Search
17,425 CVEs
EOL hidden · Show all products
CVEs (17,425, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 17,425 (capped at 500)
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2010-20125 | HIGH | Patched | 7.5 | 2026-10-30 | DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating… |
| CVE-2012-20002 | HIGH | Patched | 7.5 | 2026-10-20 | TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the hr… |
| CVE-2012-20003 | MEDIUM | Patched | 6.1 | 2026-10-20 | Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the … |
| CVE-2012-20004 | MEDIUM | Patched | 6.1 | 2026-10-20 | K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanit… |
| CVE-2012-20005 | MEDIUM | 6.1 | 2026-10-20 | SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the unsanit… | |
| CVE-2012-20006 | NONE | — | 2026-10-26 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2013-10076 | HIGH | Patched | 7.5 | 2026-10-10 | ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, … |
| CVE-2013-10077 | MEDIUM | 5.3 | 2026-10-26 | A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler.… | |
| CVE-2013-20007 | HIGH | 7.2 | 2026-10-28 | Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input… | |
| CVE-2013-20008 | HIGH | 6.8 | 2026-10-28 | Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password.… | |
| CVE-2013-20009 | MEDIUM | 4.8 | 2026-10-28 | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in … | |
| CVE-2014-125130 | HIGH | 7.5 | 2026-10-02 | CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remo… | |
| CVE-2014-125131 | MEDIUM | 6.1 | 2026-10-20 | DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adm… | |
| CVE-2014-125132 | MEDIUM | Patched | 6.1 | 2026-10-20 | Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the '… |
| CVE-2014-125133 | HIGH | Patched | 7.5 | 2026-10-20 | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file par… |
| CVE-2014-125134 | HIGH | Patched | 7.5 | 2026-10-20 | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parame… |
| CVE-2014-125135 | MEDIUM | 7.3 | 2026-10-26 | A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to u… | |
| CVE-2014-125136 | HIGH | 5.9 | 2026-10-28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backup… | |
| CVE-2014-125137 | HIGH | 6.5 | 2026-10-28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/t… | |
| CVE-2014-125138 | HIGH | 8.8 | 2026-10-28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fi… | |
| CVE-2015-20123 | HIGH | Patched | 7.5 | 2026-10-20 | Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing uns… |
| CVE-2015-20124 | HIGH | Patched | 7.5 | 2026-10-20 | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the… |
| CVE-2015-20125 | HIGH | Patched | 7.5 | 2026-10-20 | Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized … |
| CVE-2015-20128 | HIGH | 8.2 | 2026-10-20 | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attacke… | |
| CVE-2015-20129 | HIGH | Patched | 8.8 | 2026-10-28 | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by def… |