Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 376–400 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-48195 | MEDIUM | 6.5 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PD… | |
| CVE-2026-42707 | MEDIUM | 4.3 | 2026-10-29 | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.T… | |
| CVE-2026-39782 | MEDIUM | 5.3 | 2026-10-29 | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms… | |
| CVE-2026-39736 | HIGH | 8.5 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affect… | |
| CVE-2026-25467 | MEDIUM | 5.3 | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This iss… | |
| CVE-2026-119054 | MEDIUM | Patched | 5.4 | 2026-10-29 | Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] a… |
| CVE-2026-119053 | MEDIUM | 5.3 | 2026-10-29 | lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of rem… | |
| CVE-2026-119052 | HIGH | 7.5 | 2026-10-29 | llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by se… | |
| CVE-2026-119051 | HIGH | 5.9 | 2026-10-29 | flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. … | |
| CVE-2026-119050 | CRITICAL | 8.1 | 2026-10-29 | Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled func… | |
| CVE-2026-119049 | HIGH | Patched | 7.6 | 2026-10-29 | FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpo… |
| CVE-2026-119048 | LOW | 4.2 | 2026-10-29 | JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' co… | |
| CVE-2026-118425 | MEDIUM | 6.8 | 2026-10-29 | A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured … | |
| CVE-2026-116857 | MEDIUM | 6.5 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This is… | |
| CVE-2026-116402 | MEDIUM | 5.3 | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects… | |
| CVE-2026-116399 | HIGH | 8.8 | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a th… | |
| CVE-2026-113697 | MEDIUM | — | 2026-10-29 | Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's brow… | |
| CVE-2026-113696 | MEDIUM | — | 2026-10-29 | Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make u… | |
| CVE-2026-113695 | MEDIUM | — | 2026-10-29 | Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated… | |
| CVE-2026-113694 | MEDIUM | — | 2026-10-29 | Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access… | |
| CVE-2026-113693 | MEDIUM | — | 2026-10-29 | Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated user… | |
| CVE-2026-113692 | MEDIUM | — | 2026-10-29 | Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read … | |
| CVE-2026-113691 | MEDIUM | — | 2026-10-29 | Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to… | |
| CVE-2019-25781 | HIGH | 7.5 | 2026-10-29 | Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched bra… | |
| CVE-2026-93011 | MEDIUM | 5.3 | 2026-10-29 | A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to … |