Browse All CVEs
11,719 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-118075 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | |
CVE-2026-118073 |
high | 8.8 | — | 2026-10-29 | Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. | |
CVE-2026-118074 |
high | 7.2 | — | 2026-10-29 | Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. | |
CVE-2026-116868 |
high | 8.8 | — | 2026-10-29 | Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 version | |
CVE-2026-116869 |
high | 7.2 | — | 2026-10-29 | Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. | |
CVE-2026-116866 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. | |
CVE-2026-116867 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions. | |
CVE-2026-116864 |
high | 7.2 | — | 2026-10-29 | Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. | |
CVE-2026-116865 |
high | 7.2 | — | 2026-10-29 | Editor PHP Object Injection in Zippy <= 1.7.0 versions. | |
CVE-2026-114148 |
high | 7.8 | — | 2026-10-29 | 1 PoC | Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate pri |
CVE-2026-108494 |
high | 7.1 | — | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions. | |
CVE-2026-107326 |
high | 8.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execu | |
CVE-2026-104324 |
high | 8.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execu | |
CVE-2026-104328 |
high | 8.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execu | |
CVE-2026-104317 |
high | 8.1 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the me | |
CVE-2026-103092 |
high | 8.5 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execu | |
CVE-2026-101288 |
high | 8.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execu | |
CVE-2026-86016 |
high | 8.2 | 0.0022 | 2026-10-29 | VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerH | |
CVE-2026-104875 |
high | 7.1 | 0.0035 | 2026-10-29 | Ente provides end-to-end encrypted cloud services and security tools. Prior to server imag | |
CVE-2026-107020 |
high | 7.5 | — | 2026-10-29 | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader ver | |
CVE-2026-92982 |
high | 8.5 | 0.0047 | 2026-10-29 | A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit | |
CVE-2026-115713 |
high | 7.5 | — | 2026-10-29 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud E | |
CVE-2026-115708 |
high | 7.2 | — | 2026-10-29 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud E | |
CVE-2026-115709 |
high | 8.2 | — | 2026-10-29 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud E | |
CVE-2026-2100 |
high | 7.5 | 0.0131 | 2026-10-29 | A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling | |
CVE-2026-11837 |
high | 7.3 | 0.0016 | 2026-10-29 | 1 PoC | A local privilege escalation vulnerability was found in the ansible.posix authorized_key m |
CVE-2026-113170 |
high | 8.8 | 0.0033 | 2026-10-29 | Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 allowed a | |
CVE-2026-113180 |
high | 8.8 | 0.0037 | 2026-10-29 | Memory corruption in ContentCapture in Google Chrome on on Android prior to 156.0.8078.47 | |
CVE-2026-39736 |
high | 8.5 | — | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-61611 |
high | 7.5 | 0.0035 | 2026-10-29 | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::u | |
CVE-2026-73261 |
high | 7.5 | 0.0035 | 2026-10-29 | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP | |
CVE-2026-100353 |
high | 7.5 | 0.0034 | 2026-10-29 | kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three | |
CVE-2026-55786 |
high | 8.4 | 0.0026 | 2026-10-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 unti | |
CVE-2026-92158 |
high | 7.2 | 0.0075 | 2026-10-29 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and oth | |
CVE-2026-100413 |
high | 7.0 | 0.0042 | 2026-10-29 | SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, th | |
CVE-2026-116399 |
high | 8.8 | — | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect | |
CVE-2026-119052 |
high | 8.7 | — | 2026-10-29 | llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc | |
CVE-2026-119051 |
high | 8.2 | — | 2026-10-29 | flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten | |
CVE-2026-119049 |
high | 7.2 | — | 2026-10-29 | FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authentic | |
CVE-2019-25781 |
high | 8.7 | — | 2026-10-29 | Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inl | |
CVE-2026-67615 |
high | 8.7 | 0.0054 | 2026-10-29 | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability | |
CVE-2026-94109 |
high | 8.6 | 0.0078 | 2026-10-29 | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injectio | |
CVE-2026-49142 |
high | 8.7 | — | 2026-10-29 | OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromi | |
CVE-2026-42693 |
high | 7.1 | 0.0018 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-101974 |
high | 7.1 | 0.0025 | 2026-10-29 | An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Netw | |
CVE-2026-101987 |
high | 7.1 | 0.0027 | 2026-10-29 | An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon | |
CVE-2026-97860 |
high | 8.4 | — | 2026-10-29 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unq | |
CVE-2026-103665 |
high | 8.4 | — | 2026-10-29 | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecu | |
CVE-2026-109822 |
high | 7.1 | — | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with in | |
CVE-2026-119028 |
high | 8.7 | — | 2026-10-29 | oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attack |