Search
151,644 CVEs · High severity
CVEs (151,644, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 151,644 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97676 | HIGH | Patched | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code,… |
| CVE-2026-97674 | HIGH | Patched | 8.1 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used i… |
| CVE-2026-97673 | HIGH | Patched | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation. |
| CVE-2026-97665 | HIGH | — | 2026-10-15 | A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and pe… | |
| CVE-2026-97663 | HIGH | 7.2 | 2026-10-02 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0… | |
| CVE-2026-97661 | HIGH | 7.2 | 2026-10-01 | The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, … | |
| CVE-2026-97660 | HIGH | 7.2 | 2026-10-03 | The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up … | |
| CVE-2026-97655 | HIGH | Patched | 8.8 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner. |
| CVE-2026-9765 | HIGH | 7.1 | 2026-07-24 | Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are n… | |
| CVE-2026-97646 | HIGH | 7.3 | 2026-09-25 | A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fu… | |
| CVE-2026-97644 | HIGH | 8.8 | 2026-10-03 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to,… | |
| CVE-2026-97641 | HIGH | 7.2 | 2026-10-02 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to i… | |
| CVE-2026-97640 | HIGH | 7.2 | 2026-10-16 | The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Sc… | |
| CVE-2026-97635 | HIGH | Patched | 8.1 | 2026-10-22 | The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces content in the chat interface… |
| CVE-2026-97629 | HIGH | 6.5 | 2026-10-14 | Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to auto… | |
| CVE-2026-97627 | HIGH | 7.2 | 2026-10-20 | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrat… | |
| CVE-2026-9762 | HIGH | Patched | 7.8 | 2026-07-17 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. |
| CVE-2026-97612 | HIGH | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the pre-encapsul… | |
| CVE-2026-97611 | HIGH | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc() retires the… | |
| CVE-2026-97609 | HIGH | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nf_ct_set_timeout() protects the timeout hook d… | |
| CVE-2026-97608 | HIGH | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister loggers before per-net teardown nf_log_syslog and nfnetlink_log unregist… | |
| CVE-2026-97602 | HIGH | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdir_pre_exit() flushes the skbs from incomplete … | |
| CVE-2026-97595 | HIGH | 7.5 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154_subif_f… | |
| CVE-2026-97594 | HIGH | 7.8 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path() reads old_den… | |
| CVE-2026-97589 | HIGH | Patched | 7.0 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_hash_request() o… |