Browse All CVEs
10,485 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-75524 |
medium | 5.4 | 0.0027 | 2026-10-29 | OpenReception's appointment booking software provides an end-to-end encrypted appointment | |
CVE-2026-75525 |
medium | 5.3 | 0.0017 | 2026-10-29 | OpenReception's appointment booking software provides an end-to-end encrypted appointment | |
CVE-2026-115883 |
medium | 6.0 | 0.0030 | 2026-10-29 | LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for Lang | |
CVE-2026-115885 |
medium | 4.1 | 0.0011 | 2026-10-29 | The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until | |
CVE-2026-115886 |
medium | 6.5 | 0.0068 | 2026-10-29 | MLflow is an open source AI engineering platform for agents, large language models, and ma | |
CVE-2026-115892 |
medium | 5.7 | 0.0043 | 2026-10-29 | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a hos | |
CVE-2026-105199 |
medium | 6.8 | 0.0031 | 2026-10-29 | The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a ca | |
CVE-2026-107887 |
medium | 5.4 | 0.0014 | 2026-10-29 | The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capabili | |
CVE-2026-107907 |
medium | 6.5 | 0.0023 | 2026-10-29 | The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership | |
CVE-2026-113489 |
medium | 4.3 | 0.0020 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attach | |
CVE-2026-113490 |
medium | 5.3 | 0.0028 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership | |
CVE-2026-113491 |
medium | 6.4 | 0.0025 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image | |
CVE-2026-113492 |
medium | 5.3 | 0.0028 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or pa | |
CVE-2026-113493 |
medium | 6.8 | 0.0031 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its | |
CVE-2026-114429 |
medium | 6.8 | 0.0031 | 2026-10-29 | The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its | |
CVE-2026-87835 |
medium | 6.5 | 0.0025 | 2026-10-29 | The Front End Users WordPress plugin through 3.2.35 does not restrict which account attrib | |
CVE-2026-97352 |
medium | 4.3 | 0.0020 | 2026-10-29 | The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capabil | |
CVE-2026-97353 |
medium | 5.4 | 0.0022 | 2026-10-29 | The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capabili | |
CVE-2026-108013 |
medium | 6.8 | 0.0016 | 2026-10-29 | BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated bef | |
CVE-2026-115803 |
medium | 5.3 | 0.0022 | 2026-10-29 | A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function H | |
CVE-2026-110892 |
medium | 6.5 | 0.0030 | 2026-10-29 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploitin | |
CVE-2026-114190 |
medium | 5.9 | 0.0031 | 2026-10-29 | Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed | |
CVE-2026-114693 |
medium | 6.5 | 0.0018 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-115993 |
medium | 6.8 | 0.0032 | 2026-10-29 | Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3- | |
CVE-2026-114194 |
medium | 6.5 | 0.0018 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114705 |
medium | 6.5 | 0.0022 | 2026-10-29 | Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery all | |
CVE-2026-115994 |
medium | 5.4 | 0.0022 | 2026-10-29 | BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an | |
CVE-2026-115998 |
medium | 4.3 | 0.0020 | 2026-10-29 | IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensit | |
CVE-2026-116008 |
medium | 5.3 | 0.0020 | 2026-10-29 | DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsContro | |
CVE-2026-116010 |
medium | 5.3 | 0.0020 | 2026-10-29 | RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authen | |
CVE-2026-116013 |
medium | 6.3 | 0.0029 | 2026-10-29 | OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in | |
CVE-2026-116015 |
medium | 5.3 | 0.0022 | 2026-10-29 | yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in | |
CVE-2026-116017 |
medium | 5.3 | 0.0023 | 2026-10-29 | Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerabili | |
CVE-2026-116018 |
medium | 5.3 | 0.0021 | 2026-10-29 | ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vul | |
CVE-2026-116020 |
medium | 5.3 | 0.0018 | 2026-10-29 | BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentCo | |
CVE-2026-114192 |
medium | 6.5 | 0.0022 | 2026-10-29 | Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Ex | |
CVE-2026-115969 |
medium | 5.5 | 0.0134 | 2026-10-29 | A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the f | |
CVE-2026-115970 |
medium | 5.5 | 0.0030 | 2026-10-29 | A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function | |
CVE-2026-115971 |
medium | 6.9 | 0.0037 | 2026-10-29 | A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.conca | |
CVE-2026-115972 |
medium | 6.9 | 0.0028 | 2026-10-29 | A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this | |
CVE-2026-115973 |
medium | 6.9 | 0.0028 | 2026-10-29 | A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue | |
CVE-2026-115981 |
medium | 4.8 | 0.0025 | 2026-10-29 | A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulner | |
CVE-2026-115996 |
medium | 6.3 | 0.0023 | 2026-10-29 | A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15. | |
CVE-2026-115999 |
medium | 6.9 | 0.0026 | 2026-10-29 | A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bd | |
CVE-2026-116000 |
medium | 6.9 | 0.0029 | 2026-10-29 | A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability af | |
CVE-2026-116006 |
medium | 5.5 | 0.0083 | 2026-10-29 | A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affe | |
CVE-2026-116007 |
medium | 6.3 | 0.0037 | 2026-10-29 | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted el | |
CVE-2026-110285 |
medium | 5.3 | 0.0020 | 2026-10-29 | The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook | |
CVE-2026-111976 |
medium | 5.3 | 0.0020 | 2026-10-29 | The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability che | |
CVE-2026-111978 |
medium | 6.0 | 0.0028 | 2026-10-29 | The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied fi |