Browse All CVEs
50,487 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-111040 |
medium | 5.1 | 0.0023 | 2026-11-04 | The platform allows persistent HTML injection into editable fields managed by TinyMCE. An | |
CVE-2026-108949 |
medium | 6.5 | 0.0047 | 2026-11-04 | Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authent | |
CVE-2026-111037 |
medium | 5.1 | 0.0046 | 2026-11-04 | A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Su | |
CVE-2026-111036 |
high | 8.4 | 0.0041 | 2026-11-04 | Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platfor | |
CVE-2026-102721 |
medium | 6.9 | 0.0025 | 2026-11-04 | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the TFTP client copies the | |
CVE-2026-102720 |
medium | 5.3 | 0.0015 | 2026-11-04 | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the DHCP client's option w | |
CVE-2026-102719 |
medium | 6.3 | 0.0021 | 2026-11-04 | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS serve | |
CVE-2026-111038 |
high | 7.3 | 0.0035 | 2026-11-04 | CSV formula injection vulnerability in the export functionality of the Coupa Supplier Port | |
CVE-2026-102722 |
medium | 6.9 | 0.0024 | 2026-11-04 | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 pas | |
CVE-2026-95649 |
medium | 6.1 | 0.0014 | 2026-11-04 | IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user | |
CVE-2026-94460 |
high | 7.2 | 0.0019 | 2026-11-04 | IRISPowerscan contain an insecure default configuration where the built-in installation ac | |
CVE-2026-94459 |
high | 7.2 | 0.0015 | 2026-11-04 | IRISPowerscan contain default user accounts with predictable credentials. An unauthenticat | |
CVE-2026-110935 |
high | 8.6 | 0.0019 | 2026-11-04 | The PFI plugin framework deployment routine does not validate path components when extract | |
CVE-2026-110022 |
high | 8.6 | 0.0011 | 2026-11-04 | The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package | |
CVE-2026-110021 |
medium | 6.9 | 0.0006 | 2026-11-04 | PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically ver | |
CVE-2026-102711 |
medium | 6.9 | 0.0008 | 2026-11-04 | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders take a | |
CVE-2026-93900 |
medium | 6.4 | 0.0033 | 2026-11-04 | The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored | |
CVE-2026-120554 |
high | 8.8 | 0.0055 | 2026-11-04 | The Import and export users and customers plugin for WordPress is vulnerable to Privilege | |
CVE-2026-115498 |
high | 7.2 | 0.0032 | 2026-11-04 | The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | |
CVE-2026-114424 |
critical | 9.2 | 0.0026 | 2026-11-04 | SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement t | |
CVE-2026-114425 |
critical | 9.2 | 0.0033 | 2026-11-04 | SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally prov | |
CVE-2026-114426 |
high | 8.7 | 0.0032 | 2026-11-04 | SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload | |
CVE-2026-114421 |
high | 8.3 | 0.0030 | 2026-11-04 | SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but un | |
CVE-2026-114420 |
medium | 6.9 | 0.0036 | 2026-11-04 | SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an | |
CVE-2026-19731 |
low | 3.3 | 0.0013 | 2026-11-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-19721 |
low | 3.3 | 0.0011 | 2026-11-04 | Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Soft | |
CVE-2026-62126 |
high | 7.5 | 0.0026 | 2026-11-04 | Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP S | |
CVE-2026-62007 |
high | 7.1 | 0.0015 | 2026-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-57775 |
medium | 5.3 | 0.0024 | 2026-11-04 | Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cl | |
CVE-2026-57666 |
high | 7.1 | 0.0015 | 2026-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-57639 |
high | 7.1 | 0.0015 | 2026-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-56065 |
high | 7.5 | 0.0024 | 2026-11-04 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerabil | |
CVE-2026-54861 |
high | 7.1 | 0.0015 | 2026-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119477 |
high | 7.1 | 0.0015 | 2026-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119366 |
high | 7.1 | 0.0015 | 2026-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-110944 |
low | 2.7 | 0.0029 | 2026-11-04 | Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer componen | |
CVE-2026-62000 |
high | 7.5 | 0.0020 | 2026-11-04 | Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketpla | |
CVE-2026-54851 |
high | 7.1 | 0.0015 | 2026-11-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-121818 |
high | 8.5 | 0.0013 | 2026-11-04 | Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Au | |
CVE-2024-33605 |
high | 7.5 | 0.0605 | 2026-11-04 | Improper processing of some parameters of installed_emanual_list.html and installed_emanua | |
CVE-2026-121817 |
high | 8.7 | 0.0044 | 2026-11-04 | Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Refe | |
CVE-2026-121816 |
high | 8.7 | 0.0035 | 2026-11-04 | Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerabi | |
CVE-2026-87044 |
medium | 6.5 | 0.0021 | 2026-11-04 | The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipa | |
CVE-2026-87043 |
medium | 4.8 | 0.0018 | 2026-11-04 | The entropy-device random number generator in subsys/random/random_entropy_device.c return | |
CVE-2026-87041 |
high | 7.8 | 0.0011 | 2026-11-04 | The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/ | |
CVE-2026-87040 |
high | 8.3 | 0.0029 | 2026-11-04 | The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not valida | |
CVE-2026-87039 |
high | 7.8 | 0.0010 | 2026-11-04 | The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies | |
CVE-2026-87038 |
high | 7.0 | 0.0009 | 2026-11-04 | The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer | |
CVE-2026-85036 |
medium | 5.7 | 0.0021 | 2026-11-04 | The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_ | |
CVE-2026-16511 |
high | 8.8 | 0.0017 | 2026-11-04 | Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c be |