Search
16,920 CVEs · High severity
CVEs (16,920, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 16,920 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-15962 | HIGH | 8.8 | 2026-07-26 | The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted inp… | |
| CVE-2026-63720 | HIGH | 7.5 | 2026-07-26 | datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by… | |
| CVE-2024-14040 | HIGH | 7.8 | 2026-07-26 | In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the… | |
| CVE-2026-17496 | HIGH | Patched | 8.1 | 2026-07-26 | NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, … |
| CVE-2026-17497 | HIGH | Patched | 8.3 | 2026-07-26 | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilitie… |
| CVE-2026-57989 | HIGH | Patched | 7.4 | 2026-07-26 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-57990 | HIGH | 7.4 | 2026-07-26 | Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | |
| CVE-2025-15662 | HIGH | Patched | 8.6 | 2026-07-27 | The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not … |
| CVE-2026-12255 | HIGH | Patched | 8.1 | 2026-07-27 | The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disa… |
| CVE-2026-12493 | HIGH | Patched | 7.5 | 2026-07-27 | The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooComm… |
| CVE-2026-13152 | HIGH | Patched | 8.1 | 2026-07-27 | The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities met… |
| CVE-2026-13726 | HIGH | Patched | 7.1 | 2026-07-27 | The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Ref… |
| CVE-2026-14235 | HIGH | Patched | 7.5 | 2026-07-27 | The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-liv… |
| CVE-2026-9830 | HIGH | Patched | 8.2 | 2026-07-27 | The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespa… |
| CVE-2026-14837 | HIGH | 7.8 | 2026-07-27 | Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verific… | |
| CVE-2026-64531 | HIGH | 7.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as n… | |
| CVE-2026-64532 | HIGH | 7.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateReco… | |
| CVE-2026-64533 | HIGH | 7.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 record… | |
| CVE-2026-64536 | HIGH | 8.1 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over… | |
| CVE-2026-16554 | HIGH | 7.8 | 2026-07-27 | cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wr… | |
| CVE-2026-17523 | HIGH | Patched | 7.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet This patch switches the timer t… |
| CVE-2026-17527 | HIGH | 7.7 | 2026-07-27 | In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting creat… | |
| CVE-2026-41608 | HIGH | Patched | 7.5 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users ar… |
| CVE-2026-43871 | HIGH | Patched | 7.5 | 2026-07-27 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Us… |
| CVE-2026-45112 | HIGH | Patched | 7.5 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are … |