Browse All CVEs
3,490 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-46949 |
critical | 9.1 | 0.0040 | 2026-10-29 | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite | |
CVE-2026-46963 |
critical | 9.9 | 0.0040 | 2026-10-29 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (compo | |
CVE-2026-46964 |
critical | 9.9 | 0.0040 | 2026-10-29 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (compo | |
CVE-2026-46978 |
critical | 10.0 | 0.0031 | 2026-10-29 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administr | |
CVE-2026-0063 |
critical | 10.0 | 0.0015 | 2026-10-29 | In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable ca | |
CVE-2026-0064 |
critical | 10.0 | 0.0012 | 2026-10-29 | In multiple places, there is a possible persistent denial of service due to resource exhau | |
CVE-2026-0068 |
critical | 10.0 | 0.0012 | 2026-10-29 | In createSessionInternal of PackageInstallerService.java, there is a possible method to re | |
CVE-2026-0071 |
critical | 10.0 | 0.0015 | 2026-10-29 | In SettingsLib, there is a possible missing permission check due to a logic error in the c | |
CVE-2026-0081 |
critical | 10.0 | 0.0015 | 2026-10-29 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. T | |
CVE-2026-0082 |
critical | 10.0 | 0.0016 | 2026-10-29 | In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app acces | |
CVE-2026-0083 |
critical | 10.0 | 0.0012 | 2026-10-29 | In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race conditi | |
CVE-2026-0092 |
critical | 10.0 | 0.0022 | 2026-10-29 | In Package Manager, there is a possible device lock controller bypass due to a missing per | |
CVE-2026-10094 |
critical | 9.8 | 0.0038 | 2026-10-29 | A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Rele | |
CVE-2026-12440 |
critical | 9.6 | 0.0025 | 2026-10-29 | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 a | |
CVE-2026-22327 |
critical | 9.9 | 0.0046 | 2026-10-29 | Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions. | |
CVE-2026-22332 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. | |
CVE-2026-22340 |
critical | 9.3 | 0.0037 | 2026-10-29 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. | |
CVE-2026-24611 |
critical | 9.1 | 0.0044 | 2026-10-29 | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. | |
CVE-2026-25446 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in WishList Member X <= 3.29.0 versions. | |
CVE-2026-25470 |
critical | 10.0 | 0.0065 | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for W | |
CVE-2026-27041 |
critical | 9.9 | 0.0032 | 2026-10-29 | Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 v | |
CVE-2026-27395 |
critical | 9.8 | 0.0034 | 2026-10-29 | Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions. | |
CVE-2026-27429 |
critical | 9.8 | 0.0056 | 2026-10-29 | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | |
CVE-2026-28575 |
critical | 10.0 | 0.0013 | 2026-10-29 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/ser | |
CVE-2026-28587 |
critical | 10.0 | 0.0011 | 2026-10-29 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive in | |
CVE-2026-28615 |
critical | 10.0 | 0.0012 | 2026-10-29 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permi | |
CVE-2026-32966 |
critical | 9.8 | 0.0039 | 2026-10-29 | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclos | |
CVE-2026-32967 |
critical | 9.1 | 0.0034 | 2026-10-29 | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinSch | |
CVE-2026-39438 |
critical | 9.3 | 0.0037 | 2026-10-29 | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. | |
CVE-2026-39529 |
critical | 9.8 | 0.0037 | 2026-10-29 | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | |
CVE-2026-39589 |
critical | 9.9 | 0.0045 | 2026-10-29 | Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions. | |
CVE-2026-39596 |
critical | 9.3 | 0.0037 | 2026-10-29 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | |
CVE-2026-40725 |
critical | 9.8 | 0.0037 | 2026-10-29 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. | |
CVE-2026-40746 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions. | |
CVE-2026-40747 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions. | |
CVE-2026-40748 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions. | |
CVE-2026-40749 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions. | |
CVE-2026-40783 |
critical | 9.9 | 0.0054 | 2026-10-29 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. | |
CVE-2026-42380 |
critical | 9.8 | 0.0051 | 2026-10-29 | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. | |
CVE-2026-48055 |
critical | 10.0 | 0.0070 | 2026-10-29 | Streambert is a cross-platform Electron Desktop App to stream and download any video media | |
CVE-2026-48616 |
critical | 9.3 | 0.0033 | 2026-10-29 | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an acc | |
CVE-2026-48745 |
critical | 9.3 | 0.0032 | 2026-10-29 | Traccar Client is a GPS tracking mobile app for sending location updates to private server | |
CVE-2026-48781 |
critical | 9.9 | 0.0021 | 2026-10-29 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integ | |
CVE-2026-48875 |
critical | 9.3 | 0.0042 | 2026-10-29 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. | |
CVE-2026-49058 |
critical | 9.8 | 0.0032 | 2026-10-29 | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. | |
CVE-2026-49075 |
critical | 9.8 | 0.0037 | 2026-10-29 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | |
CVE-2026-49076 |
critical | 9.3 | 0.0037 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-49079 |
critical | 9.3 | 0.0035 | 2026-10-29 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. | |
CVE-2026-49080 |
critical | 9.3 | 0.0031 | 2026-10-29 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | |
CVE-2026-49084 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. |