Search
16,949 CVEs
CVEs (16,949, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 476–500 of 16,949 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-78802 | CRITICAL | 9.8 | 2026-10-13 | An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. | |
| CVE-2024-34320 | CRITICAL | 9.8 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. | |
| CVE-2026-53709 | CRITICAL | Patched | 9.8 | 2026-10-13 | MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token()… |
| CVE-2026-87689 | CRITICAL | Patched | 9.8 | 2026-10-13 | The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servl… |
| CVE-2026-90920 | CRITICAL | 9.8 | 2026-10-12 | IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | |
| CVE-2026-109566 | CRITICAL | Patched | 9.8 | 2026-10-12 | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an Auth… |
| CVE-2025-71429 | CRITICAL | 9.8 | 2026-10-12 | GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output fol… | |
| CVE-2026-109575 | CRITICAL | Patched | 9.8 | 2026-10-12 | In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly… |
| CVE-2026-57118 | CRITICAL | Patched | 9.8 | 2026-10-12 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{… |
| CVE-2026-84286 | CRITICAL | 9.8 | 2026-10-12 | ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force… | |
| CVE-2026-109390 | CRITICAL | Patched | 9.8 | 2026-10-12 | AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as r… |
| CVE-2026-66086 | CRITICAL | 9.8 | 2026-10-12 | In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote cod… | |
| CVE-2026-84253 | CRITICAL | 9.8 | 2026-10-11 | The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not en… | |
| CVE-2026-84254 | CRITICAL | 9.8 | 2026-10-11 | The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not e… | |
| CVE-2026-84734 | CRITICAL | 9.8 | 2026-10-11 | The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating t… | |
| CVE-2026-84737 | CRITICAL | 9.8 | 2026-10-11 | The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as an… | |
| CVE-2026-85118 | CRITICAL | 9.8 | 2026-10-11 | The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users t… | |
| CVE-2026-84251 | CRITICAL | 9.8 | 2026-10-11 | The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensu… | |
| CVE-2026-84252 | CRITICAL | 9.8 | 2026-10-11 | The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure t… | |
| CVE-2026-104028 | CRITICAL | 9.8 | 2026-10-11 | The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied cont… | |
| CVE-2026-108707 | CRITICAL | 9.8 | 2026-10-11 | Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omi… | |
| CVE-2026-78533 | CRITICAL | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | |
| CVE-2026-78535 | CRITICAL | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | |
| CVE-2026-81797 | CRITICAL | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | |
| CVE-2026-66567 | CRITICAL | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. |