Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-34506 |
high | 8.6 | 0.0097 | 2026-10-29 | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerabi | |
CVE-2025-34458 |
high | 8.7 | 0.0046 | 2026-10-29 | wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, c | |
CVE-2025-34457 |
high | 8.7 | 0.0051 | 2026-10-29 | wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 694c954, c | |
CVE-2025-34253 |
medium | 5.1 | 0.0055 | 2026-10-29 | D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting | |
CVE-2025-34108 |
high | 8.6 | 0.0144 | 2026-10-29 | A stack-based buffer overflow vulnerability exists in the login functionality of Disk Puls | |
CVE-2025-34023 |
high | 8.5 | 0.0158 | 2026-10-29 | A path traversal vulnerability exists in the Karel IP1211 IP Phone's web management panel. | |
CVE-2025-30006 |
medium | 6.1 | 0.0025 | 2026-10-29 | Xorcom CompletePBX is vulnerable to a reflected cross-site scripting (XSS) in the administ | |
CVE-2025-25034 |
critical | 9.3 | 0.0496 | 2026-10-29 | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, | |
CVE-2025-15620 |
high | 8.6 | 0.0052 | 2026-10-29 | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain | |
CVE-2024-8517 |
critical | 9.8 | 0.9453 | 2026-10-29 | 2 PoC | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remo |
CVE-2024-58300 |
high | 8.7 | 0.0044 | 2026-10-29 | Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticated vulnera | |
CVE-2024-58296 |
medium | 5.3 | 0.0039 | 2026-10-29 | CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the currencie | |
CVE-2024-58276 |
high | 8.7 | 0.0044 | 2026-10-29 | Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword paramete | |
CVE-2024-58275 |
high | 8.7 | 0.0175 | 2026-10-29 | Easywall 0.3.1 allows authenticated remote command execution via a command injection vulne | |
CVE-2024-23690 |
high | 7.2 | 0.0116 | 2026-10-29 | The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulner | |
CVE-2024-22047 |
low | 3.1 | 0.0050 | 2026-10-29 | A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated | |
CVE-2023-53982 |
critical | 9.3 | 0.0061 | 2026-10-29 | PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module | |
CVE-2023-53937 |
high | 8.5 | 0.0022 | 2026-10-29 | Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows | |
CVE-2023-53907 |
high | 7.1 | 0.0081 | 2026-10-29 | Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the | |
CVE-2018-25308 |
high | 8.7 | 0.0045 | 2026-10-29 | BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerabi | |
CVE-2017-20251 |
critical | 9.3 | 0.0056 | 2026-10-29 | 1 PoC | WordPress Insert PHP plugin versions before 2.5.1 contain a PHP code injection vulnerabili |
CVE-2017-20243 |
high | 8.8 | 0.0026 | 2026-10-29 | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injectio | |
CVE-2017-20238 |
high | 7.1 | 0.0025 | 2026-10-29 | Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 c | |
CVE-2016-20084 |
medium | 5.1 | 0.0024 | 2026-10-29 | WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulne | |
CVE-2026-119202 |
high | 7.5 | 0.0041 | 2026-10-29 | @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disp | |
CVE-2026-119201 |
medium | 4.8 | 0.0021 | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt | |
CVE-2026-119200 |
medium | 6.5 | 0.0034 | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt | |
CVE-2026-103314 |
high | 7.4 | 0.0040 | 2026-10-29 | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central | |
CVE-2026-110077 |
medium | 5.4 | 0.0019 | 2026-10-29 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerabili | |
CVE-2026-110076 |
medium | 5.4 | 0.0019 | 2026-10-29 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerabili | |
CVE-2026-110075 |
medium | 5.4 | 0.0019 | 2026-10-29 | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerabili | |
CVE-2026-119191 |
high | 7.5 | 0.0043 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in J | |
CVE-2026-119190 |
high | 7.4 | 0.0024 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in J | |
CVE-2026-102559 |
high | 8.6 | 0.0063 | 2026-10-29 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very | |
CVE-2026-102558 |
high | 8.6 | 0.0060 | 2026-10-29 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocke | |
CVE-2026-102557 |
high | 8.6 | 0.0047 | 2026-10-29 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteA | |
CVE-2026-102556 |
high | 8.6 | 0.0047 | 2026-10-29 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocket | |
CVE-2026-119194 |
high | 7.5 | 0.0043 | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container | |
CVE-2026-119193 |
medium | 5.4 | 0.0011 | 2026-10-29 | PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFi | |
CVE-2026-89059 |
high | 7.5 | 0.0153 | 2026-10-29 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image req | |
CVE-2026-67205 |
— | — | — | 2026-10-29 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | |
CVE-2026-67203 |
— | — | — | 2026-10-29 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | |
CVE-2026-51832 |
high | 7.8 | 0.0013 | 2026-10-29 | An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediate | |
CVE-2026-51831 |
high | 7.8 | 0.0013 | 2026-10-29 | An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediate | |
CVE-2026-119196 |
high | 7.5 | 0.0043 | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decod | |
CVE-2026-119195 |
high | 7.5 | 0.0053 | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indef | |
CVE-2026-119197 |
high | 7.5 | 0.0043 | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds | |
CVE-2026-92092 |
high | 7.4 | 0.0032 | 2026-10-29 | A flaw was found in openshift-ansible. The installer container's `run` script downloads an | |
CVE-2026-97229 |
critical | 10.0 | 0.6929 | 2026-10-29 | KEV 7 PoC | GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound v |
CVE-2026-119186 |
medium | 5.9 | 0.0020 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in J |