Search
6,516 CVEs · High severity
CVEs (6,516, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 101–125 of 6,516 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-75779 | HIGH | — | 2026-10-23 | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker t… | |
| CVE-2026-75775 | HIGH | — | 2026-10-23 | Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted … | |
| CVE-2026-94268 | HIGH | Patched | 8.1 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of th… |
| CVE-2026-94262 | HIGH | Patched | 8.1 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requeste… |
| CVE-2026-113500 | HIGH | Patched | 7.5 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an att… |
| CVE-2026-113499 | HIGH | Patched | 7.5 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attri… |
| CVE-2026-111982 | HIGH | Patched | 7.2 | 2026-10-23 | The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, … |
| CVE-2026-109936 | HIGH | Patched | 7.5 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can … |
| CVE-2026-107858 | HIGH | Patched | — | 2026-10-23 | Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Age… |
| CVE-2026-86055 | HIGH | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emai… |
| CVE-2026-115497 | HIGH | 7.5 | 2026-10-23 | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter.… | |
| CVE-2026-109198 | HIGH | 7.2 | 2026-10-23 | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all version… | |
| CVE-2026-115546 | HIGH | 8.1 | 2026-10-23 | Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication so… | |
| CVE-2026-19678 | HIGH | — | 2026-10-23 | A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to acce… | |
| CVE-2026-115486 | HIGH | 7.1 | 2026-10-23 | A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the pa… | |
| CVE-2026-115484 | HIGH | 7.6 | 2026-10-23 | A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allo… | |
| CVE-2026-92450 | HIGH | 7.5 | 2026-10-22 | The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within… | |
| CVE-2026-110825 | HIGH | 7.5 | 2026-10-22 | The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regard… | |
| CVE-2026-96616 | HIGH | 6.5 | 2026-10-22 | Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them … | |
| CVE-2026-96185 | HIGH | 7.5 | 2026-10-22 | Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network. | |
| CVE-2026-114616 | HIGH | Patched | 7.4 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-… |
| CVE-2026-114615 | HIGH | Patched | 7.4 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while… |
| CVE-2026-108456 | HIGH | 7.7 | 2026-10-22 | Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-115419 | HIGH | Patched | 8.1 | 2026-10-22 | The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversat… |
| CVE-2026-115417 | HIGH | Patched | 7.5 | 2026-10-22 | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0.16.2 might allow a remote actor to cause a denial of service … |