Browse All CVEs
36,804 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-62284 |
high | 8.6 | 0.0050 | 2026-10-30 | OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, th | |
CVE-2026-109213 |
— | — | — | 2026-10-30 | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-11349 | |
CVE-2026-61586 |
high | 8.2 | 0.0036 | 2026-10-30 | Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0 | |
CVE-2026-62298 |
none | — | 0.0050 | 2026-10-30 | mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereferenc | |
CVE-2026-62303 |
medium | 5.9 | 0.0031 | 2026-10-30 | Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `Se | |
CVE-2026-62331 |
high | 8.2 | 0.0078 | 2026-10-30 | praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker i | |
CVE-2026-7003 |
medium | 6.9 | 0.0029 | 2026-10-30 | WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that all | |
CVE-2026-7004 |
medium | 5.1 | 0.0027 | 2026-10-30 | WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scri | |
CVE-2026-7005 |
medium | 5.3 | 0.0012 | 2026-10-30 | WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forger | |
CVE-2025-11537 |
medium | 5.0 | 0.0017 | 2026-10-30 | A flaw was found in Keycloak. When the logging format is configured to a verbose, user-sup | |
CVE-2025-57848 |
medium | 6.4 | 0.0019 | 2026-10-30 | A container privilege escalation flaw was found in certain Container-native Virtualization | |
CVE-2026-90888 |
critical | 9.8 | 0.0032 | 2026-10-30 | Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | |
CVE-2026-94175 |
high | 7.1 | 0.0018 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. | |
CVE-2026-73186 |
high | 8.8 | 0.0039 | 2026-10-30 | Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. | |
CVE-2026-78527 |
high | 8.8 | 0.0037 | 2026-10-30 | Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. | |
CVE-2026-62162 |
high | 8.2 | 0.0037 | 2026-10-30 | Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Claim` branch | |
CVE-2026-62264 |
high | 7.5 | 0.0045 | 2026-10-30 | PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2 | |
CVE-2026-54854 |
medium | 6.3 | 0.0024 | 2026-10-30 | Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | |
CVE-2026-54855 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | |
CVE-2026-48201 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. | |
CVE-2026-54850 |
medium | 6.5 | 0.0036 | 2026-10-30 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. | |
CVE-2026-39786 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. | |
CVE-2026-46560 |
high | 7.5 | 0.0019 | 2026-10-30 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RA | |
CVE-2026-39734 |
high | 7.5 | 0.0046 | 2026-10-30 | Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. | |
CVE-2026-39738 |
critical | 9.8 | 0.0041 | 2026-10-30 | Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing | |
CVE-2026-28160 |
high | 7.1 | 0.0023 | 2026-10-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-39732 |
critical | 9.3 | 0.0032 | 2026-10-30 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | |
CVE-2026-119729 |
medium | 6.5 | 0.0040 | 2026-10-30 | A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variabl | |
CVE-2026-27061 |
medium | 6.5 | 0.0024 | 2026-10-30 | Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | |
CVE-2026-119526 |
critical | 9.8 | 0.0041 | 2026-10-30 | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Inje | |
CVE-2026-119728 |
medium | 6.5 | 0.0033 | 2026-10-30 | A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially | |
CVE-2026-118086 |
high | 8.8 | 0.0036 | 2026-10-30 | Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. | |
CVE-2026-116852 |
critical | 9.1 | 0.0060 | 2026-10-30 | Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. | |
CVE-2026-116401 |
high | 7.5 | 0.0032 | 2026-10-30 | Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. | |
CVE-2026-107868 |
medium | 5.3 | 0.0030 | 2026-10-30 | Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 version | |
CVE-2026-105077 |
high | 7.1 | 0.0023 | 2026-10-30 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. | |
CVE-2026-101363 |
medium | 5.3 | 0.0030 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that | |
CVE-2026-101364 |
medium | 5.4 | 0.0019 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versi | |
CVE-2026-101361 |
medium | 4.2 | 0.0018 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-101362 |
medium | 6.9 | 0.0022 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-66026 |
— | — | — | 2026-10-30 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | |
CVE-2026-101360 |
medium | 5.4 | 0.0022 | 2026-10-30 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are | |
CVE-2026-61845 |
high | 8.9 | 0.0039 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-66025 |
— | — | — | 2026-10-30 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority | |
CVE-2026-61848 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-61846 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-61847 |
medium | 6.3 | 0.0049 | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specificatio | |
CVE-2026-18477 |
medium | 4.4 | 0.0008 | 2026-10-30 | A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' re | |
CVE-2026-118089 |
high | 7.2 | 0.0039 | 2026-10-30 | Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | |
CVE-2026-118090 |
high | 8.8 | 0.0045 | 2026-10-30 | Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. |