Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 476–500 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-7190 | MEDIUM | — | 2026-10-29 | A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where t… | |
| CVE-2026-115303 | LOW | Patched | 3.7 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing e… |
| CVE-2026-114358 | CRITICAL | — | 2026-10-29 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web managemen… | |
| CVE-2026-117174 | NONE | — | 2026-10-29 | Rejected reason: VUL-2026-008368 為先回報之相同問題 | |
| CVE-2025-62841 | HIGH | — | 2026-10-29 | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allo… | |
| CVE-2025-62839 | HIGH | — | 2026-10-29 | An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allo… | |
| CVE-2026-118030 | MEDIUM | 4.2 | 2026-10-29 | A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because t… | |
| CVE-2026-117859 | MEDIUM | 5.4 | 2026-10-29 | A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which… | |
| CVE-2026-117688 | MEDIUM | 5.3 | 2026-10-29 | A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive … | |
| CVE-2026-117627 | MEDIUM | 5.4 | 2026-10-29 | A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific logi… | |
| CVE-2026-117548 | MEDIUM | 6.5 | 2026-10-29 | A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") i… | |
| CVE-2026-93293 | MEDIUM | 6.4 | 2026-10-29 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, a… | |
| CVE-2026-89216 | HIGH | Patched | 8.6 | 2026-10-29 | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to per… |
| CVE-2026-88928 | MEDIUM | Patched | 6.5 | 2026-10-29 | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tok… |
| CVE-2026-86794 | HIGH | Patched | 8.8 | 2026-10-29 | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the … |
| CVE-2026-85007 | LOW | Patched | 3.8 | 2026-10-29 | The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role … |
| CVE-2026-78396 | MEDIUM | Patched | 5.3 | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unau… |
| CVE-2026-78395 | MEDIUM | Patched | 5.3 | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unaut… |
| CVE-2026-19610 | MEDIUM | 6.5 | 2026-10-29 | A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handle… | |
| CVE-2026-15564 | HIGH | 7.4 | 2026-10-29 | Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to cons… | |
| CVE-2026-118905 | HIGH | 7.0 | 2026-10-29 | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed version… | |
| CVE-2026-115302 | MEDIUM | Patched | 5.3 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticat… |
| CVE-2026-115301 | HIGH | Patched | 7.2 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach t… |
| CVE-2026-115300 | MEDIUM | Patched | 4.3 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured f… |
| CVE-2026-115299 | MEDIUM | Patched | 5.4 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's out… |