Search
151,643 CVEs · High severity
CVEs (151,643, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 426–450 of 151,643 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97240 | HIGH | 7.5 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. | |
| CVE-2026-97237 | HIGH | 7.1 | 2026-09-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affect… | |
| CVE-2026-97235 | HIGH | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | |
| CVE-2026-97231 | HIGH | 7.3 | 2026-09-24 | A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The man… | |
| CVE-2026-97206 | HIGH | 7.5 | 2026-10-21 | NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. … | |
| CVE-2026-97197 | HIGH | 7.5 | 2026-09-30 | Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions. | |
| CVE-2026-97188 | HIGH | Patched | 8.8 | 2026-10-07 | The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, a… |
| CVE-2026-97185 | HIGH | 7.8 | 2026-09-24 | A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-si… | |
| CVE-2026-97182 | HIGH | 7.3 | 2026-09-24 | A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/… | |
| CVE-2026-9717 | HIGH | Patched | 7.2 | 2026-06-25 | CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of commands with eleva… |
| CVE-2026-97162 | HIGH | Patched | 9.8 | 2026-09-26 | Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 |
| CVE-2026-9716 | HIGH | Patched | 7.5 | 2026-06-25 | CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionality unavailable… |
| CVE-2026-97150 | HIGH | 7.2 | 2026-09-30 | When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Ar… | |
| CVE-2026-97147 | HIGH | — | 2026-10-08 | In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. … | |
| CVE-2026-9713 | HIGH | 7.5 | 2026-07-23 | The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed… | |
| CVE-2026-9710 | HIGH | Patched | 7.7 | 2026-06-24 | The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to ever… |
| CVE-2026-9709 | HIGH | Patched | 7.7 | 2026-06-24 | The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of … |
| CVE-2026-97077 | HIGH | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. | |
| CVE-2026-97076 | HIGH | Patched | 7.5 | 2026-10-09 | Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5. |
| CVE-2026-97065 | HIGH | 7.1 | 2026-09-30 | Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. | |
| CVE-2026-97060 | HIGH | 7.2 | 2026-09-25 | X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification… | |
| CVE-2026-97059 | HIGH | 8.2 | 2026-09-24 | DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the … | |
| CVE-2026-97057 | HIGH | 7.5 | 2026-09-24 | redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an exce… | |
| CVE-2026-97055 | HIGH | Patched | 8.1 | 2026-09-24 | SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRE… |
| CVE-2026-97032 | HIGH | 7.5 | 2026-10-08 | HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goro… |