Browse All CVEs
10,560 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-114175 |
medium | 5.4 | 0.0026 | 2026-10-29 | Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows | |
CVE-2026-114180 |
medium | 5.3 | 0.0025 | 2026-10-29 | Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly | |
CVE-2026-114182 |
medium | 4.3 | 0.0022 | 2026-10-29 | Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor po | |
CVE-2026-114184 |
medium | 6.5 | 0.0018 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114458 |
medium | 5.9 | 0.0031 | 2026-10-29 | A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Serv | |
CVE-2026-114460 |
medium | 5.3 | 0.0027 | 2026-10-29 | A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging r | |
CVE-2026-110893 |
medium | 5.3 | 0.0028 | 2026-10-29 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploitin | |
CVE-2026-110894 |
medium | 5.3 | 0.0026 | 2026-10-29 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploitin | |
CVE-2026-110974 |
medium | 6.3 | 0.0033 | 2026-10-29 | The org.json parser in com.vaadin.external.google:android-json recurses once per nesting l | |
CVE-2026-111842 |
medium | 5.3 | 0.0024 | 2026-10-29 | Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart | |
CVE-2026-112218 |
medium | 5.3 | 0.0024 | 2026-10-29 | Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Expl | |
CVE-2026-112311 |
medium | 6.5 | 0.0034 | 2026-10-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-112845 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114195 |
medium | 5.3 | 0.0027 | 2026-10-29 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerabil | |
CVE-2026-114696 |
medium | 5.3 | 0.0026 | 2026-10-29 | Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and | |
CVE-2026-114698 |
medium | 5.4 | 0.0024 | 2026-10-29 | Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred all | |
CVE-2026-114699 |
medium | 5.3 | 0.0026 | 2026-10-29 | Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exp | |
CVE-2026-114700 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114701 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114702 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-114703 |
medium | 6.5 | 0.0017 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-96293 |
medium | 6.9 | 0.0006 | 2026-10-29 | A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security | |
CVE-2026-106017 |
medium | 6.3 | 0.0020 | 2026-10-29 | Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 a | |
CVE-2026-114348 |
medium | 5.3 | 0.0031 | 2026-10-29 | webpack-dev-server is a development server that provides live reloading for webpack projec | |
CVE-2017-20288 |
medium | 5.1 | 0.0026 | 2026-10-29 | QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that al | |
CVE-2017-20290 |
medium | 5.1 | 0.0027 | 2026-10-29 | Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulner | |
CVE-2020-37284 |
medium | 5.1 | 0.0021 | 2026-10-29 | Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that a | |
CVE-2023-54413 |
medium | 5.1 | 0.0021 | 2026-10-29 | WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site sc | |
CVE-2024-58394 |
medium | 5.1 | 0.0020 | 2026-10-29 | Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthentic | |
CVE-2026-112842 |
medium | 6.5 | 0.0021 | 2026-10-29 | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-su | |
CVE-2026-115207 |
medium | 5.5 | 0.0014 | 2026-10-29 | A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the | |
CVE-2026-115321 |
medium | 5.3 | 0.0028 | 2026-10-29 | Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueCo | |
CVE-2026-115322 |
medium | 5.3 | 0.0028 | 2026-10-29 | Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, Ge | |
CVE-2026-115323 |
medium | 6.9 | 0.0024 | 2026-10-29 | EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer | |
CVE-2026-115326 |
medium | 5.3 | 0.0022 | 2026-10-29 | QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderD | |
CVE-2026-115327 |
medium | 6.0 | 0.0031 | 2026-10-29 | libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_ | |
CVE-2026-115329 |
medium | 6.0 | 0.0026 | 2026-10-29 | Lotus through 0.10.2 contains an insecure direct object reference vulnerability in Subscri | |
CVE-2026-13411 |
medium | 4.3 | 0.0032 | 2026-10-29 | Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playboo | |
CVE-2026-115248 |
medium | 5.3 | 0.0025 | 2026-10-29 | A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a | |
CVE-2026-115400 |
medium | 6.7 | 0.0010 | 2026-10-29 | crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attac | |
CVE-2026-115411 |
medium | 5.3 | 0.0028 | 2026-10-29 | crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its | |
CVE-2026-66281 |
medium | 6.0 | 0.0033 | 2026-10-29 | In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a lo | |
CVE-2026-66282 |
medium | 6.0 | 0.0033 | 2026-10-29 | In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a | |
CVE-2026-85080 |
medium | 6.0 | 0.0050 | 2026-10-29 | In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an ou | |
CVE-2026-89409 |
medium | 5.3 | 0.0027 | 2026-10-29 | In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for | |
CVE-2026-89410 |
medium | 5.1 | 0.0018 | 2026-10-29 | In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds rea | |
CVE-2026-114515 |
medium | 6.5 | 0.0027 | 2026-10-29 | OCO-Server is a self-hosted endpoint management application for computer inventory, softwa | |
CVE-2026-78801 |
medium | 4.3 | 0.0031 | 2026-10-29 | An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) | |
CVE-2026-114485 |
medium | 4.3 | 0.0024 | 2026-10-29 | Insufficient protection of sensitive information in the user list endpoint in Devolutions | |
CVE-2026-114486 |
medium | 4.3 | 0.0022 | 2026-10-29 | Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server |