Browse All CVEs
50,481 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42014 |
medium | 6.6 | 0.0015 | 2026-11-03 | A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing | |
CVE-2026-14180 |
medium | 5.3 | 0.0103 | 2026-11-03 | A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used b | |
CVE-2026-121625 |
medium | 6.3 | 0.0036 | 2026-11-03 | GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRT | |
CVE-2026-97072 |
medium | 4.3 | 0.0020 | 2026-11-03 | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly | |
CVE-2026-39777 |
medium | 4.3 | 0.0015 | 2026-11-03 | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership | |
CVE-2026-38601 |
high | 7.5 | 0.0033 | 2026-11-03 | A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers | |
CVE-2026-38600 |
critical | 9.8 | 0.0064 | 2026-11-03 | A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3. | |
CVE-2026-121631 |
low | 2.3 | 0.0018 | 2026-11-03 | Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the Re | |
CVE-2026-121262 |
medium | 5.5 | 0.0037 | 2026-11-03 | A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is th | |
CVE-2026-119509 |
medium | 5.3 | 0.0027 | 2026-11-03 | Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease | |
CVE-2026-119485 |
medium | 5.3 | 0.0023 | 2026-11-03 | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrect | |
CVE-2026-114187 |
medium | 5.3 | 0.0023 | 2026-11-03 | Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allow | |
CVE-2026-114185 |
medium | 6.5 | 0.0020 | 2026-11-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-103077 |
medium | 4.3 | 0.0024 | 2026-11-03 | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly | |
CVE-2026-109268 |
medium | 6.3 | 0.0041 | 2026-11-03 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerabili | |
CVE-2026-109267 |
medium | 6.9 | 0.0029 | 2026-11-03 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL | |
CVE-2026-109265 |
medium | 6.9 | 0.0037 | 2026-11-03 | ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that al | |
CVE-2026-109264 |
medium | 6.3 | 0.0040 | 2026-11-03 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in th | |
CVE-2026-109263 |
medium | 6.3 | 0.0042 | 2026-11-03 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV enc | |
CVE-2026-121261 |
low | 2.1 | 0.0029 | 2026-11-03 | A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the functi | |
CVE-2026-121259 |
medium | 6.5 | 0.0033 | 2026-11-03 | A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 200 | |
CVE-2011-4899 |
high | 7.5 | 0.0902 | 2026-11-03 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier doe | |
CVE-2026-39743 |
medium | 5.3 | 0.0018 | 2026-11-03 | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership | |
CVE-2026-120846 |
medium | 5.3 | 0.0018 | 2026-11-03 | Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator all | |
CVE-2026-119521 |
medium | 6.5 | 0.0013 | 2026-11-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119495 |
medium | 5.3 | 0.0060 | 2026-11-03 | Missing Authorization vulnerability in WebberZone Better Search better-search allows Explo | |
CVE-2026-116859 |
medium | 5.3 | 0.0023 | 2026-11-03 | Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting In | |
CVE-2026-116858 |
medium | 4.3 | 0.0017 | 2026-11-03 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-115716 |
medium | 6.5 | 0.0035 | 2026-11-03 | Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to d | |
CVE-2026-115715 |
medium | 6.5 | 0.0032 | 2026-11-03 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead t | |
CVE-2026-115714 |
high | 7.4 | 0.0018 | 2026-11-03 | Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipp | |
CVE-2026-115710 |
medium | 4.2 | 0.0017 | 2026-11-03 | Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to infor | |
CVE-2026-115298 |
medium | 4.3 | 0.0022 | 2026-11-03 | Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via | |
CVE-2026-115297 |
medium | 6.5 | 0.0030 | 2026-11-03 | NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to d | |
CVE-2026-115295 |
medium | 4.3 | 0.0030 | 2026-11-03 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to informati | |
CVE-2026-115294 |
high | 7.3 | 0.0034 | 2026-11-03 | Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet f | |
CVE-2026-115293 |
medium | 6.5 | 0.0037 | 2026-11-03 | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboar | |
CVE-2026-115292 |
medium | 4.3 | 0.0024 | 2026-11-03 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can | |
CVE-2026-115290 |
high | 7.5 | 0.0041 | 2026-11-03 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serial | |
CVE-2026-115289 |
medium | 4.3 | 0.0024 | 2026-11-03 | Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to in | |
CVE-2026-114183 |
medium | 6.5 | 0.0022 | 2026-11-03 | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elemen | |
CVE-2026-105312 |
critical | 9.9 | 0.0034 | 2026-11-03 | A Kubernetes tenant with create permission on Console custom resources can set spec.contai | |
CVE-2026-105311 |
high | 7.7 | 0.0030 | 2026-11-03 | The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permis | |
CVE-2026-38595 |
critical | 9.8 | 0.0048 | 2026-11-03 | An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS | |
CVE-2026-120843 |
medium | 6.5 | 0.0013 | 2026-11-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-119487 |
medium | 5.3 | 0.0026 | 2026-11-03 | Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrect | |
CVE-2026-91408 |
critical | 9.8 | 0.0038 | 2026-11-03 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (componen | |
CVE-2026-109259 |
medium | 6.9 | 0.0031 | 2026-11-03 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read | |
CVE-2026-109258 |
low | 2.0 | 0.0026 | 2026-11-03 | ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the | |
CVE-2026-108693 |
high | 7.3 | 0.0024 | 2026-11-03 | ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path |