Search
16,950 CVEs
CVEs (16,950, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 326–350 of 16,950 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-108709 | CRITICAL | Patched | 9.8 | 2026-10-16 | Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house … |
| CVE-2026-111711 | CRITICAL | 9.8 | 2026-10-16 | Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames … | |
| CVE-2026-111704 | CRITICAL | 9.8 | 2026-10-16 | LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token … | |
| CVE-2026-111708 | CRITICAL | 9.8 | 2026-10-16 | WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST… | |
| CVE-2026-111690 | CRITICAL | 9.8 | 2026-10-16 | Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-… | |
| CVE-2026-111692 | CRITICAL | 9.8 | 2026-10-16 | DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcode… | |
| CVE-2026-111693 | CRITICAL | 9.8 | 2026-10-16 | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the buil… | |
| CVE-2026-111687 | CRITICAL | 9.8 | 2026-10-16 | WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GE… | |
| CVE-2026-111673 | CRITICAL | 9.8 | 2026-10-16 | IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is exc… | |
| CVE-2026-111643 | CRITICAL | 9.8 | 2026-10-16 | Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprot… | |
| CVE-2026-111641 | CRITICAL | 9.8 | 2026-10-16 | FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-l… | |
| CVE-2026-111626 | CRITICAL | 9.8 | 2026-10-16 | Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller autho… | |
| CVE-2026-49868 | CRITICAL | Patched | 9.8 | 2026-10-16 | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/appl… |
| CVE-2026-26846 | CRITICAL | 9.8 | 2026-10-16 | Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component | |
| CVE-2026-107617 | CRITICAL | 9.8 | 2026-10-16 | An attacker can use a hard-coded credential to log in to EseeCloud devices. | |
| CVE-2026-64610 | CRITICAL | Patched | 9.8 | 2026-10-16 | Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache… |
| CVE-2026-64959 | CRITICAL | Patched | 9.8 | 2026-10-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact mos… |
| CVE-2026-104730 | CRITICAL | 9.8 | 2026-10-16 | The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and incl… | |
| CVE-2026-89079 | CRITICAL | 9.8 | 2026-10-16 | The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not pr… | |
| CVE-2026-103768 | CRITICAL | 9.8 | 2026-10-16 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the init… | |
| CVE-2026-109219 | CRITICAL | 9.8 | 2026-10-16 | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validati… | |
| CVE-2026-109515 | CRITICAL | 9.8 | 2026-10-16 | The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,… | |
| CVE-2026-104798 | CRITICAL | 9.8 | 2026-10-16 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET para… | |
| CVE-2026-111444 | CRITICAL | Patched | 9.8 | 2026-10-16 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline… |
| CVE-2026-111329 | CRITICAL | 9.8 | 2026-10-15 | JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090.… |