Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-84295 | CRITICAL | 10.0 | 2026-10-29 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensi… | |
| CVE-2026-61991 | CRITICAL | 10.0 | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | |
| CVE-2026-90868 | CRITICAL | 9.9 | 2026-10-29 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under ce… | |
| CVE-2026-119145 | CRITICAL | Patched | 9.9 | 2026-10-29 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before wr… |
| CVE-2026-107327 | CRITICAL | Patched | 9.9 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization. |
| CVE-2026-107328 | CRITICAL | Patched | 9.9 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec. |
| CVE-2026-107329 | CRITICAL | Patched | 9.9 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation. |
| CVE-2026-113617 | CRITICAL | Patched | 9.9 | 2026-10-29 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users wit… |
| CVE-2026-107058 | CRITICAL | 9.8 | 2026-10-29 | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state. | |
| CVE-2026-93680 | CRITICAL | Patched | 9.8 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. |
| CVE-2026-62013 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |
| CVE-2026-62014 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | |
| CVE-2026-62015 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | |
| CVE-2026-62016 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
| CVE-2026-62017 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | |
| CVE-2026-62018 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | |
| CVE-2026-62131 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | |
| CVE-2026-62004 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | |
| CVE-2026-62005 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | |
| CVE-2026-62006 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | |
| CVE-2026-62008 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | |
| CVE-2026-62009 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | |
| CVE-2026-62010 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | |
| CVE-2026-62011 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | |
| CVE-2026-62012 | CRITICAL | 9.8 | 2026-10-29 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. |