Search
151,644 CVEs · High severity
CVEs (151,644, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 376–400 of 151,644 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114396 | HIGH | 7.1 | 2026-10-21 | Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search … | |
| CVE-2026-114397 | HIGH | 7.4 | 2026-10-21 | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them rem… | |
| CVE-2026-114391 | HIGH | Patched | 7.1 | 2026-10-21 | ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method co… |
| CVE-2026-56386 | HIGH | 7.5 | 2026-10-21 | Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sendi… | |
| CVE-2026-110369 | HIGH | 8.8 | 2026-10-21 | Deserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue affects WordPress Team … | |
| CVE-2026-110370 | HIGH | 8.8 | 2026-10-21 | Deserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects GS Pins for Pinterest:… | |
| CVE-2026-110884 | HIGH | 7.1 | 2026-10-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms live-summary-for-gravity-… | |
| CVE-2026-85683 | HIGH | Patched | 8.8 | 2026-10-21 | The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing … |
| CVE-2026-97206 | HIGH | 7.5 | 2026-10-21 | NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. … | |
| CVE-2026-70386 | HIGH | Patched | — | 2026-10-21 | Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any local… |
| CVE-2026-70387 | HIGH | Patched | — | 2026-10-21 | Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s an… |
| CVE-2026-110938 | HIGH | — | 2026-10-21 | In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handli… | |
| CVE-2026-110899 | HIGH | 7.1 | 2026-10-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affe… | |
| CVE-2026-111074 | HIGH | — | 2026-10-21 | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte lengt… | |
| CVE-2026-111075 | HIGH | — | 2026-10-21 | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset… | |
| CVE-2026-107435 | HIGH | 7.1 | 2026-10-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.Thi… | |
| CVE-2026-85642 | HIGH | Patched | 7.5 | 2026-10-21 | The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verificati… |
| CVE-2026-88784 | HIGH | Patched | 7.5 | 2026-10-21 | The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, an… |
| CVE-2026-92997 | HIGH | Patched | 8.6 | 2026-10-21 | The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allow… |
| CVE-2026-92998 | HIGH | Patched | 8.6 | 2026-10-21 | The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthentica… |
| CVE-2026-79627 | HIGH | Patched | 7.1 | 2026-10-21 | The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-mana… |
| CVE-2026-111574 | HIGH | Patched | 7.5 | 2026-10-21 | The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead de… |
| CVE-2026-111948 | HIGH | Patched | 7.1 | 2026-10-21 | The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading… |
| CVE-2026-111949 | HIGH | Patched | 7.5 | 2026-10-21 | The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configu… |
| CVE-2026-109147 | HIGH | Patched | 7.1 | 2026-10-21 | The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected C… |