Search
16,921 CVEs · High severity
CVEs (16,921, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 226–250 of 16,921 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2022-51024 | HIGH | Patched | 7.5 | 2026-10-22 | Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filena… |
| CVE-2022-51023 | HIGH | Patched | 8.2 | 2026-10-22 | PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers … |
| CVE-2022-51022 | HIGH | Patched | 9.1 | 2026-10-22 | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers… |
| CVE-2022-51021 | HIGH | Patched | 8.2 | 2026-10-22 | NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries b… |
| CVE-2021-48017 | HIGH | Patched | 7.5 | 2026-10-22 | OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Atta… |
| CVE-2021-48015 | HIGH | 7.5 | 2026-10-22 | JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attacke… | |
| CVE-2021-48013 | HIGH | 7.5 | 2026-10-22 | Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.File… | |
| CVE-2019-25779 | HIGH | 7.5 | 2026-10-22 | WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.… | |
| CVE-2019-25778 | HIGH | 8.2 | 2026-10-22 | SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] … | |
| CVE-2018-25439 | HIGH | Patched | 7.5 | 2026-10-22 | MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir param… |
| CVE-2018-25438 | HIGH | Patched | 7.5 | 2026-10-22 | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by m… |
| CVE-2017-20289 | HIGH | Patched | 7.5 | 2026-10-22 | Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP … |
| CVE-2017-20287 | HIGH | Patched | 7.5 | 2026-10-22 | Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the… |
| CVE-2026-112085 | HIGH | Patched | 8.2 | 2026-10-22 | webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0, when a proxy entry is configure… |
| CVE-2026-93471 | HIGH | — | 2026-10-22 | Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust server memory and crash the… | |
| CVE-2026-86696 | HIGH | — | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and cras… | |
| CVE-2026-115253 | HIGH | — | 2026-10-22 | An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to,… | |
| CVE-2026-112379 | HIGH | 7.1 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.… | |
| CVE-2026-112312 | HIGH | 7.5 | 2026-10-22 | Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF… | |
| CVE-2026-112242 | HIGH | 8.8 | 2026-10-22 | Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4. | |
| CVE-2026-111851 | HIGH | 7.6 | 2026-10-22 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Code Inject… | |
| CVE-2026-111830 | HIGH | 7.1 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affec… | |
| CVE-2026-114177 | HIGH | 8.8 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addo… | |
| CVE-2026-105270 | HIGH | — | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table … | |
| CVE-2026-97328 | HIGH | Patched | 7.5 | 2026-10-22 | The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode… |