high | 8.8 | 0.0029 | 2026-11-06 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do n | |
CVE-2026-121636 |
medium | 5.3 | 0.0011 | 2026-11-06 | The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of P | |
CVE-2026-121633 |
medium | 5.3 | 0.0011 | 2026-11-06 | The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment not | |
CVE-2026-118423 |
critical | 10.0 | 0.0057 | 2026-11-06 | 3 PoC | The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded th |
CVE-2026-118166 |
medium | 4.8 | 0.0018 | 2026-11-06 | The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request | |
CVE-2025-25208 |
medium | 5.7 | 0.0035 | 2026-11-06 | A Developer persona can bring down the Authorino service, preventing the evaluation of all | |
CVE-2025-25207 |
medium | 5.7 | 0.0028 | 2026-11-06 | The Authorino service in the Red Hat Connectivity Link is the authorization service for ze | |
CVE-2026-48864 |
high | 7.8 | 0.0023 | 2026-11-06 | A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of | |
CVE-2026-121822 |
low | 2.4 | 0.0011 | 2026-11-06 | A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attac |