Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 426–450 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-5698 | MEDIUM | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be exe… | |
| CVE-2026-5697 | MEDIUM | — | 2026-10-29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be exe… | |
| CVE-2026-27401 | MEDIUM | 5.3 | 2026-10-29 | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configur… | |
| CVE-2026-119028 | HIGH | Patched | 8.8 | 2026-10-29 | oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or… |
| CVE-2026-119027 | HIGH | Patched | 7.5 | 2026-10-29 | oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted une… |
| CVE-2026-119025 | HIGH | Patched | 7.5 | 2026-10-29 | open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attac… |
| CVE-2026-115821 | HIGH | 7.2 | 2026-10-29 | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and includ… | |
| CVE-2026-110184 | HIGH | 7.5 | 2026-10-29 | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on … | |
| CVE-2026-109822 | HIGH | 6.5 | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONF… | |
| CVE-2026-109216 | MEDIUM | 4.9 | 2026-10-29 | The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'profile_background[<attacker-chosen key>]' parame… | |
| CVE-2026-103665 | HIGH | 7.8 | 2026-10-29 | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a direc… | |
| CVE-2026-71569 | MEDIUM | Patched | 4.8 | 2026-10-29 | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classi… |
| CVE-2026-33924 | HIGH | 7.2 | 2026-10-29 | Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker … | |
| CVE-2026-33923 | HIGH | 7.2 | 2026-10-29 | A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker wit… | |
| CVE-2026-118989 | MEDIUM | Patched | 5.5 | 2026-10-29 | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager use… |
| CVE-2026-118984 | HIGH | Patched | 5.5 | 2026-10-29 | OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change t… |
| CVE-2026-116409 | HIGH | 7.1 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-of… | |
| CVE-2026-115967 | HIGH | 8.8 | 2026-10-29 | Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication Abuse.This issue affects Login with phone number: fr… | |
| CVE-2026-115965 | HIGH | 8.5 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue… | |
| CVE-2026-115964 | CRITICAL | 9.3 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows… | |
| CVE-2026-115963 | HIGH | 7.1 | 2026-10-29 | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-115962 | MEDIUM | 4.3 | 2026-10-29 | Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects myCred: from n/a through 4.0.1. | |
| CVE-2026-115942 | NONE | Patched | — | 2026-10-29 | A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only … |
| CVE-2026-115611 | HIGH | 7.1 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This … | |
| CVE-2026-115599 | HIGH | 7.5 | 2026-10-29 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress… |