Browse All CVEs
3,297 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-97854 |
critical | 9.8 | — | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command in | |
CVE-2026-115964 |
critical | 9.3 | — | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-105192 |
critical | 9.8 | 0.0077 | 2026-10-29 | 1 PoC | LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ R |
CVE-2026-114358 |
critical | 9.3 | — | 2026-10-29 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation | |
CVE-2025-49794 |
critical | 9.1 | 0.0083 | 2026-10-29 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath | |
CVE-2026-32557 |
critical | 9.3 | 0.0037 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-103693 |
critical | 9.0 | — | 2026-10-29 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before | |
CVE-2026-113616 |
critical | 9.8 | — | 2026-10-29 | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-t | |
CVE-2026-113617 |
critical | 9.9 | — | 2026-10-29 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a us | |
CVE-2026-115245 |
critical | 9.8 | — | 2026-10-29 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploade | |
CVE-2026-109516 |
critical | 9.8 | — | 2026-10-29 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication B | |
CVE-2026-42922 |
critical | 9.8 | — | 2026-10-29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version | |
CVE-2026-74040 |
critical | 9.4 | 0.0072 | 2026-10-29 | Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability | |
CVE-2026-66088 |
critical | 9.4 | — | 2026-10-29 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting eng | |
CVE-2026-87701 |
critical | 9.6 | 0.0079 | 2026-10-29 | Improper neutralization of special elements in output used by a downstream component ('inj | |
CVE-2026-85885 |
critical | 9.9 | 0.0072 | 2026-10-29 | Improper neutralization of special elements used in a command ('command injection') in M36 | |
CVE-2026-85889 |
critical | 10.0 | 0.0067 | 2026-10-29 | Missing authentication for critical function in Azure AI Foundry allows an unauthorized at | |
CVE-2026-83944 |
critical | 10.0 | 0.0044 | 2026-10-29 | Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate pri | |
CVE-2026-83941 |
critical | 9.9 | 0.0078 | 2026-10-29 | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over | |
CVE-2026-77903 |
critical | 9.0 | 0.0037 | 2026-10-29 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker t | |
CVE-2026-70200 |
critical | 10.0 | 0.0060 | 2026-10-29 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Lo | |
CVE-2026-70009 |
critical | 9.3 | 0.0053 | 2026-10-29 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Ar | |
CVE-2026-69865 |
critical | 10.0 | 0.0080 | 2026-10-29 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an | |
CVE-2026-69399 |
critical | 10.0 | 0.0048 | 2026-10-29 | Azure Arc Elevation of Privilege Vulnerability | |
CVE-2026-66302 |
critical | 9.8 | 0.0097 | 2026-10-29 | External control of file name or path in Skype for Business allows an unauthorized attacke | |
CVE-2026-62916 |
critical | 9.1 | 0.0086 | 2026-10-29 | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an u | |
CVE-2026-67631 |
critical | 9.8 | 0.0097 | 2026-10-29 | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code o | |
CVE-2018-25254 |
critical | 9.3 | — | 2026-10-29 | NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability th | |
CVE-2026-109391 |
critical | 9.2 | 0.0048 | 2026-10-29 | Square Squash through commit e73f280 contains an insecure deserialization vulnerability th | |
CVE-2026-105223 |
critical | 9.1 | 0.0020 | 2026-10-29 | maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in par | |
CVE-2026-105216 |
critical | 9.1 | 0.0019 | 2026-10-29 | go-micro before 6.0.0 contains an improper certificate validation vulnerability that allow | |
CVE-2026-105222 |
critical | 9.1 | 0.0019 | 2026-10-29 | The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verif | |
CVE-2020-37281 |
critical | 9.2 | — | 2026-10-29 | Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability th | |
CVE-2026-85614 |
critical | 9.2 | 0.0026 | 2026-10-29 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerabili | |
CVE-2026-63160 |
critical | 9.1 | 0.0033 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remem | |
CVE-2026-63158 |
critical | 9.1 | 0.0041 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability tha | |
CVE-2026-63159 |
critical | 9.1 | 0.0033 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnera | |
CVE-2026-63149 |
critical | 9.1 | 0.0037 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that | |
CVE-2026-63146 |
critical | 9.3 | 0.0066 | 2026-10-29 | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unesc | |
CVE-2025-13590 |
critical | 9.1 | 0.0077 | 2026-10-29 | A malicious actor with administrative privileges can upload an arbitrary file to a user-co | |
CVE-2026-97749 |
critical | 9.8 | 0.0120 | 2026-10-29 | Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code ov | |
CVE-2026-97016 |
critical | 9.8 | 0.0117 | 2026-10-29 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to | |
CVE-2026-96219 |
critical | 9.8 | 0.0089 | 2026-10-29 | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows a | |
CVE-2026-96096 |
critical | 9.8 | 0.0066 | 2026-10-29 | Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to exec | |
CVE-2026-88178 |
critical | 9.8 | 0.0097 | 2026-10-29 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute c | |
CVE-2026-88156 |
critical | 9.8 | 0.0117 | 2026-10-29 | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to | |
CVE-2026-88102 |
critical | 9.8 | 0.0063 | 2026-10-29 | Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code | |
CVE-2026-85818 |
critical | 9.0 | 0.0041 | 2026-10-29 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorize | |
CVE-2026-85814 |
critical | 9.8 | 0.0093 | 2026-10-29 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized at | |
CVE-2026-85809 |
critical | 9.8 | 0.0093 | 2026-10-29 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker |