Search
16,950 CVEs
CVEs (16,950, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 16,950 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-109444 | CRITICAL | 9.8 | 2026-10-20 | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless … | |
| CVE-2026-112779 | CRITICAL | Patched | 9.8 | 2026-10-19 | Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/tran… |
| CVE-2026-112776 | CRITICAL | Patched | 9.8 | 2026-10-19 | Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllow… |
| CVE-2026-109437 | CRITICAL | Patched | 9.8 | 2026-10-19 | Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authe… |
| CVE-2026-111862 | CRITICAL | 9.8 | 2026-10-19 | Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC… | |
| CVE-2026-107083 | CRITICAL | 9.8 | 2026-10-19 | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID. | |
| CVE-2026-111058 | CRITICAL | Patched | 9.8 | 2026-10-19 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to cre… |
| CVE-2026-109432 | CRITICAL | Patched | 9.8 | 2026-10-19 | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query express… |
| CVE-2026-107081 | CRITICAL | 9.8 | 2026-10-19 | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, adm… | |
| CVE-2026-112296 | CRITICAL | 9.8 | 2026-10-19 | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms a… | |
| CVE-2026-112292 | CRITICAL | 9.8 | 2026-10-19 | CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase co… | |
| CVE-2026-71253 | CRITICAL | Patched | 9.8 | 2026-10-19 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads & static-initializes an attacker… |
| CVE-2026-90910 | CRITICAL | Patched | 9.8 | 2026-10-19 | Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content… |
| CVE-2026-108983 | CRITICAL | 9.8 | 2026-10-19 | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | |
| CVE-2026-111998 | CRITICAL | 9.8 | 2026-10-18 | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admi… | |
| CVE-2026-110886 | CRITICAL | 9.8 | 2026-10-18 | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversatio… | |
| CVE-2026-110372 | CRITICAL | 9.8 | 2026-10-18 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. | |
| CVE-2026-111911 | CRITICAL | Patched | 9.8 | 2026-10-17 | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication o… |
| CVE-2026-104736 | CRITICAL | 9.8 | 2026-10-17 | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout… | |
| CVE-2026-111823 | CRITICAL | Patched | 9.8 | 2026-10-17 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. |
| CVE-2026-110759 | CRITICAL | Patched | 9.8 | 2026-10-16 | Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends… |
| CVE-2026-110753 | CRITICAL | Patched | 9.8 | 2026-10-16 | Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns… |
| CVE-2026-110756 | CRITICAL | Patched | 9.8 | 2026-10-16 | Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record con… |
| CVE-2026-110757 | CRITICAL | Patched | 9.8 | 2026-10-16 | Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a fi… |
| CVE-2026-68573 | CRITICAL | Patched | 9.8 | 2026-10-16 | Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly expose… |