Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 251–275 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-116869 | HIGH | 7.2 | 2026-10-29 | Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. | |
| CVE-2026-116868 | HIGH | 8.8 | 2026-10-29 | Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. | |
| CVE-2026-116867 | HIGH | 8.8 | 2026-10-29 | Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions. | |
| CVE-2026-116866 | HIGH | 8.8 | 2026-10-29 | Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. | |
| CVE-2026-116865 | HIGH | 7.2 | 2026-10-29 | Editor PHP Object Injection in Zippy <= 1.7.0 versions. | |
| CVE-2026-116864 | HIGH | 7.2 | 2026-10-29 | Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. | |
| CVE-2026-116848 | MEDIUM | 6.5 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite t… | |
| CVE-2026-115795 | MEDIUM | Patched | — | 2026-10-29 | P-Net before 1.0.3 does not check that a complete block header is present in the received data before reading the next block in DCP Set and Identify requests. If the last b… |
| CVE-2026-115794 | LOW | Patched | — | 2026-10-29 | P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against… |
| CVE-2026-115793 | HIGH | Patched | — | 2026-10-29 | P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeat… |
| CVE-2026-114148 | HIGH | 7.8 | 2026-10-29 | Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-113576 | MEDIUM | 6.3 | 2026-10-29 | Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security featur… | |
| CVE-2026-112256 | CRITICAL | — | 2026-10-29 | Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained b… | |
| CVE-2026-112255 | LOW | — | 2026-10-29 | Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Aut… | |
| CVE-2026-112200 | HIGH | Patched | — | 2026-10-29 | P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endi… |
| CVE-2026-111736 | HIGH | Patched | — | 2026-10-29 | P-Net before 1.0.3 dereferences a NULL AR pointer in pf_fspm_cm_read_ind() when handling an implicit read request without a valid target AR UUID for a user specific record … |
| CVE-2026-111735 | HIGH | Patched | — | 2026-10-29 | P-Net before 1.0.3 contains an integer underflow in pf_cpm_c_data_ind(). When handling a received cyclic data frame while the consumer is in the FRUN or RUN state, the offs… |
| CVE-2026-111734 | HIGH | Patched | — | 2026-10-29 | P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN… |
| CVE-2026-111733 | HIGH | Patched | — | 2026-10-29 | P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific … |
| CVE-2026-111732 | CRITICAL | Patched | — | 2026-10-29 | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block defin… |
| CVE-2026-111731 | HIGH | Patched | — | 2026-10-29 | P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced… |
| CVE-2026-111730 | HIGH | Patched | — | 2026-10-29 | P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into t… |
| CVE-2026-110309 | HIGH | Patched | 8.8 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation. |
| CVE-2026-110245 | HIGH | Patched | 7.5 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication. |
| CVE-2026-110244 | HIGH | Patched | 8.8 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted d… |