Browse All CVEs
50,450 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-120209 |
critical | 9.3 | 0.0054 | 2026-10-31 | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attacker | |
CVE-2026-120208 |
high | 7.7 | 0.0037 | 2026-10-31 | libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_de | |
CVE-2026-120207 |
high | 7.0 | 0.0020 | 2026-10-31 | Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that a | |
CVE-2026-120206 |
medium | 5.9 | 0.0015 | 2026-10-31 | Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office | |
CVE-2026-120205 |
high | 7.4 | 0.0026 | 2026-10-31 | Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustome | |
CVE-2026-120204 |
medium | 6.3 | 0.0043 | 2026-10-31 | DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /pr | |
CVE-2026-120203 |
high | 8.7 | 0.0035 | 2026-10-31 | ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature th | |
CVE-2026-120202 |
high | 7.1 | 0.0029 | 2026-10-31 | Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that | |
CVE-2026-120201 |
critical | 9.3 | 0.0214 | 2026-10-31 | Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows un | |
CVE-2026-120200 |
medium | 5.3 | 0.0023 | 2026-10-31 | Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows auth | |
CVE-2026-120199 |
medium | 5.3 | 0.0022 | 2026-10-31 | LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment A | |
CVE-2026-102212 |
high | 8.4 | 0.0032 | 2026-10-31 | Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 | |
CVE-2026-14164 |
high | 7.5 | 0.0079 | 2026-10-31 | A double free issue has been identified in libarchive's RAR5 reader. During parsing of a s | |
CVE-2026-11850 |
medium | 5.0 | 0.0027 | 2026-10-31 | An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function | |
CVE-2026-78191 |
critical | 9.8 | 0.0047 | 2026-10-31 | WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the | |
CVE-2026-78190 |
medium | 6.1 | 0.0024 | 2026-10-31 | WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped int | |
CVE-2026-78189 |
critical | 9.8 | 0.0061 | 2026-10-31 | WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document | |
CVE-2026-78188 |
medium | 5.4 | 0.0013 | 2026-10-31 | WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure | |
CVE-2026-11332 |
high | 7.8 | 0.0022 | 2026-10-31 | A flaw was found in ansible-core. The ansible-galaxy role install command processes depend | |
CVE-2026-78192 |
high | 7.5 | 0.0043 | 2026-10-31 | WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthent | |
CVE-2026-16313 |
high | 7.6 | 0.0035 | 2026-10-31 | A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, | |
CVE-2026-113380 |
critical | 9.3 | 0.0090 | 2026-10-31 | In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue | |
CVE-2024-5154 |
high | 8.1 | 0.0124 | 2026-10-31 | A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary f | |
CVE-2026-15272 |
medium | 6.5 | 0.0032 | 2026-10-31 | The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via t | |
CVE-2026-120194 |
high | 7.5 | 0.0047 | 2026-10-31 | A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can | |
CVE-2026-104715 |
high | 7.8 | 0.0027 | 2026-10-31 | 1 PoC | A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve pri |
CVE-2026-107565 |
medium | 5.1 | 0.0010 | 2026-10-31 | A flaw was found in luksmeta. A local attacker with administrative privileges can cause da | |
CVE-2026-104047 |
medium | 5.3 | 0.0013 | 2026-10-31 | A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not | |
CVE-2026-104041 |
medium | 5.5 | 0.0014 | 2026-10-31 | A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for no | |
CVE-2026-104040 |
medium | 6.1 | 0.0012 | 2026-10-31 | Rejected reason: Red Hat Product Security has been notified that this CVE is a duplicated | |
CVE-2026-96554 |
medium | 6.4 | 0.0020 | 2026-10-31 | The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | |
CVE-2026-76010 |
high | 8.8 | 0.0077 | 2026-10-31 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is | |
CVE-2026-120114 |
high | 7.2 | 0.0041 | 2026-10-31 | The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vu | |
CVE-2026-118599 |
medium | 5.5 | 0.0018 | 2026-10-31 | A file overwrite vulnerability exists in Epiphany when installing WebExtension packages fr | |
CVE-2026-118598 |
medium | 6.5 | 0.0047 | 2026-10-31 | A logic error in Epiphany's site permission handling can cause camera and microphone acces | |
CVE-2026-116752 |
medium | 6.4 | 0.0033 | 2026-10-31 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin f | |
CVE-2026-109231 |
medium | 4.3 | 0.0037 | 2026-10-31 | The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access o | |
CVE-2026-109197 |
high | 7.5 | 0.0043 | 2026-10-31 | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the ' | |
CVE-2026-107711 |
medium | 6.4 | 0.0034 | 2026-10-31 | The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress | |
CVE-2026-104926 |
medium | 6.1 | 0.0027 | 2026-10-31 | The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected | |
CVE-2026-100151 |
medium | 6.1 | 0.0023 | 2026-10-31 | The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Bui | |
CVE-2026-120075 |
high | 7.2 | 0.0023 | 2026-10-31 | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in a | |
CVE-2026-119160 |
medium | 6.4 | 0.0023 | 2026-10-31 | The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News pl | |
CVE-2026-118235 |
critical | 9.8 | 0.0074 | 2026-10-31 | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plug | |
CVE-2026-110530 |
high | 7.2 | 0.0024 | 2026-10-31 | The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in ver | |
CVE-2026-109367 |
medium | 5.3 | 0.0028 | 2026-10-31 | The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sit | |
CVE-2026-103915 |
medium | 5.3 | 0.0026 | 2026-10-31 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerab | |
CVE-2026-103882 |
critical | 9.1 | 0.0079 | 2026-10-31 | The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for Word | |
CVE-2026-101325 |
medium | 5.3 | 0.0025 | 2026-10-31 | The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id | |
CVE-2026-117681 |
high | 8.0 | 0.0010 | 2026-10-31 | A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the us |