Browse All CVEs
36,085 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-65519 |
medium | 6.5 | 0.0022 | 2026-10-29 | Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. | |
CVE-2026-65521 |
medium | 5.3 | 0.0033 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions. | |
CVE-2026-65522 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Educati | |
CVE-2026-65524 |
medium | 4.3 | 0.0027 | 2026-10-29 | Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. | |
CVE-2026-65525 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. | |
CVE-2026-65526 |
high | 8.5 | 0.0036 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-65527 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions. | |
CVE-2026-65528 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. | |
CVE-2026-65529 |
medium | 5.3 | 0.0031 | 2026-10-29 | Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Ele | |
CVE-2026-65531 |
medium | 4.8 | 0.0022 | 2026-10-29 | Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. | |
CVE-2026-65532 |
high | 7.6 | 0.0038 | 2026-10-29 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | |
CVE-2026-65533 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. | |
CVE-2026-65534 |
medium | 5.9 | 0.0024 | 2026-10-29 | Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 ver | |
CVE-2026-65535 |
medium | 4.3 | 0.0029 | 2026-10-29 | Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions. | |
CVE-2026-65536 |
medium | 6.5 | 0.0017 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز | |
CVE-2026-65537 |
medium | 4.3 | 0.0025 | 2026-10-29 | Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and fil | |
CVE-2026-65538 |
medium | 5.9 | 0.0024 | 2026-10-29 | Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. | |
CVE-2026-65539 |
high | 7.1 | 0.0013 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. | |
CVE-2026-65540 |
high | 7.1 | 0.0013 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6 | |
CVE-2026-65550 |
medium | 5.9 | 0.0024 | 2026-10-29 | Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. | |
CVE-2026-65605 |
critical | 9.4 | 0.0079 | 2026-10-29 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute Vie | |
CVE-2026-65607 |
high | 7.1 | 0.0059 | 2026-10-29 | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-ci | |
CVE-2026-65608 |
high | 8.7 | 0.0112 | 2026-10-29 | Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. Fle | |
CVE-2026-65895 |
high | 8.2 | 0.0029 | 2026-10-29 | Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical | |
CVE-2026-65896 |
high | 7.1 | 0.0032 | 2026-10-29 | Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly | |
CVE-2026-65897 |
high | 8.7 | 0.0046 | 2026-10-29 | Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsCon | |
CVE-2026-65906 |
critical | 10.0 | 0.0066 | 2026-10-29 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox esc | |
CVE-2026-65907 |
critical | 9.1 | 0.0066 | 2026-10-29 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possi | |
CVE-2026-65908 |
high | 8.6 | 0.0019 | 2026-10-29 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python | |
CVE-2026-14257 |
high | 7.5 | 0.0064 | 2026-10-29 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. Th | |
CVE-2026-16733 |
low | 1.9 | 0.0106 | 2026-10-29 | A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted | |
CVE-2026-16735 |
low | 1.9 | 0.0108 | 2026-10-29 | A security vulnerability has been detected in release-it conventional-changelog up to 11.0 | |
CVE-2026-65687 |
critical | 9.3 | 0.0087 | 2026-10-29 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65688 |
critical | 9.3 | 0.0087 | 2026-10-29 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65689 |
critical | 9.3 | 0.0087 | 2026-10-29 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65690 |
high | 8.7 | 0.0090 | 2026-10-29 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65898 |
medium | 5.1 | 0.0021 | 2026-10-29 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used | |
CVE-2026-65899 |
medium | 5.1 | 0.0041 | 2026-10-29 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearCo | |
CVE-2026-65900 |
medium | 5.1 | 0.0031 | 2026-10-29 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES toget | |
CVE-2026-65901 |
medium | 5.1 | 0.0029 | 2026-10-29 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode tha | |
CVE-2026-65902 |
medium | 5.3 | 0.0036 | 2026-10-29 | DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS a | |
CVE-2026-65903 |
medium | 5.1 | 0.0032 | 2026-10-29 | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit | |
CVE-2026-65904 |
low | 2.3 | 0.0027 | 2026-10-29 | DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the e | |
CVE-2026-65911 |
medium | 5.1 | 0.0033 | 2026-10-29 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPu | |
CVE-2026-65912 |
medium | 5.1 | 0.0030 | 2026-10-29 | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is pro | |
CVE-2026-65913 |
medium | 5.1 | 0.0032 | 2026-10-29 | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode t | |
CVE-2026-65914 |
medium | 5.3 | 0.0031 | 2026-10-29 | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinse | |
CVE-2026-8287 |
medium | 4.3 | 0.0036 | 2026-10-29 | Allocation of resources without limits or throttling vulnerability in BizimHesap Informati | |
CVE-2026-43820 |
high | 7.7 | 0.0011 | 2026-10-29 | NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's S | |
CVE-2026-43823 |
high | 7.5 | 0.0043 | 2026-10-29 | When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* i |