Browse All CVEs
29,336 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-110505 |
medium | 6.8 | — | 2026-10-29 | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animat | |
CVE-2026-110983 |
medium | 4.3 | — | 2026-10-29 | The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a | |
CVE-2026-111739 |
high | 7.5 | — | 2026-10-29 | The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) | |
CVE-2026-113616 |
critical | 9.8 | — | 2026-10-29 | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-t | |
CVE-2026-113617 |
critical | 9.9 | — | 2026-10-29 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a us | |
CVE-2026-114270 |
medium | 5.3 | — | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection | |
CVE-2026-114488 |
high | 7.4 | — | 2026-10-29 | A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invoc | |
CVE-2026-115245 |
critical | 9.8 | — | 2026-10-29 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploade | |
CVE-2026-115259 |
medium | 4.9 | — | 2026-10-29 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have | |
CVE-2026-115282 |
medium | 5.3 | — | 2026-10-29 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorizatio | |
CVE-2026-115299 |
medium | 5.4 | — | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce | |
CVE-2026-115300 |
medium | 4.3 | — | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF tok | |
CVE-2026-115301 |
high | 7.2 | — | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the templat | |
CVE-2026-115302 |
medium | 5.3 | — | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to | |
CVE-2026-15564 |
high | 7.4 | — | 2026-10-29 | Wildfly's IIOP listener may permit deserialization of input streams before authentication | |
CVE-2026-19610 |
medium | 6.5 | — | 2026-10-29 | A flaw was found in the platform-mbean component of JBoss EAP, which provides management a | |
CVE-2026-78395 |
medium | 5.3 | — | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's o | |
CVE-2026-78396 |
medium | 5.3 | — | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belo | |
CVE-2026-85007 |
low | 3.8 | — | 2026-10-29 | The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability | |
CVE-2026-86794 |
high | 8.8 | — | 2026-10-29 | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce ch | |
CVE-2026-88928 |
medium | 6.5 | — | 2026-10-29 | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographi | |
CVE-2026-89216 |
high | 8.6 | — | 2026-10-29 | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter | |
CVE-2026-118905 |
high | 7.1 | — | 2026-10-29 | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node. | |
CVE-2023-6270 |
high | 7.0 | 0.0041 | 2026-10-29 | A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg | |
CVE-2026-87853 |
high | 7.5 | 0.0033 | 2026-10-29 | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() functi | |
CVE-2026-93293 |
medium | 6.4 | — | 2026-10-29 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | |
CVE-2023-3397 |
high | 7.0 | 0.0021 | 2026-10-29 | A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux | |
CVE-2026-42013 |
high | 8.2 | 0.0042 | 2026-10-29 | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative | |
CVE-2026-42012 |
high | 7.1 | 0.0035 | 2026-10-29 | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenti | |
CVE-2026-109516 |
critical | 9.8 | — | 2026-10-29 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication B | |
CVE-2026-40063 |
medium | 5.3 | — | 2026-10-29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality o | |
CVE-2026-42922 |
critical | 9.8 | — | 2026-10-29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version | |
CVE-2026-42949 |
medium | 5.6 | — | 2026-10-29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (v | |
CVE-2026-93757 |
high | 7.5 | — | 2026-10-29 | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO | |
CVE-2026-93855 |
high | 7.5 | — | 2026-10-29 | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection v | |
CVE-2026-93904 |
high | 7.5 | — | 2026-10-29 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPr | |
CVE-2026-96228 |
high | 8.1 | — | 2026-10-29 | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all | |
CVE-2026-96666 |
high | 7.2 | — | 2026-10-29 | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scr | |
CVE-2026-96669 |
high | 7.2 | — | 2026-10-29 | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Store | |
CVE-2026-96741 |
high | 7.2 | — | 2026-10-29 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Script | |
CVE-2026-93347 |
medium | 6.9 | 0.0042 | 2026-10-29 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_fil | |
CVE-2026-93346 |
medium | 6.9 | 0.0033 | 2026-10-29 | Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allo | |
CVE-2026-74047 |
high | 7.1 | 0.0032 | 2026-10-29 | Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allow | |
CVE-2026-74043 |
high | 8.5 | 0.0036 | 2026-10-29 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file | |
CVE-2026-74045 |
high | 7.1 | 0.0034 | 2026-10-29 | Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() wh | |
CVE-2026-74037 |
high | 8.6 | 0.0049 | 2026-10-29 | Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero sta | |
CVE-2026-74040 |
critical | 9.4 | 0.0072 | 2026-10-29 | Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability | |
CVE-2026-74035 |
high | 8.6 | 0.0050 | 2026-10-29 | Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability whe | |
CVE-2026-74036 |
high | 8.6 | 0.0083 | 2026-10-29 | Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA po | |
CVE-2026-74034 |
high | 8.7 | 0.0043 | 2026-10-29 | Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that al |