Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,118 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-116366 | 9.5 Critical | Unauthenticated RCE vulnerability against ClickHouse Server | Oct 30, 2026 |
| CVE-2026-22110 | 8.7 High | Missing authentication check on POST/PUT requests | Oct 30, 2026 |
| CVE-2026-22105 | 8.7 High | Use of default password based on serial number | Oct 30, 2026 |
| CVE-2026-22109 | 8.4 High | Default WebUI passwords stored in plaintext | Oct 30, 2026 |
| CVE-2026-22114 | 5.3 Medium | Missing brute-force protection for web interface | Oct 30, 2026 |
| CVE-2025-31704 | 9.8 Critical | Dahua Intelligent Connection Center command injection | Oct 30, 2026 |
| CVE-2026-85268 | 8.7 High | Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID | Oct 30, 2026 |
| CVE-2026-14467 | 8.2 High | Display of information in the Forocoches comments editor | Oct 30, 2026 |
| CVE-2026-97209 | 5.4 Medium | Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build | Oct 30, 2026 |
| CVE-2026-115274 | 6.9 Medium | Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir | Oct 30, 2026 |
| CVE-2026-109821 | 6.3 Medium | Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir | Oct 30, 2026 |
| CVE-2026-59387 | 8.8 High | Broken access control restriction in Cloud Controller API | Oct 30, 2026 |
| CVE-2026-59385 | 2.7 Low | Space Developer can extract space-scoped broker credentials | Oct 30, 2026 |
| CVE-2026-59388 | 6.5 Medium | Cloud Controller exposes secrets in audit log | Oct 30, 2026 |
| CVE-2026-59386 | 6.5 Medium | Credential exposure to space supporter | Oct 30, 2026 |
| CVE-2026-64618 | Not scored | Apache Fineract: SQL injection vulnerability in Search API | Oct 30, 2026 |
| CVE-2026-59396 | 6.9 Medium | DoS Vulnerability in UAA Related to JWKS URI Handling | Oct 30, 2026 |
| CVE-2026-115456 | 3.7 Low | Gcc: out-of-bounds read in std::from_chars | Oct 30, 2026 |
| CVE-2026-65874 | Not scored | Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints | Oct 30, 2026 |
| CVE-2026-82104 | 9.4 Critical | API permission bypass via logic bug | Oct 30, 2026 |
| CVE-2026-115455 | 6.5 Medium | Gcc: stack overflow in std::bitset on libstdc++ | Oct 30, 2026 |
| CVE-2026-114691 | 5.9 Medium | Gcc: integer wrap in `std | Oct 30, 2026 |
| CVE-2026-114690 | 6.2 Medium | Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std | Oct 30, 2026 |
| CVE-2026-103039 | 9.8 Critical | Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field | Oct 30, 2026 |
| CVE-2026-110732 | 7.5 High | AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration | Oct 30, 2026 |
| CVE-2026-116622 | 7.2 High | Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie | Oct 30, 2026 |
| CVE-2026-97645 | 7.2 High | Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field | Oct 30, 2026 |
| CVE-2026-89435 | 8.8 High | Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter | Oct 30, 2026 |
| CVE-2026-90437 | 7.2 High | Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values | Oct 30, 2026 |
| CVE-2026-118593 | 5.9 Medium | Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099) | Oct 30, 2026 |
| CVE-2026-118952 | 6.5 Medium | Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules | Oct 30, 2026 |
| CVE-2026-118165 | Not scored | Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute | Oct 30, 2026 |
| CVE-2026-118101 | Not scored | BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification | Oct 30, 2026 |
| CVE-2026-118100 | Not scored | BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure | Oct 30, 2026 |
| CVE-2026-118072 | Not scored | Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting | Oct 30, 2026 |
| CVE-2026-118071 | Not scored | Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute | Oct 30, 2026 |
| CVE-2026-117572 | Not scored | WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter | Oct 30, 2026 |
| CVE-2026-117571 | Not scored | WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters | Oct 30, 2026 |
| CVE-2026-115277 | Not scored | WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter | Oct 30, 2026 |
| CVE-2026-114444 | Not scored | Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer | Oct 30, 2026 |
| CVE-2026-114443 | Not scored | Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code | Oct 30, 2026 |
| CVE-2026-114422 | Not scored | Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer | Oct 30, 2026 |
| CVE-2026-119087 | 4.3 Medium | Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter | Oct 30, 2026 |
| CVE-2026-119059 | 4.3 Medium | Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action | Oct 30, 2026 |
| CVE-2026-118634 | 6.4 Medium | Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute | Oct 30, 2026 |
| CVE-2026-118500 | 6.4 Medium | Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter | Oct 30, 2026 |
| CVE-2026-118698 | 6.5 Medium | JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute | Oct 30, 2026 |
| CVE-2026-118194 | 6.5 Medium | Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication | Oct 30, 2026 |
| CVE-2026-5461 | 6.5 Medium | Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata | Oct 30, 2026 |
| CVE-2026-104368 | 8.8 High | Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field | Oct 30, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.