Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 201–225 of 172,839 (capped at 500)
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-114460 | MEDIUM | 5.3 | 2026-10-22 | A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query strin… | |
| CVE-2026-111847 | MEDIUM | 5.4 | 2026-10-22 | Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce allows Exploiting Incorrectly Configured Access Control S… | |
| CVE-2026-112826 | MEDIUM | 5.3 | 2026-10-22 | Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… | |
| CVE-2026-112843 | MEDIUM | 4.3 | 2026-10-22 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… | |
| CVE-2026-112867 | MEDIUM | 6.5 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9. | |
| CVE-2026-114175 | MEDIUM | 5.4 | 2026-10-22 | Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… | |
| CVE-2026-78392 | MEDIUM | Patched | 6.8 | 2026-10-22 | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the… |
| CVE-2026-111971 | MEDIUM | Patched | 6.8 | 2026-10-22 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting th… |
| CVE-2026-111972 | MEDIUM | Patched | 4.9 | 2026-10-22 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing aut… |
| CVE-2026-114570 | MEDIUM | 4.9 | 2026-10-22 | WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. T… | |
| CVE-2026-103234 | MEDIUM | Patched | 4.8 | 2026-10-22 | The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public review form, which is available… |
| CVE-2026-110010 | MEDIUM | Patched | 4.8 | 2026-10-22 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated reque… |
| CVE-2026-100142 | MEDIUM | Patched | 5.3 | 2026-10-22 | The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allow… |
| CVE-2026-114221 | MEDIUM | 7.4 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from… | |
| CVE-2026-114222 | MEDIUM | 6.2 | 2026-10-22 | NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, … | |
| CVE-2026-114223 | MEDIUM | 5.5 | 2026-10-22 | NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwor… | |
| CVE-2026-114729 | MEDIUM | Patched | 5.3 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `fro… |
| CVE-2026-114731 | MEDIUM | Patched | 5.3 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fet… |
| CVE-2026-114732 | MEDIUM | Patched | 6.8 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alia… |
| CVE-2026-96388 | MEDIUM | 5.4 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat applicat… | |
| CVE-2026-96390 | MEDIUM | 4.3 | 2026-10-22 | Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Ch… | |
| CVE-2026-96398 | MEDIUM | 4.3 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | |
| CVE-2026-96377 | MEDIUM | 5.3 | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versi… | |
| CVE-2026-96378 | MEDIUM | 4.3 | 2026-10-22 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affec… | |
| CVE-2026-96380 | MEDIUM | 6.5 | 2026-10-22 | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2. |