Search
16,949 CVEs
CVEs (16,949, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 16,949 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-96884 | MEDIUM | 6.3 | 2026-09-24 | A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The… | |
| CVE-2026-96891 | CRITICAL | 9.8 | 2026-09-24 | A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the … | |
| CVE-2026-97149 | MEDIUM | Patched | — | 2026-09-24 | In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and pat… |
| CVE-2026-96892 | MEDIUM | 4.3 | 2026-09-24 | A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument … | |
| CVE-2026-96898 | HIGH | 7.3 | 2026-09-24 | A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ued… | |
| CVE-2026-97151 | NONE | Patched | — | 2026-09-24 | mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacke… |
| CVE-2026-97152 | NONE | Patched | — | 2026-09-24 | Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Vers… |
| CVE-2026-97155 | MEDIUM | Patched | 6.5 | 2026-09-24 | Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origin… |
| CVE-2026-14780 | HIGH | — | 2026-09-24 | A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded executio… | |
| CVE-2026-74991 | MEDIUM | Patched | 6.8 | 2026-09-24 | The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing… |
| CVE-2026-80338 | MEDIUM | Patched | 6.8 | 2026-09-24 | The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrar… |
| CVE-2026-80513 | HIGH | Patched | 7.5 | 2026-09-24 | The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authen… |
| CVE-2026-82195 | MEDIUM | Patched | 6.5 | 2026-09-24 | The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing… |
| CVE-2026-82849 | MEDIUM | Patched | 4.3 | 2026-09-24 | The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticate… |
| CVE-2026-82850 | MEDIUM | Patched | 4.3 | 2026-09-24 | The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct a… |
| CVE-2026-84151 | LOW | Patched | 3.5 | 2026-09-24 | The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with … |
| CVE-2026-88843 | HIGH | Patched | 7.2 | 2026-09-24 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing … |
| CVE-2026-88845 | MEDIUM | Patched | 4.3 | 2026-09-24 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any a… |
| CVE-2026-88846 | MEDIUM | Patched | 5.3 | 2026-09-24 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one … |
| CVE-2026-88847 | MEDIUM | Patched | 4.3 | 2026-09-24 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, all… |
| CVE-2026-89002 | MEDIUM | Patched | 6.8 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could… |
| CVE-2026-89004 | LOW | Patched | 2.7 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, all… |
| CVE-2026-89005 | MEDIUM | Patched | 6.8 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which… |
| CVE-2026-93661 | LOW | Patched | 2.7 | 2026-09-24 | The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a us… |
| CVE-2026-93662 | MEDIUM | Patched | 4.3 | 2026-09-24 | The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting … |