Search
545 CVEs · published 2026-10-29 to 2026-10-29
CVEs (545, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 545 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-118585 | LOW | 3.5 | 2026-10-29 | A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affect… | |
| CVE-2026-118586 | MEDIUM | 5.3 | 2026-10-29 | A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results… | |
| CVE-2026-118589 | MEDIUM | 5.3 | 2026-10-29 | A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipul… | |
| CVE-2026-113957 | NONE | Patched | — | 2026-10-29 | An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs… |
| CVE-2026-118590 | MEDIUM | 5.3 | 2026-10-29 | A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the compo… | |
| CVE-2026-21157 | HIGH | — | 2026-10-29 | Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity. | |
| CVE-2026-113387 | HIGH | Patched | 8.6 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat … |
| CVE-2026-113409 | MEDIUM | Patched | 4.8 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modif… |
| CVE-2026-114173 | MEDIUM | Patched | 5.3 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read … |
| CVE-2026-16889 | MEDIUM | Patched | — | 2026-10-29 | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them… |
| CVE-2026-66088 | CRITICAL | Patched | — | 2026-10-29 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of… |
| CVE-2026-66089 | MEDIUM | Patched | — | 2026-10-29 | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbi… |
| CVE-2026-66090 | HIGH | Patched | — | 2026-10-29 | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit c… |
| CVE-2026-66091 | MEDIUM | Patched | — | 2026-10-29 | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies ano… |
| CVE-2026-66092 | MEDIUM | Patched | — | 2026-10-29 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDIT_SYSTEM_… |
| CVE-2026-109516 | CRITICAL | 9.8 | 2026-10-29 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The… | |
| CVE-2026-118426 | MEDIUM | — | 2026-10-29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search. | |
| CVE-2026-40063 | MEDIUM | 5.3 | 2026-10-29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an i… | |
| CVE-2026-42922 | CRITICAL | 9.8 | 2026-10-29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code ex… | |
| CVE-2026-42949 | MEDIUM | 5.6 | 2026-10-29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute privi… | |
| CVE-2026-93757 | HIGH | 7.5 | 2026-10-29 | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. Whe… | |
| CVE-2026-93855 | HIGH | 7.5 | 2026-10-29 | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 du… | |
| CVE-2026-93904 | HIGH | 7.5 | 2026-10-29 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic SQL Injection via the 'exclude_posts' parameter in al… | |
| CVE-2026-96228 | HIGH | 8.1 | 2026-10-29 | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.8.1. The public final_login_ajax_action handler r… | |
| CVE-2026-96666 | HIGH | 7.2 | 2026-10-29 | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter in all versions up… |