Browse All CVEs
3,599 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-27064 |
critical | 9.1 | 0.0050 | 2026-10-29 | Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. | |
CVE-2026-57784 |
critical | 9.6 | 0.0020 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension < | |
CVE-2026-59514 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. | |
CVE-2026-59525 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | |
CVE-2026-59526 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
CVE-2026-59540 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions. | |
CVE-2026-59543 |
critical | 9.9 | 0.0079 | 2026-10-29 | Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions. | |
CVE-2026-59544 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. | |
CVE-2026-59555 |
critical | 10.0 | 0.0060 | 2026-10-29 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. | |
CVE-2026-61948 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | |
CVE-2026-61950 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | |
CVE-2026-61951 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions. | |
CVE-2026-64812 |
critical | 10.0 | 0.0048 | 2026-10-29 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Re | |
CVE-2026-64813 |
critical | 10.0 | 0.0052 | 2026-10-29 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible i | |
CVE-2026-64815 |
critical | 9.8 | 0.0048 | 2026-10-29 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Desi | |
CVE-2026-65461 |
critical | 9.1 | 0.0050 | 2026-10-29 | Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions. | |
CVE-2026-65471 |
critical | 9.6 | 0.0020 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions. | |
CVE-2026-65605 |
critical | 9.4 | 0.0079 | 2026-10-29 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute Vie | |
CVE-2026-65906 |
critical | 10.0 | 0.0066 | 2026-10-29 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox esc | |
CVE-2026-65907 |
critical | 9.1 | 0.0066 | 2026-10-29 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possi | |
CVE-2026-65687 |
critical | 9.3 | 0.0087 | 2026-10-29 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65688 |
critical | 9.3 | 0.0087 | 2026-10-29 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65689 |
critical | 9.3 | 0.0087 | 2026-10-29 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65760 |
critical | 9.2 | 0.0042 | 2026-10-29 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosu | |
CVE-2026-65761 |
critical | 9.3 | 0.0104 | 2026-10-29 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension | |
CVE-2026-47752 |
critical | 9.9 | 0.0044 | 2026-10-29 | Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior | |
CVE-2026-65700 |
critical | 9.3 | 0.0152 | 2026-10-29 | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible file | |
CVE-2026-65701 |
critical | 9.3 | 0.0069 | 2026-10-29 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vuln | |
CVE-2026-6516 |
critical | 10.0 | 0.0473 | 2026-10-29 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Re | |
CVE-2026-63359 |
critical | 9.3 | 0.0075 | 2026-10-29 | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) application | |
CVE-2026-10697 |
critical | 9.8 | 0.0060 | 2026-10-29 | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOV | |
CVE-2026-15966 |
critical | 9.8 | 0.0037 | 2026-10-29 | Permissive cross-domain security policy with untrusted domains vulnerability in Progress M | |
CVE-2026-15967 |
critical | 9.8 | 0.0037 | 2026-10-29 | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue aff | |
CVE-2026-47724 |
critical | 9.9 | 0.0048 | 2026-10-29 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. | |
CVE-2026-49035 |
critical | 9.2 | 0.0061 | 2026-10-29 | The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initi | |
CVE-2026-52439 |
critical | 9.8 | 0.0068 | 2026-10-29 | An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via t | |
CVE-2026-63732 |
critical | 9.4 | 0.0101 | 2026-10-29 | 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default | |
CVE-2026-28698 |
critical | 9.2 | 0.0042 | 2026-10-29 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system inform | |
CVE-2026-42933 |
critical | 10.0 | 0.0051 | 2026-10-29 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vu | |
CVE-2026-50517 |
critical | 9.9 | 0.0169 | 2026-10-29 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute | |
CVE-2026-54120 |
critical | 9.9 | 0.0096 | 2026-10-29 | Improper input validation in Microsoft Surface allows an authorized attacker to execute co | |
CVE-2026-56160 |
critical | 9.1 | 0.0079 | 2026-10-29 | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to e | |
CVE-2026-56165 |
critical | 9.8 | 0.0097 | 2026-10-29 | Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute | |
CVE-2026-56191 |
critical | 10.0 | 0.0090 | 2026-10-29 | Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to pe | |
CVE-2026-58275 |
critical | 10.0 | 0.0092 | 2026-10-29 | Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges o | |
CVE-2026-62825 |
critical | 10.0 | 0.0092 | 2026-10-29 | Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate priv | |
CVE-2026-15704 |
critical | 9.8 | 0.0046 | 2026-10-29 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployment | |
CVE-2026-24727 |
critical | 9.3 | 0.0065 | 2026-10-29 | An unrestricted upload of file with dangerous type vulnerability in the e-paper draft uplo | |
CVE-2026-16634 |
critical | 9.8 | 0.0082 | 2026-10-29 | TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tom | |
CVE-2026-56163 |
critical | 10.0 | 0.0090 | 2026-10-29 | Missing authentication for critical function in Microsoft Azure Kubernetes Service allows |