Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-100413 |
high | 7.0 | 0.0037 | 2026-10-29 | SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, th | |
CVE-2026-48202 |
medium | 5.3 | 0.0029 | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-39782 |
medium | 5.3 | 0.0026 | 2026-10-29 | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting I | |
CVE-2026-25467 |
medium | 5.3 | 0.0027 | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerabilit | |
CVE-2026-116857 |
medium | 6.5 | 0.0020 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-116399 |
high | 8.8 | 0.0017 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect | |
CVE-2026-93010 |
medium | 4.3 | 0.0019 | 2026-10-29 | A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed sourc | |
CVE-2026-93009 |
medium | 4.3 | 0.0020 | 2026-10-29 | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the | |
CVE-2026-54862 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-48195 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-42707 |
medium | 4.3 | 0.0020 | 2026-10-29 | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim- | |
CVE-2026-119054 |
medium | 5.1 | 0.0023 | 2026-10-29 | Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting | |
CVE-2026-119053 |
medium | 6.9 | 0.0048 | 2026-10-29 | lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerab | |
CVE-2026-119052 |
high | 8.7 | 0.0061 | 2026-10-29 | llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc | |
CVE-2026-119051 |
high | 8.2 | 0.0032 | 2026-10-29 | flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten | |
CVE-2026-119050 |
critical | 9.2 | 0.0043 | 2026-10-29 | Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows | |
CVE-2026-119049 |
high | 7.2 | 0.0039 | 2026-10-29 | FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authentic | |
CVE-2026-119048 |
low | 2.3 | 0.0027 | 2026-10-29 | JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability i | |
CVE-2026-113695 |
medium | 4.8 | 0.0035 | 2026-10-29 | Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Se | |
CVE-2026-113694 |
medium | 5.3 | 0.0031 | 2026-10-29 | Improper authorization in the SmartIT user attachment feature of BMC IT Service Management | |
CVE-2026-113693 |
medium | 5.3 | 0.0034 | 2026-10-29 | Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service | |
CVE-2026-113692 |
medium | 6.9 | 0.0047 | 2026-10-29 | Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite v | |
CVE-2026-113691 |
medium | 5.1 | 0.0043 | 2026-10-29 | Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Man | |
CVE-2019-25781 |
high | 8.7 | 0.0042 | 2026-10-29 | Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inl | |
CVE-2026-56056 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-52709 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-48196 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-42703 |
medium | 6.5 | 0.0027 | 2026-10-29 | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting I | |
CVE-2026-39741 |
medium | 5.3 | 0.0023 | 2026-10-29 | Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflar | |
CVE-2026-39735 |
medium | 6.5 | 0.0027 | 2026-10-29 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting I | |
CVE-2026-24533 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-22386 |
medium | 4.3 | 0.0022 | 2026-10-29 | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting | |
CVE-2026-118094 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-118093 |
medium | 5.3 | 0.0023 | 2026-10-29 | Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerc | |
CVE-2026-118087 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-113690 |
medium | 4.8 | 0.0035 | 2026-10-29 | Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management | |
CVE-2026-113689 |
medium | 5.1 | 0.0035 | 2026-10-29 | Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management | |
CVE-2026-113688 |
medium | 5.3 | 0.0031 | 2026-10-29 | Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service | |
CVE-2026-94109 |
high | 8.6 | 0.0078 | 2026-10-29 | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injectio | |
CVE-2026-67615 |
high | 8.7 | 0.0054 | 2026-10-29 | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability | |
CVE-2026-93008 |
medium | 6.8 | 0.0015 | 2026-10-29 | A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can ca | |
CVE-2026-49142 |
high | 8.7 | 0.0033 | 2026-10-29 | OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromi | |
CVE-2026-93011 |
medium | 5.3 | 0.0063 | 2026-10-29 | A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the D | |
CVE-2026-93007 |
medium | 5.3 | 0.0043 | 2026-10-29 | A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processe | |
CVE-2026-93006 |
medium | 6.8 | 0.0030 | 2026-10-29 | A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a r | |
CVE-2026-88648 |
low | 3.7 | 0.0020 | 2026-10-29 | In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier do | |
CVE-2026-43840 |
medium | 6.9 | 0.0034 | 2026-10-29 | A NULL pointer dereference vulnerability in the license manager service could allow an una | |
CVE-2026-42693 |
high | 7.1 | 0.0018 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-107686 |
medium | 4.3 | 0.0024 | 2026-10-29 | The Gitea web handlers for adding and removing reactions on issues and comments did not re | |
CVE-2026-101987 |
high | 7.1 | 0.0027 | 2026-10-29 | An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon |