Search
4,652 CVEs
CVEs (4,652, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 351–375 of 4,652 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-115332 | HIGH | 8.8 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that… | |
| CVE-2026-115328 | HIGH | Patched | 8.8 | 2026-10-22 | JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via Hist… |
| CVE-2026-112242 | HIGH | 8.8 | 2026-10-22 | Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4. | |
| CVE-2026-114177 | HIGH | 8.8 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addo… | |
| CVE-2026-114658 | HIGH | Patched | 8.8 | 2026-10-22 | Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. A… |
| CVE-2026-76530 | HIGH | 8.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a sof… | |
| CVE-2026-76298 | HIGH | 8.8 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser p… | |
| CVE-2026-76291 | HIGH | 8.8 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards i… | |
| CVE-2026-103090 | HIGH | Patched | — | 2026-10-21 | Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus… |
| CVE-2026-114140 | HIGH | Patched | — | 2026-10-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconv… |
| CVE-2026-114142 | HIGH | Patched | — | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString(… |
| CVE-2026-114135 | HIGH | Patched | 8.8 | 2026-10-21 | Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChan… |
| CVE-2026-113870 | HIGH | 8.8 | 2026-10-21 | MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployme… | |
| CVE-2026-92206 | HIGH | 8.8 | 2026-10-21 | CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… | |
| CVE-2026-92207 | HIGH | 8.8 | 2026-10-21 | MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mi… | |
| CVE-2026-92208 | HIGH | 8.8 | 2026-10-21 | NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected in… | |
| CVE-2026-76476 | HIGH | 8.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisc… | |
| CVE-2026-76477 | HIGH | 8.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisc… | |
| CVE-2026-76478 | HIGH | 8.8 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisc… | |
| CVE-2026-113779 | HIGH | 8.8 | 2026-10-21 | The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus firewalls. A privilege escalation vulnerability in pfSense-p… | |
| CVE-2026-110369 | HIGH | 8.8 | 2026-10-21 | Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team … | |
| CVE-2026-110370 | HIGH | 8.8 | 2026-10-21 | Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest:… | |
| CVE-2026-85683 | HIGH | Patched | 8.8 | 2026-10-21 | The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing … |
| CVE-2026-82814 | HIGH | 8.8 | 2026-10-21 | The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via de… | |
| CVE-2026-114107 | HIGH | Patched | 8.8 | 2026-10-21 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting in… |