Search
6,516 CVEs · High severity
CVEs (6,516, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 76–100 of 6,516 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-112850 | HIGH | 8.1 | 2026-10-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local… | |
| CVE-2026-112849 | HIGH | 7.1 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects… | |
| CVE-2026-56840 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the … |
| CVE-2026-56838 | HIGH | Patched | 7.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller ex… |
| CVE-2026-56837 | HIGH | Patched | 8.6 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_W… |
| CVE-2026-56836 | HIGH | Patched | 8.2 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the re… |
| CVE-2026-56835 | HIGH | Patched | 8.3 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unk… |
| CVE-2026-56834 | HIGH | Patched | 7.5 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ct… |
| CVE-2026-56833 | HIGH | Patched | 7.5 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log… |
| CVE-2026-56832 | HIGH | Patched | 8.8 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any… |
| CVE-2026-115726 | HIGH | 7.8 | 2026-10-23 | Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded wi… | |
| CVE-2026-115723 | HIGH | 7.4 | 2026-10-23 | Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring… | |
| CVE-2026-112904 | HIGH | 8.7 | 2026-10-23 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() fu… | |
| CVE-2026-89320 | HIGH | — | 2026-10-23 | `HmacShaCryptor.Hash` never hashed its input. For any input it returned `HMAC_K("")` — the MAC of the empty message under the key. Every AES-CBC-HMAC JWE produced or verifi… | |
| CVE-2026-25716 | HIGH | Patched | 7.1 | 2026-10-23 | Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unbl… |
| CVE-2026-16762 | HIGH | — | 2026-10-23 | An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application… | |
| CVE-2026-112838 | HIGH | 7.1 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects Vi… | |
| CVE-2026-112837 | HIGH | 8.5 | 2026-10-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue… | |
| CVE-2026-112835 | HIGH | 7.1 | 2026-10-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects… | |
| CVE-2026-112359 | HIGH | 7.5 | 2026-10-23 | Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile… | |
| CVE-2025-30052 | HIGH | — | 2026-10-23 | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker… | |
| CVE-2025-30049 | HIGH | Patched | — | 2026-10-23 | The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions 2026.MS1 and 2026.MS3 |
| CVE-2025-30045 | HIGH | — | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evalu… | |
| CVE-2025-30043 | HIGH | Patched | — | 2026-10-23 | CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthe… |
| CVE-2026-93489 | HIGH | — | 2026-10-23 | Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to p… |