Browse All CVEs
10,517 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-116745 |
medium | 6.9 | 0.0023 | 2026-10-29 | QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmatio | |
CVE-2026-116746 |
medium | 6.9 | 0.0025 | 2026-10-29 | QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotel | |
CVE-2026-116602 |
medium | 5.5 | 0.0047 | 2026-10-29 | A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue | |
CVE-2026-2270 |
medium | 5.9 | 0.0034 | 2026-10-29 | A confused deputy attack exists in the StatefulSet controller that allows a user with name | |
CVE-2026-76654 |
medium | 5.8 | 0.0043 | 2026-10-29 | An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod' | |
CVE-2026-116604 |
medium | 5.5 | 0.0057 | 2026-10-29 | A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affe | |
CVE-2026-116800 |
medium | 6.9 | 0.0051 | 2026-10-29 | WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauth | |
CVE-2026-116801 |
medium | 5.3 | 0.0025 | 2026-10-29 | Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning o | |
CVE-2026-116802 |
medium | 5.1 | 0.0022 | 2026-10-29 | DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attacker | |
CVE-2026-116803 |
medium | 5.1 | 0.0016 | 2026-10-29 | DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attacker | |
CVE-2026-116804 |
medium | 5.1 | 0.0018 | 2026-10-29 | DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attacker | |
CVE-2026-116805 |
medium | 5.3 | 0.0022 | 2026-10-29 | OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-l | |
CVE-2026-116806 |
medium | 5.3 | 0.0024 | 2026-10-29 | OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.pr | |
CVE-2026-116809 |
medium | 6.9 | 0.0021 | 2026-10-29 | OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tR | |
CVE-2026-116810 |
medium | 6.9 | 0.0025 | 2026-10-29 | OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthen | |
CVE-2026-116815 |
medium | 5.3 | 0.0023 | 2026-10-29 | OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts th | |
CVE-2026-116817 |
medium | 6.9 | 0.0027 | 2026-10-29 | OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthe | |
CVE-2026-116820 |
medium | 6.9 | 0.0023 | 2026-10-29 | YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allo | |
CVE-2026-116822 |
medium | 6.9 | 0.0021 | 2026-10-29 | YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allo | |
CVE-2026-116823 |
medium | 5.3 | 0.0018 | 2026-10-29 | YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows u | |
CVE-2026-116824 |
medium | 5.3 | 0.0018 | 2026-10-29 | YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page | |
CVE-2026-116828 |
medium | 6.9 | 0.0025 | 2026-10-29 | YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from p | |
CVE-2024-58399 |
medium | 6.9 | 0.0012 | 2026-10-29 | llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader | |
CVE-2025-71439 |
medium | 6.8 | 0.0012 | 2026-10-29 | llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::im | |
CVE-2026-116605 |
medium | 5.5 | 0.0030 | 2026-10-29 | A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted | |
CVE-2026-116620 |
medium | 5.5 | 0.0030 | 2026-10-29 | A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue af | |
CVE-2026-116623 |
medium | 5.5 | 0.0039 | 2026-10-29 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impact | |
CVE-2026-116829 |
medium | 6.9 | 0.0013 | 2026-10-29 | llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_fro | |
CVE-2026-116840 |
medium | 6.9 | 0.0013 | 2026-10-29 | llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from | |
CVE-2026-116841 |
medium | 6.8 | 0.0012 | 2026-10-29 | DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundle | |
CVE-2026-116842 |
medium | 6.9 | 0.0013 | 2026-10-29 | DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundl | |
CVE-2026-116844 |
medium | 6.3 | 0.0009 | 2026-10-29 | Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability beca | |
CVE-2026-88781 |
medium | 6.8 | 0.0011 | 2026-10-29 | Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level | |
CVE-2026-103312 |
medium | 5.3 | 0.0024 | 2026-10-29 | The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authentic | |
CVE-2026-103332 |
medium | 5.3 | 0.0018 | 2026-10-29 | The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properl | |
CVE-2026-117468 |
medium | 6.5 | 0.0047 | 2026-10-29 | Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce tok | |
CVE-2026-117469 |
medium | 5.4 | 0.0034 | 2026-10-29 | Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file- | |
CVE-2026-117470 |
medium | 6.5 | 0.0041 | 2026-10-29 | Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challe | |
CVE-2026-117471 |
medium | 5.4 | 0.0024 | 2026-10-29 | Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when co | |
CVE-2026-117472 |
medium | 4.3 | 0.0032 | 2026-10-29 | Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk | |
CVE-2026-103359 |
medium | 5.3 | 0.0011 | 2026-10-29 | The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify th | |
CVE-2026-105946 |
medium | 5.3 | 0.0046 | 2026-10-29 | Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network mo | |
CVE-2026-110910 |
medium | 6.3 | 0.0029 | 2026-10-29 | ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty arr | |
CVE-2026-101034 |
medium | 6.8 | 0.0015 | 2026-10-29 | An attacker who obtained the hardcoded key could decrypt domain/service account passwords, | |
CVE-2026-107472 |
medium | 4.3 | 0.0012 | 2026-10-29 | An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibi | |
CVE-2026-10511 |
medium | 6.4 | 0.0019 | 2026-10-29 | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | |
CVE-2026-65210 |
medium | 4.9 | 0.0023 | 2026-10-29 | This issue may allow an authenticated IPMI Administrator to read arbitrary files from the | |
CVE-2026-65213 |
medium | 6.6 | 0.0054 | 2026-10-29 | This issue may allow an IPMI authenticated administrator to execute commands as the operat | |
CVE-2026-102787 |
medium | 5.3 | 0.0016 | 2026-10-29 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | |
CVE-2026-107145 |
medium | 6.3 | 0.0030 | 2026-10-29 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the se |