Browse All CVEs
9,465 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-114270 |
medium | 5.3 | 0.0015 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection | |
CVE-2026-115259 |
medium | 4.9 | 0.0013 | 2026-10-29 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have | |
CVE-2026-115282 |
medium | 5.3 | 0.0015 | 2026-10-29 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorizatio | |
CVE-2026-115299 |
medium | 5.4 | 0.0010 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce | |
CVE-2026-115300 |
medium | 4.3 | 0.0010 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF tok | |
CVE-2026-115302 |
medium | 5.3 | 0.0014 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to | |
CVE-2026-19610 |
medium | 6.5 | 0.0021 | 2026-10-29 | A flaw was found in the platform-mbean component of JBoss EAP, which provides management a | |
CVE-2026-78395 |
medium | 5.3 | 0.0014 | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's o | |
CVE-2026-78396 |
medium | 5.3 | 0.0015 | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belo | |
CVE-2026-88928 |
medium | 6.5 | 0.0014 | 2026-10-29 | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographi | |
CVE-2026-93293 |
medium | 6.4 | 0.0019 | 2026-10-29 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting v | |
CVE-2026-40063 |
medium | 5.3 | 0.0029 | 2026-10-29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality o | |
CVE-2026-42949 |
medium | 5.6 | 0.0022 | 2026-10-29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (v | |
CVE-2026-93347 |
medium | 6.9 | 0.0042 | 2026-10-29 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_fil | |
CVE-2026-93346 |
medium | 6.9 | 0.0033 | 2026-10-29 | Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allo | |
CVE-2026-74032 |
medium | 5.3 | 0.0033 | 2026-10-29 | Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows | |
CVE-2026-86979 |
medium | 5.5 | 0.0015 | 2026-10-29 | A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Ga | |
CVE-2026-86981 |
medium | 5.5 | 0.0013 | 2026-10-29 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fi | |
CVE-2026-86940 |
medium | 5.5 | 0.0015 | 2026-10-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Gol | |
CVE-2026-86935 |
medium | 5.5 | 0.0014 | 2026-10-29 | This issue was addressed by removing additional entitlements. This issue is fixed in macOS | |
CVE-2026-86928 |
medium | 5.5 | 0.0017 | 2026-10-29 | A path handling issue was addressed with improved validation. This issue is fixed in macOS | |
CVE-2026-86932 |
medium | 5.5 | 0.0014 | 2026-10-29 | An authorization issue was addressed with improved state management. This issue is fixed i | |
CVE-2026-86915 |
medium | 4.7 | 0.0009 | 2026-10-29 | A race condition was addressed with improved locking. This issue is fixed in macOS Golden | |
CVE-2026-118426 |
medium | 5.3 | 0.0027 | 2026-10-29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any | |
CVE-2026-101365 |
medium | 4.7 | 0.0029 | 2026-10-29 | Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versi | |
CVE-2026-101407 |
medium | 5.5 | 0.0041 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101412 |
medium | 5.8 | 0.0012 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101432 |
medium | 5.3 | 0.0013 | 2026-10-29 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-101471 |
medium | 6.1 | 0.0014 | 2026-10-29 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co | |
CVE-2026-101474 |
medium | 5.9 | 0.0031 | 2026-10-29 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Orac | |
CVE-2026-101502 |
medium | 5.0 | 0.0011 | 2026-10-29 | Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported | |
CVE-2026-101524 |
medium | 5.6 | 0.0019 | 2026-10-29 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-101575 |
medium | 6.5 | 0.0019 | 2026-10-29 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Suppor | |
CVE-2026-101584 |
medium | 6.5 | 0.0027 | 2026-10-29 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webcl | |
CVE-2026-91247 |
medium | 5.9 | 0.0026 | 2026-10-29 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-113409 |
medium | 4.8 | 0.0020 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin s | |
CVE-2026-114173 |
medium | 5.3 | 0.0029 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data i | |
CVE-2026-16889 |
medium | 4.8 | 0.0032 | 2026-10-29 | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/prelogi | |
CVE-2026-66089 |
medium | 6.1 | 0.0027 | 2026-10-29 | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation w | |
CVE-2026-66091 |
medium | 6.9 | 0.0040 | 2026-10-29 | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no a | |
CVE-2026-66092 |
medium | 4.8 | 0.0033 | 2026-10-29 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the l | |
CVE-2026-77490 |
medium | 6.1 | 0.0041 | 2026-10-29 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-70091 |
medium | 5.9 | 0.0066 | 2026-10-29 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2026-66308 |
medium | 6.5 | 0.0114 | 2026-10-29 | Out-of-bounds read in Skype for Business allows an authorized attacker to deny service ove | |
CVE-2026-66306 |
medium | 6.5 | 0.0092 | 2026-10-29 | Generation of error message containing sensitive information in Skype for Business allows | |
CVE-2026-55946 |
medium | 6.1 | 0.0039 | 2026-10-29 | Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose info | |
CVE-2026-68781 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove | |
CVE-2026-67633 |
medium | 6.5 | 0.0114 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a netw | |
CVE-2026-67630 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove | |
CVE-2026-67629 |
medium | 6.5 | 0.0100 | 2026-10-29 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information ove |