Browse All CVEs
13,225 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-115895 |
high | 8.8 | 0.0047 | 2026-10-29 | Happy DOM is a JavaScript implementation of a web browser without its graphical user inter | |
CVE-2026-115935 |
high | 8.7 | 0.0037 | 2026-10-29 | The app/process-api-response-headers action accepts fake Craft API response headers from a | |
CVE-2026-115937 |
high | 8.7 | 0.0017 | 2026-10-29 | The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and ne | |
CVE-2026-115938 |
high | 8.7 | 0.0037 | 2026-10-29 | Craft CMS allows any authenticated control panel user to submit an element-search conditio | |
CVE-2026-115929 |
high | 7.6 | 0.0019 | 2026-10-29 | MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root ce | |
CVE-2026-115807 |
high | 7.1 | 0.0021 | 2026-10-29 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Ed | |
CVE-2026-112207 |
high | 7.1 | 0.0021 | 2026-10-29 | The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a click | |
CVE-2026-113673 |
high | 7.2 | 0.0060 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-d | |
CVE-2026-112844 |
high | 7.1 | 0.0020 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-112869 |
high | 7.1 | 0.0020 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114178 |
high | 7.1 | 0.0021 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114179 |
high | 7.1 | 0.0020 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114694 |
high | 7.1 | 0.0025 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114695 |
high | 7.1 | 0.0021 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114697 |
high | 7.1 | 0.0021 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-115975 |
high | 7.1 | 0.0022 | 2026-10-29 | Broken access control in JiraController in Cervantes version v1.3-beta could allow an atta | |
CVE-2026-110018 |
high | 8.8 | 0.0039 | 2026-10-29 | The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Anim | |
CVE-2026-116009 |
high | 8.7 | 0.0042 | 2026-10-29 | Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with o | |
CVE-2026-116011 |
high | 8.7 | 0.0068 | 2026-10-29 | Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() t | |
CVE-2026-116016 |
high | 7.1 | 0.0025 | 2026-10-29 | yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows aut | |
CVE-2026-116019 |
high | 8.7 | 0.0035 | 2026-10-29 | Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page edit | |
CVE-2026-114191 |
high | 7.5 | 0.0034 | 2026-10-29 | Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerc | |
CVE-2026-114704 |
high | 7.2 | 0.0041 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi releva | |
CVE-2026-115251 |
high | 7.2 | 0.0031 | 2026-10-29 | The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade rout | |
CVE-2026-116066 |
high | 7.0 | 0.0028 | 2026-10-29 | Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Play | |
CVE-2026-116067 |
high | 8.8 | 0.0169 | 2026-10-29 | Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, Delet | |
CVE-2026-116068 |
high | 8.7 | 0.0032 | 2026-10-29 | Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners | |
CVE-2026-116071 |
high | 8.2 | 0.0020 | 2026-10-29 | rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to | |
CVE-2026-116149 |
high | 7.2 | 0.0035 | 2026-10-29 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflo | |
CVE-2026-116165 |
high | 8.8 | 0.0032 | 2026-10-29 | Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorizati | |
CVE-2026-116166 |
high | 7.6 | 0.0011 | 2026-10-29 | SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enfor | |
CVE-2026-116167 |
high | 7.6 | 0.0066 | 2026-10-29 | SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauth | |
CVE-2026-116172 |
high | 8.2 | 0.0034 | 2026-10-29 | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the | |
CVE-2026-116173 |
high | 8.2 | 0.0034 | 2026-10-29 | vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remo | |
CVE-2026-116174 |
high | 8.2 | 0.0028 | 2026-10-29 | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the | |
CVE-2026-116175 |
high | 7.1 | 0.0031 | 2026-10-29 | vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the Aud | |
CVE-2026-116176 |
high | 8.8 | 0.0032 | 2026-10-29 | vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that al | |
CVE-2026-116177 |
high | 8.7 | 0.0029 | 2026-10-29 | vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability | |
CVE-2026-116178 |
high | 8.2 | 0.0033 | 2026-10-29 | vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remo | |
CVE-2026-116179 |
high | 8.7 | 0.0032 | 2026-10-29 | vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows AP | |
CVE-2026-116180 |
high | 8.3 | 0.0025 | 2026-10-29 | vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in | |
CVE-2026-116181 |
high | 7.1 | 0.0037 | 2026-10-29 | vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that al | |
CVE-2026-116183 |
high | 8.7 | 0.0024 | 2026-10-29 | phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that al | |
CVE-2026-116189 |
high | 7.7 | 0.0014 | 2026-10-29 | rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfup | |
CVE-2026-116191 |
high | 8.7 | 0.0039 | 2026-10-29 | Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows u | |
CVE-2026-116192 |
high | 8.2 | 0.0022 | 2026-10-29 | rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that a | |
CVE-2026-116194 |
high | 7.6 | 0.0012 | 2026-10-29 | Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in th | |
CVE-2026-116195 |
high | 7.0 | 0.0023 | 2026-10-29 | Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's transl | |
CVE-2026-116200 |
high | 8.2 | 0.0015 | 2026-10-29 | Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), | |
CVE-2026-116201 |
high | 8.7 | 0.0030 | 2026-10-29 | Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers |