Browse All CVEs
35,962 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-66050 |
high | 8.7 | 0.0112 | 2026-10-29 | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file t | |
CVE-2026-66427 |
high | 7.6 | 0.0038 | 2026-10-29 | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. | |
CVE-2026-66428 |
medium | 4.3 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versi | |
CVE-2026-66433 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions. | |
CVE-2026-66434 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug | |
CVE-2026-66437 |
medium | 4.9 | 0.0019 | 2026-10-29 | Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. | |
CVE-2026-66438 |
medium | 5.3 | 0.0033 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions. | |
CVE-2026-66442 |
medium | 5.4 | 0.0029 | 2026-10-29 | Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. | |
CVE-2026-66445 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions. | |
CVE-2026-66448 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions. | |
CVE-2026-66474 |
medium | 4.3 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT | |
CVE-2026-66475 |
medium | 5.9 | 0.0024 | 2026-10-29 | Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – C | |
CVE-2026-66476 |
medium | 4.9 | 0.0050 | 2026-10-29 | Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. | |
CVE-2026-66477 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in Gillion <= 4.13 versions. | |
CVE-2026-16812 |
critical | 10.0 | 0.0176 | 2026-10-29 | KEV | Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that |
CVE-2026-17529 |
low | 2.1 | 0.0037 | 2026-10-29 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown | |
CVE-2026-17530 |
low | 2.1 | 0.0037 | 2026-10-29 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this | |
CVE-2026-17572 |
medium | 5.5 | 0.0014 | 2026-10-29 | Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1 | |
CVE-2026-17573 |
medium | 4.0 | 0.0015 | 2026-10-29 | A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 | |
CVE-2026-17574 |
medium | 5.2 | 0.0015 | 2026-10-29 | HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file con | |
CVE-2026-42792 |
medium | 6.3 | 0.0043 | 2026-10-29 | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows | |
CVE-2026-47078 |
medium | 4.8 | 0.0015 | 2026-10-29 | Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing fil | |
CVE-2026-54890 |
high | 8.2 | 0.0042 | 2026-10-29 | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts module | |
CVE-2026-55737 |
medium | 5.1 | 0.0029 | 2026-10-29 | Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP er | |
CVE-2026-55953 |
critical | 9.1 | 0.0023 | 2026-10-29 | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher s | |
CVE-2026-58227 |
high | 8.7 | 0.0039 | 2026-10-29 | The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete pe | |
CVE-2026-59250 |
high | 8.3 | 0.0078 | 2026-10-29 | Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote una | |
CVE-2026-59251 |
high | 8.7 | 0.0032 | 2026-10-29 | Allocation of resources without limits in Erlang/OTP public_key certificate path validatio | |
CVE-2026-66394 |
critical | 9.3 | 0.0034 | 2026-10-29 | SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in | |
CVE-2026-66395 |
critical | 9.4 | 0.0056 | 2026-10-29 | SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in th | |
CVE-2026-66396 |
critical | 9.3 | 0.0054 | 2026-10-29 | SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when re | |
CVE-2026-66397 |
high | 8.6 | 0.0040 | 2026-10-29 | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image fie | |
CVE-2026-66398 |
critical | 9.4 | 0.0041 | 2026-10-29 | phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration | |
CVE-2026-66399 |
high | 8.5 | 0.0029 | 2026-10-29 | phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::up | |
CVE-2026-17191 |
high | 8.5 | 0.0035 | 2026-10-29 | An input validation vulnerability exists in an API component of the orchestrator. An authe | |
CVE-2026-17192 |
medium | 6.3 | 0.0029 | 2026-10-29 | A VCO feature does not sufficiently validate caller-supplied input, allowing requests to b | |
CVE-2026-17531 |
low | 1.3 | 0.0032 | 2026-10-29 | A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue | |
CVE-2026-24252 |
high | 7.8 | 0.0149 | 2026-10-29 | NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command inje | |
CVE-2026-63077 |
critical | 9.8 | 0.9356 | 2026-10-29 | KEV | JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could a |
CVE-2026-66390 |
medium | 6.1 | 0.0057 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-66391 |
medium | 6.5 | 0.0064 | 2026-10-29 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache | |
CVE-2026-66729 |
high | 8.7 | 0.0078 | 2026-10-29 | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart | |
CVE-2026-66730 |
high | 8.7 | 0.0078 | 2026-10-29 | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart b | |
CVE-2026-66731 |
high | 8.7 | 0.0078 | 2026-10-29 | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 ch | |
CVE-2026-17552 |
critical | 9.1 | 0.0054 | 2026-10-29 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via un | |
CVE-2026-17568 |
high | 8.8 | 0.0042 | 2026-10-29 | Improper access control in the role membership management endpoint in Devolutions Server a | |
CVE-2026-17569 |
medium | 4.3 | 0.0027 | 2026-10-29 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authent | |
CVE-2026-17570 |
medium | 4.3 | 0.0025 | 2026-10-29 | Improper access control in the PAM password history endpoints in Devolutions Server allows | |
CVE-2026-48030 |
critical | 9.9 | 0.0755 | 2026-10-29 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to be | |
CVE-2026-48051 |
low | 3.5 | 0.0026 | 2026-10-29 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5. |