Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-39782 | 5.3 Medium | WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-25467 | 5.3 Medium | WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability | Oct 29, 2026 |
| CVE-2026-116399 | 8.8 High | WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability | Oct 29, 2026 |
| CVE-2026-116857 | 6.5 Medium | WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-113697 | 4.8 Medium | Reflected Cross-Site Scripting in BMC Helix Operations Management | Oct 29, 2026 |
| CVE-2026-113696 | 5.3 Medium | Improper Authorization in BMC ITSM SmartIT Change Approvals | Oct 29, 2026 |
| CVE-2026-113695 | 4.8 Medium | Reflected Cross-Site Scripting in BMC ITSM SmartIT | Oct 29, 2026 |
| CVE-2026-93009 | 4.3 Medium | Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder | Oct 29, 2026 |
| CVE-2026-93010 | 4.3 Medium | Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check | Oct 29, 2026 |
| CVE-2026-113694 | 5.3 Medium | Improper Authorization in BMC ITSM SmartIT Attachments | Oct 29, 2026 |
| CVE-2026-113693 | 5.3 Medium | System Account Credential Disclosure in BMC ITSM | Oct 29, 2026 |
| CVE-2026-54862 | 6.5 Medium | WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-113692 | 6.9 Medium | Path Traversal in BMC ITSM | Oct 29, 2026 |
| CVE-2026-119054 | 5.1 Medium | Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url | Oct 29, 2026 |
| CVE-2026-119053 | 6.9 Medium | lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto() | Oct 29, 2026 |
| CVE-2026-119052 | 8.7 High | llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length | Oct 29, 2026 |
| CVE-2026-119051 | 8.2 High | flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys | Oct 29, 2026 |
| CVE-2026-119050 | 9.2 Critical | Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection | Oct 29, 2026 |
| CVE-2026-119049 | 7.2 High | FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming | Oct 29, 2026 |
| CVE-2026-119048 | 2.3 Low | JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module | Oct 29, 2026 |
| CVE-2019-25781 | 8.7 High | Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing | Oct 29, 2026 |
| CVE-2026-42707 | 4.3 Medium | WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-48195 | 6.5 Medium | WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-113691 | 5.1 Medium | Stored Cross-Site Scripting in BMC ITSM Knowledge Articles | Oct 29, 2026 |
| CVE-2026-39741 | 5.3 Medium | WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-48196 | 6.5 Medium | WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-22386 | 4.3 Medium | WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-52709 | 6.5 Medium | WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-113690 | 4.8 Medium | Stored Cross-Site Scripting in BMC ITSM Attachments | Oct 29, 2026 |
| CVE-2026-113689 | 5.1 Medium | Stored Cross-Site Scripting in BMC ITSM Work Notes | Oct 29, 2026 |
| CVE-2026-24533 | 6.5 Medium | WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-42703 | 6.5 Medium | WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-113688 | 5.3 Medium | Server-Side Request Forgery in BMC ITSM SmartIT | Oct 29, 2026 |
| CVE-2026-118087 | 6.5 Medium | WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-118094 | 6.5 Medium | WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-39735 | 6.5 Medium | WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-56056 | 6.5 Medium | WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-118093 | 5.3 Medium | WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-93006 | 6.8 Medium | Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content | Oct 29, 2026 |
| CVE-2026-93007 | 5.3 Medium | Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation | Oct 29, 2026 |
| CVE-2026-93011 | 5.3 Medium | Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms | Oct 29, 2026 |
| CVE-2026-49142 | 8.7 High | OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[] | Oct 29, 2026 |
| CVE-2026-93008 | 6.8 Medium | Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations | Oct 29, 2026 |
| CVE-2026-119028 | 8.7 High | oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values | Oct 29, 2026 |
| CVE-2026-119027 | 7.7 High | oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension | Oct 29, 2026 |
| CVE-2026-109822 | 7.1 High | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker. | Oct 29, 2026 |
| CVE-2026-97854 | 9.3 Critical | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product. | Oct 29, 2026 |
| CVE-2026-103665 | 8.4 High | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may… | Oct 29, 2026 |
| CVE-2026-97860 | 8.4 High | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges. | Oct 29, 2026 |
| CVE-2026-27401 | 5.3 Medium | WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability | Oct 29, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.