Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 545 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97860 | HIGH | 6.7 | 2026-10-29 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able… | |
| CVE-2026-97854 | CRITICAL | 9.8 | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a speciall… | |
| CVE-2026-97073 | MEDIUM | 5.3 | 2026-10-29 | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a thro… | |
| CVE-2026-96767 | HIGH | 7.2 | 2026-10-29 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and in… | |
| CVE-2026-96741 | HIGH | 7.2 | 2026-10-29 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, … | |
| CVE-2026-96669 | HIGH | 7.2 | 2026-10-29 | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and includ… | |
| CVE-2026-96666 | HIGH | 7.2 | 2026-10-29 | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up… | |
| CVE-2026-96228 | HIGH | 8.1 | 2026-10-29 | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler r… | |
| CVE-2026-96203 | HIGH | 8.8 | 2026-10-29 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-96199 | HIGH | 8.8 | 2026-10-29 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96198 | HIGH | 8.8 | 2026-10-29 | Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96196 | HIGH | 8.8 | 2026-10-29 | Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-96192 | HIGH | 8.8 | 2026-10-29 | Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-96187 | HIGH | 7.4 | 2026-10-29 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-9536 | HIGH | 7.5 | 2026-10-29 | A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead… | |
| CVE-2026-9535 | HIGH | 8.2 | 2026-10-29 | A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds… | |
| CVE-2026-93904 | HIGH | 7.5 | 2026-10-29 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in al… | |
| CVE-2026-93855 | HIGH | 7.5 | 2026-10-29 | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 du… | |
| CVE-2026-93757 | HIGH | 7.5 | 2026-10-29 | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. Whe… | |
| CVE-2026-93680 | CRITICAL | Patched | 9.8 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. |
| CVE-2026-93571 | LOW | Patched | — | 2026-10-29 | Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file … |
| CVE-2026-93570 | HIGH | Patched | — | 2026-10-29 | Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external… |
| CVE-2026-93293 | MEDIUM | 6.4 | 2026-10-29 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, a… | |
| CVE-2026-93011 | MEDIUM | 5.3 | 2026-10-29 | A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to … | |
| CVE-2026-93010 | MEDIUM | 4.3 | 2026-10-29 | A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local net… |