Browse All CVEs
33,189 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-62162 |
high | 8.2 | 0.0037 | 2026-10-30 | Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch | |
CVE-2026-62264 |
high | 7.5 | 0.0045 | 2026-10-30 | PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2 | |
CVE-2026-54854 |
medium | 6.3 | 0.0024 | 2026-10-30 | Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | |
CVE-2026-54855 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | |
CVE-2026-48201 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. | |
CVE-2026-54850 |
medium | 6.5 | 0.0036 | 2026-10-30 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. | |
CVE-2026-39786 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. | |
CVE-2026-46560 |
high | 7.5 | 0.0019 | 2026-10-30 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RA | |
CVE-2026-39734 |
high | 7.5 | 0.0046 | 2026-10-30 | Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. | |
CVE-2026-39738 |
critical | 9.8 | 0.0041 | 2026-10-30 | Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions. | |
CVE-2026-28160 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions. | |
CVE-2026-39732 |
critical | 9.3 | 0.0032 | 2026-10-30 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | |
CVE-2026-119729 |
medium | 6.5 | 0.0040 | 2026-10-30 | A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variabl | |
CVE-2026-27061 |
medium | 6.5 | 0.0024 | 2026-10-30 | Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | |
CVE-2026-119526 |
critical | 9.8 | 0.0041 | 2026-10-30 | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Inje | |
CVE-2026-119728 |
medium | 5.5 | 0.0016 | 2026-10-30 | A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially | |
CVE-2026-118086 |
high | 8.8 | 0.0036 | 2026-10-30 | Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. | |
CVE-2026-116852 |
critical | 9.1 | 0.0060 | 2026-10-30 | Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. | |
CVE-2026-116401 |
high | 7.5 | 0.0032 | 2026-10-30 | Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. | |
CVE-2026-107868 |
medium | 5.3 | 0.0030 | 2026-10-30 | Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 version | |
CVE-2026-105077 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. | |
CVE-2026-101363 |
medium | 5.3 | 0.0030 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that | |
CVE-2026-101364 |
medium | 5.4 | 0.0019 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versi | |
CVE-2026-101361 |
medium | 4.2 | 0.0018 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-101362 |
medium | 6.9 | 0.0022 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-66026 |
— | — | — | 2026-10-30 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | |
CVE-2026-101360 |
medium | 5.4 | 0.0022 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-61845 |
high | 8.9 | 0.0039 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-66025 |
— | — | — | 2026-10-30 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | |
CVE-2026-61848 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-61846 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-61847 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-18477 |
medium | 4.4 | 0.0008 | 2026-10-30 | A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' re | |
CVE-2026-118089 |
high | 7.2 | 0.0039 | 2026-10-30 | Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | |
CVE-2026-118090 |
high | 8.8 | 0.0045 | 2026-10-30 | Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | |
CVE-2026-116861 |
high | 7.5 | 0.0034 | 2026-10-30 | Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. | |
CVE-2026-116862 |
high | 7.5 | 0.0032 | 2026-10-30 | Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. | |
CVE-2026-116853 |
medium | 6.5 | 0.0021 | 2026-10-30 | Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | |
CVE-2026-116854 |
medium | 6.5 | 0.0020 | 2026-10-30 | Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. | |
CVE-2026-116847 |
high | 7.1 | 0.0019 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. | |
CVE-2026-116851 |
high | 7.1 | 0.0019 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. | |
CVE-2026-116405 |
high | 7.1 | 0.0019 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. | |
CVE-2026-116410 |
medium | 6.5 | 0.0021 | 2026-10-30 | Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. | |
CVE-2026-116386 |
critical | 9.8 | 0.0035 | 2026-10-30 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. | |
CVE-2026-115604 |
medium | 5.0 | 0.0043 | 2026-10-30 | Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. | |
CVE-2026-115947 |
medium | 6.5 | 0.0022 | 2026-10-30 | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | |
CVE-2026-114711 |
medium | 6.5 | 0.0024 | 2026-10-30 | Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. | |
CVE-2026-59978 |
high | 7.5 | 0.0065 | 2026-10-30 | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5. | |
CVE-2012-5605 |
low | 3.3 | 0.0032 | 2026-10-30 | A flaw was found in Grinder, a component of Red Hat CloudForms. This vulnerability allows | |
CVE-2026-120007 |
medium | 6.9 | 0.0034 | 2026-10-30 | NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows un |