Search
151,644 CVEs · High severity
CVEs (151,644, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 251–275 of 151,644 (capped at 500)
| CVE ID | Severity ↓ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111958 | HIGH | Patched | 7.5 | 2026-10-22 | The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that obtains a valid token is authent… |
| CVE-2026-109927 | HIGH | Patched | 7.2 | 2026-10-22 | The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user role, allowing a user who alread… |
| CVE-2026-109987 | HIGH | Patched | 7.2 | 2026-10-22 | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value before printing it into the pa… |
| CVE-2026-114730 | HIGH | Patched | 7.2 | 2026-10-22 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_loca… |
| CVE-2026-110353 | HIGH | Patched | 7.5 | 2026-10-22 | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_… |
| CVE-2026-110354 | HIGH | Patched | 7.5 | 2026-10-22 | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Alth… |
| CVE-2026-96365 | HIGH | 7.5 | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12,… | |
| CVE-2026-114724 | HIGH | Patched | 7.4 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated a… |
| CVE-2026-114727 | HIGH | Patched | 8.3 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image typ… |
| CVE-2026-114716 | HIGH | Patched | 8.5 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type ta… |
| CVE-2026-114720 | HIGH | Patched | 7.1 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF seq… |
| CVE-2026-114660 | HIGH | Patched | 6.3 | 2026-10-22 | Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object m… |
| CVE-2026-114662 | HIGH | Patched | 8.1 | 2026-10-22 | Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request I… |
| CVE-2026-114663 | HIGH | 8.4 | 2026-10-22 | Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using fun… | |
| CVE-2026-114664 | HIGH | Patched | 7.1 | 2026-10-22 | Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize us… |
| CVE-2026-114642 | HIGH | Patched | 8.7 | 2026-10-22 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one servi… |
| CVE-2026-114658 | HIGH | Patched | 8.8 | 2026-10-22 | Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. A… |
| CVE-2026-114659 | HIGH | Patched | 6.5 | 2026-10-22 | Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pag… |
| CVE-2026-114637 | HIGH | 8.7 | 2026-10-22 | Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenti… | |
| CVE-2026-114638 | HIGH | 8.7 | 2026-10-22 | Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names c… | |
| CVE-2026-114639 | HIGH | Patched | 8.7 | 2026-10-22 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token auth… |
| CVE-2026-114640 | HIGH | 8.7 | 2026-10-22 | Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* heade… | |
| CVE-2026-114635 | HIGH | 8.7 | 2026-10-22 | Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated client… | |
| CVE-2026-114636 | HIGH | 8.7 | 2026-10-22 | Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on … | |
| CVE-2026-114633 | HIGH | Patched | 6.5 | 2026-10-22 | WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers… |