Browse All CVEs
34,122 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-59388 |
medium | 6.5 | 0.0030 | 2026-10-30 | Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom | |
CVE-2026-59396 |
medium | 6.9 | 0.0029 | 2026-10-30 | A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication me | |
CVE-2026-59385 |
low | 2.7 | 0.0018 | 2026-10-30 | A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker withou | |
CVE-2026-59386 |
medium | 6.5 | 0.0022 | 2026-10-30 | A SpaceSupporter could improperly modify an application's start command and buildpack—acti | |
CVE-2026-115274 |
medium | 6.9 | 0.0050 | 2026-10-30 | Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard li | |
CVE-2026-59387 |
high | 8.8 | 0.0023 | 2026-10-30 | The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /int | |
CVE-2026-109821 |
medium | 6.3 | 0.0050 | 2026-10-30 | Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard li | |
CVE-2026-101295 |
high | 7.3 | 0.0014 | 2026-10-30 | Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. Wh | |
CVE-2026-109976 |
medium | 4.7 | 0.0014 | 2026-10-30 | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon | |
CVE-2026-115456 |
low | 3.7 | 0.0022 | 2026-10-30 | A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a st | |
CVE-2026-65874 |
high | 8.8 | 0.0028 | 2026-10-30 | This issue affects Apache Fineract versions up to and including 1.15.0. The Center read en | |
CVE-2026-82104 |
critical | 9.4 | 0.0039 | 2026-10-30 | In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS de | |
CVE-2026-19730 |
medium | 4.2 | 0.0013 | 2026-10-30 | The 'podman quadlet install --replace' command opens the existing destination file with O_ | |
CVE-2026-113496 |
medium | 5.0 | 0.0014 | 2026-10-30 | A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console | |
CVE-2026-115455 |
medium | 6.5 | 0.0030 | 2026-10-30 | A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a | |
CVE-2026-113495 |
medium | 5.0 | 0.0016 | 2026-10-30 | A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authenticatio | |
CVE-2026-114690 |
medium | 6.2 | 0.0011 | 2026-10-30 | A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstd | |
CVE-2026-114691 |
medium | 5.9 | 0.0040 | 2026-10-30 | A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessi | |
CVE-2026-79705 |
medium | 4.5 | 0.0041 | 2026-10-30 | A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-r | |
CVE-2026-85231 |
medium | 6.5 | 0.0030 | 2026-10-30 | A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerab | |
CVE-2026-109971 |
medium | 4.7 | 0.0015 | 2026-10-30 | A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PK | |
CVE-2026-14324 |
medium | 6.5 | 0.0038 | 2026-10-30 | RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() | |
CVE-2026-109969 |
medium | 4.7 | 0.0013 | 2026-10-30 | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon | |
CVE-2026-109970 |
medium | 4.7 | 0.0012 | 2026-10-30 | A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes th | |
CVE-2026-109968 |
medium | 5.5 | 0.0008 | 2026-10-30 | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon | |
CVE-2026-14330 |
medium | 5.5 | 0.0016 | 2026-10-30 | Multiple unbounded alloca() calls in the PulseAudio protocol server. | |
CVE-2026-90437 |
high | 7.2 | 0.0019 | 2026-10-30 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Po | |
CVE-2026-97645 |
high | 7.2 | 0.0019 | 2026-10-30 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Li | |
CVE-2026-118593 |
medium | 5.9 | 0.0020 | 2026-10-30 | A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of th | |
CVE-2026-89435 |
high | 8.8 | 0.0039 | 2026-10-30 | The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & Mo | |
CVE-2026-110732 |
high | 7.5 | 0.0027 | 2026-10-30 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vuln | |
CVE-2026-116622 |
high | 7.2 | 0.0024 | 2026-10-30 | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Store | |
CVE-2026-103039 |
critical | 9.8 | 0.0051 | 2026-10-30 | 1 PoC | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versio |
CVE-2026-76781 |
medium | 5.5 | 0.0016 | 2026-10-30 | A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML | |
CVE-2026-118952 |
medium | 6.5 | 0.0023 | 2026-10-30 | A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a | |
CVE-2026-114422 |
high | 7.5 | 0.0047 | 2026-10-30 | The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allow | |
CVE-2026-114443 |
high | 7.5 | 0.0019 | 2026-10-30 | The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before | |
CVE-2026-114444 |
medium | 4.4 | 0.0023 | 2026-10-30 | The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before | |
CVE-2026-115277 |
medium | 4.7 | 0.0018 | 2026-10-30 | The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-s | |
CVE-2026-117571 |
high | 8.8 | 0.0028 | 2026-10-30 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitiz | |
CVE-2026-117572 |
medium | 4.1 | 0.0019 | 2026-10-30 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitiz | |
CVE-2026-118071 |
medium | 6.8 | 0.0024 | 2026-10-30 | The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button bloc | |
CVE-2026-118072 |
medium | 5.4 | 0.0017 | 2026-10-30 | The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check | |
CVE-2026-118100 |
medium | 5.3 | 0.0021 | 2026-10-30 | The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed | |
CVE-2026-118101 |
medium | 5.3 | 0.0015 | 2026-10-30 | The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an exist | |
CVE-2026-118165 |
medium | 6.8 | 0.0024 | 2026-10-30 | The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it | |
CVE-2026-119087 |
medium | 4.3 | 0.0022 | 2026-10-30 | The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vu | |
CVE-2026-118698 |
medium | 6.5 | 0.0032 | 2026-10-30 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is | |
CVE-2026-119059 |
medium | 4.3 | 0.0020 | 2026-10-30 | The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data du | |
CVE-2026-118500 |
medium | 6.4 | 0.0022 | 2026-10-30 | The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulner |