Search
1,420 CVEs · High severity
CVEs (1,420, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 1,420 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-111853 | HIGH | Patched | 8.8 | 2026-10-17 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. In… |
| CVE-2026-111854 | HIGH | Patched | 8.1 | 2026-10-17 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to … |
| CVE-2026-111855 | HIGH | Patched | 7.5 | 2026-10-17 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient v… |
| CVE-2026-104734 | HIGH | 7.2 | 2026-10-17 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via d… | |
| CVE-2026-107762 | HIGH | 7.5 | 2026-10-17 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,… | |
| CVE-2026-109208 | HIGH | 7.2 | 2026-10-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_… | |
| CVE-2026-103899 | HIGH | 7.2 | 2026-10-17 | The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, … | |
| CVE-2026-108123 | HIGH | 7.5 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin … | |
| CVE-2026-92798 | HIGH | 8.1 | 2026-10-17 | The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient i… | |
| CVE-2026-96660 | HIGH | 7.2 | 2026-10-17 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPres… | |
| CVE-2026-110384 | HIGH | 7.1 | 2026-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allow… | |
| CVE-2026-100316 | HIGH | 7.2 | 2026-10-17 | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and i… | |
| CVE-2026-111110 | HIGH | 7.2 | 2026-10-17 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all… | |
| CVE-2026-110889 | HIGH | 7.5 | 2026-10-17 | Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects G… | |
| CVE-2026-109701 | HIGH | 7.1 | 2026-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflec… | |
| CVE-2026-111880 | HIGH | Patched | 7.4 | 2026-10-17 | FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated at… |
| CVE-2026-111881 | HIGH | Patched | 7.6 | 2026-10-17 | FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-by… |
| CVE-2026-111882 | HIGH | Patched | 8.1 | 2026-10-17 | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-fac… |
| CVE-2026-111884 | HIGH | Patched | 8.3 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::upd… |
| CVE-2026-111885 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target gro… |
| CVE-2026-111886 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP … |
| CVE-2026-111890 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions w… |
| CVE-2026-111891 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints… |
| CVE-2026-111893 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assig… |
| CVE-2026-111895 | HIGH | Patched | 6.8 | 2026-10-17 | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_u… |