Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 351–375 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-115709 | HIGH | Patched | 8.2 | 2026-10-29 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to … |
| CVE-2026-115708 | HIGH | Patched | 7.2 | 2026-10-29 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the … |
| CVE-2026-115707 | MEDIUM | Patched | 6.4 | 2026-10-29 | Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Em… |
| CVE-2026-115706 | MEDIUM | Patched | 6.8 | 2026-10-29 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker w… |
| CVE-2026-115610 | MEDIUM | 6.5 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored X… | |
| CVE-2026-115605 | MEDIUM | 4.3 | 2026-10-29 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDas… | |
| CVE-2026-115601 | MEDIUM | 5.3 | 2026-10-29 | Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Le… | |
| CVE-2026-114706 | MEDIUM | 6.5 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.Thi… | |
| CVE-2026-114181 | MEDIUM | 5.3 | 2026-10-29 | Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Contro… | |
| CVE-2026-110881 | MEDIUM | 6.5 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affect… | |
| CVE-2026-107024 | NONE | — | 2026-10-29 | Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL. | |
| CVE-2026-107023 | NONE | — | 2026-10-29 | Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content. | |
| CVE-2026-107021 | NONE | — | 2026-10-29 | Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards… | |
| CVE-2026-107020 | HIGH | 7.5 | 2026-10-29 | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL. | |
| CVE-2026-107019 | NONE | — | 2026-10-29 | Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time ent… | |
| CVE-2026-107018 | NONE | — | 2026-10-29 | Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage. | |
| CVE-2026-107017 | NONE | — | 2026-10-29 | Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured auto… | |
| CVE-2026-107016 | NONE | — | 2026-10-29 | Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. | |
| CVE-2026-107015 | CRITICAL | 9.1 | 2026-10-29 | Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database. | |
| CVE-2026-107014 | NONE | — | 2026-10-29 | Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database. | |
| CVE-2026-93010 | MEDIUM | 4.3 | 2026-10-29 | A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local net… | |
| CVE-2026-93009 | MEDIUM | 4.3 | 2026-10-29 | A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confir… | |
| CVE-2026-79589 | NONE | — | 2026-10-29 | The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerabili… | |
| CVE-2026-54862 | MEDIUM | 6.5 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-… | |
| CVE-2026-48202 | MEDIUM | 5.3 | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brav… |