Search
1,420 CVEs · High severity
CVEs (1,420, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 401–425 of 1,420 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-107506 | HIGH | Patched | 7.5 | 2026-10-21 | The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granti… |
| CVE-2026-107237 | HIGH | Patched | 8.2 | 2026-10-21 | The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live… |
| CVE-2026-107127 | HIGH | Patched | 7.5 | 2026-10-21 | The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the pa… |
| CVE-2026-105262 | HIGH | Patched | 8.0 | 2026-10-21 | The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in use… |
| CVE-2026-102499 | HIGH | Patched | 7.7 | 2026-10-21 | The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using… |
| CVE-2026-82819 | HIGH | Patched | — | 2026-10-21 | A vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By supplying a malicious SMB share… |
| CVE-2026-82814 | HIGH | 8.8 | 2026-10-21 | The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via de… | |
| CVE-2026-114198 | HIGH | Patched | — | 2026-10-21 | Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the f… |
| CVE-2026-114197 | HIGH | Patched | — | 2026-10-21 | Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the c… |
| CVE-2026-114117 | HIGH | 5.9 | 2026-10-21 | Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the… | |
| CVE-2026-114113 | HIGH | Patched | — | 2026-10-21 | Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in… |
| CVE-2026-114112 | HIGH | Patched | — | 2026-10-21 | Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images… |
| CVE-2026-114111 | HIGH | Patched | — | 2026-10-21 | sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to co… |
| CVE-2026-114110 | HIGH | Patched | 5.3 | 2026-10-21 | Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD … |
| CVE-2026-114109 | HIGH | Patched | 8.8 | 2026-10-21 | uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scrip… |
| CVE-2026-114107 | HIGH | Patched | 8.8 | 2026-10-21 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting in… |
| CVE-2026-114106 | HIGH | Patched | 7.5 | 2026-10-21 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read t… |
| CVE-2026-114104 | HIGH | Patched | 5.9 | 2026-10-21 | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate ent… |
| CVE-2026-114102 | HIGH | Patched | 7.5 | 2026-10-21 | adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflate… |
| CVE-2026-114098 | HIGH | Patched | 7.8 | 2026-10-21 | Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through inter… |
| CVE-2026-114097 | HIGH | Patched | 7.8 | 2026-10-21 | Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working dire… |
| CVE-2026-114096 | HIGH | Patched | 7.8 | 2026-10-21 | Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw… |
| CVE-2026-114095 | HIGH | Patched | 6.5 | 2026-10-21 | Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA obje… |
| CVE-2026-114094 | HIGH | Patched | 8.8 | 2026-10-21 | Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious reposi… |
| CVE-2026-114092 | HIGH | Patched | 6.5 | 2026-10-21 | Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and … |