Browse All CVEs
34,199 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-27409 |
medium | 5.3 | 0.0032 | 2026-10-29 | Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incor | |
CVE-2026-34096 |
medium | 4.8 | 0.0024 | 2026-10-29 | Guardian language-system fails to sanitize the name GET parameter before outputting it int | |
CVE-2026-34097 |
medium | 4.8 | 0.0024 | 2026-10-29 | Guardian language-system fails to sanitize the id GET parameter before inserting it into m | |
CVE-2026-34098 |
medium | 4.8 | 0.0024 | 2026-10-29 | Guardian language-system fails to sanitize the id GET parameter before inserting it into H | |
CVE-2026-34099 |
critical | 9.3 | 0.0063 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL quer | |
CVE-2026-34100 |
high | 8.7 | 0.0046 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL quer | |
CVE-2026-34101 |
high | 8.7 | 0.0046 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL quer | |
CVE-2026-34102 |
high | 8.7 | 0.0046 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL quer | |
CVE-2026-34103 |
high | 8.7 | 0.0046 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL quer | |
CVE-2026-34104 |
high | 8.7 | 0.0046 | 2026-10-29 | Guardian language-system passes the name GET parameter directly into an unsanitized SQL qu | |
CVE-2026-34105 |
high | 8.7 | 0.0046 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL quer | |
CVE-2026-34106 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in su | |
CVE-2026-34107 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in tr | |
CVE-2026-34108 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in te | |
CVE-2026-34109 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in sp | |
CVE-2026-34110 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in co | |
CVE-2026-34111 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in sp | |
CVE-2026-34112 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in sp | |
CVE-2026-34113 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in sp | |
CVE-2026-34114 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in tr | |
CVE-2026-34115 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in tr | |
CVE-2026-34116 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in tr | |
CVE-2026-34117 |
critical | 9.3 | 0.0093 | 2026-10-29 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in te | |
CVE-2026-49087 |
medium | 6.5 | 0.0047 | 2026-10-29 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a den | |
CVE-2026-49088 |
medium | 4.4 | 0.0032 | 2026-10-29 | Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to informati | |
CVE-2026-54399 |
high | 7.5 | 0.0078 | 2026-10-29 | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache H | |
CVE-2026-56148 |
medium | 6.5 | 0.0047 | 2026-10-29 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Exce | |
CVE-2026-56149 |
medium | 4.9 | 0.0050 | 2026-10-29 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead t | |
CVE-2026-56150 |
high | 7.5 | 0.0048 | 2026-10-29 | Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to | |
CVE-2026-56151 |
medium | 6.5 | 0.0047 | 2026-10-29 | Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Dat | |
CVE-2026-56152 |
medium | 5.3 | 0.0031 | 2026-10-29 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized information disclosur | |
CVE-2026-57516 |
high | 8.6 | 0.0086 | 2026-10-29 | Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset rea | |
CVE-2026-57720 |
medium | 4.3 | 0.0033 | 2026-10-29 | Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrec | |
CVE-2026-57721 |
medium | 5.3 | 0.0029 | 2026-10-29 | Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrect | |
CVE-2026-58452 |
high | 8.7 | 0.0267 | 2026-10-29 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command | |
CVE-2026-58453 |
critical | 9.3 | 0.0190 | 2026-10-29 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded | |
CVE-2026-58454 |
high | 7.7 | 0.0083 | 2026-10-29 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code | |
CVE-2026-49090 |
medium | 6.5 | 0.0042 | 2026-10-29 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of servi | |
CVE-2026-49091 |
high | 8.0 | 0.0032 | 2026-10-29 | Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via | |
CVE-2026-54428 |
high | 7.5 | 0.0087 | 2026-10-29 | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache | |
CVE-2026-57722 |
medium | 5.9 | 0.0024 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-57723 |
high | 7.4 | 0.0017 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engin | |
CVE-2026-57737 |
medium | 6.5 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-58520 |
medium | 6.9 | 0.0028 | 2026-10-29 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundat | |
CVE-2026-58521 |
medium | 6.9 | 0.0055 | 2026-10-29 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-13760 |
high | 7.0 | 0.0116 | 2026-10-29 | OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in | |
CVE-2026-13769 |
medium | 6.8 | 0.0017 | 2026-10-29 | Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix | |
CVE-2026-14358 |
medium | 6.9 | 0.0030 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-41121 |
high | 7.8 | 0.0017 | 2026-10-29 | Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resol | |
CVE-2026-49119 |
high | 8.7 | 0.0069 | 2026-10-29 | Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component' |