Search
1,420 CVEs · High severity
CVEs (1,420, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,420 (capped at 500)
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2012-20002 | HIGH | Patched | 7.5 | 2026-10-20 | TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the hr… |
| CVE-2014-125133 | HIGH | Patched | 7.5 | 2026-10-20 | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file par… |
| CVE-2014-125134 | HIGH | Patched | 7.5 | 2026-10-20 | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parame… |
| CVE-2015-20123 | HIGH | Patched | 7.5 | 2026-10-20 | Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing uns… |
| CVE-2015-20124 | HIGH | Patched | 7.5 | 2026-10-20 | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the… |
| CVE-2015-20125 | HIGH | Patched | 7.5 | 2026-10-20 | Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized … |
| CVE-2015-20128 | HIGH | 8.2 | 2026-10-20 | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attacke… | |
| CVE-2016-20100 | HIGH | Patched | 7.5 | 2026-10-20 | Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the md… |
| CVE-2016-20103 | HIGH | Patched | 7.5 | 2026-10-20 | Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter.… |
| CVE-2016-20104 | HIGH | 7.5 | 2026-10-20 | EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the '… | |
| CVE-2017-20287 | HIGH | Patched | 7.5 | 2026-10-22 | Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the… |
| CVE-2017-20289 | HIGH | Patched | 7.5 | 2026-10-22 | Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP … |
| CVE-2018-25438 | HIGH | Patched | 7.5 | 2026-10-22 | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by m… |
| CVE-2018-25439 | HIGH | Patched | 7.5 | 2026-10-22 | MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir param… |
| CVE-2019-25778 | HIGH | 8.2 | 2026-10-22 | SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] … | |
| CVE-2019-25779 | HIGH | 7.5 | 2026-10-22 | WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.… | |
| CVE-2020-37286 | HIGH | Patched | 6.5 | 2026-10-21 | Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nes… |
| CVE-2020-37287 | HIGH | Patched | 5.9 | 2026-10-21 | Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. C… |
| CVE-2021-48013 | HIGH | 7.5 | 2026-10-22 | Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.File… | |
| CVE-2021-48015 | HIGH | 7.5 | 2026-10-22 | JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attacke… | |
| CVE-2021-48017 | HIGH | Patched | 7.5 | 2026-10-22 | OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Atta… |
| CVE-2021-48018 | HIGH | Patched | 7.4 | 2026-10-21 | Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonre… |
| CVE-2021-48020 | HIGH | Patched | 6.5 | 2026-10-21 | Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays… |
| CVE-2022-51021 | HIGH | Patched | 8.2 | 2026-10-22 | NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries b… |
| CVE-2022-51022 | HIGH | Patched | 9.1 | 2026-10-22 | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers… |