Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,206 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-105420 | 9.4 Critical | Path Traversal in Wing WFTP Server leading to Remote Code Execution | Oct 28, 2026 |
| CVE-2026-59959 | 4.8 Medium | SAIL: WebP decoder division by zero through malformed animated canvas metadata | Oct 28, 2026 |
| CVE-2026-93517 | 8.5 High | X.Org Server GLX RenderLarge Heap Buffer Overflow | Oct 28, 2026 |
| CVE-2026-59185 | 8.5 High | identrail: Cross-tenant GitHub installation binding without ownership verification | Oct 28, 2026 |
| CVE-2026-59179 | 8.3 High | OpenHop: Path Traversal in Flow ID File Operations | Oct 28, 2026 |
| CVE-2026-59177 | 8.8 High | ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces | Oct 28, 2026 |
| CVE-2026-59176 | 7.8 High | Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import | Oct 28, 2026 |
| CVE-2026-59172 | 7.8 High | Joker linter executed project-local .jokerd/linter.* files during linting | Oct 28, 2026 |
| CVE-2026-59164 | 7.1 High | NORA missing cross-user token-management authorization | Oct 28, 2026 |
| CVE-2026-93516 | 5.5 Medium | .Org Server XInput Passive Grab Use-After-Free | Oct 28, 2026 |
| CVE-2026-116391 | 8.8 High | WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability | Oct 28, 2026 |
| CVE-2026-116392 | 7.2 High | WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability | Oct 28, 2026 |
| CVE-2026-116393 | 7.5 High | WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability | Oct 28, 2026 |
| CVE-2026-116404 | 6.5 Medium | WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability | Oct 28, 2026 |
| CVE-2026-111850 | 8.5 High | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability | Oct 28, 2026 |
| CVE-2026-115612 | 7.1 High | WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability | Oct 28, 2026 |
| CVE-2026-115591 | 7.5 High | WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability | Oct 28, 2026 |
| CVE-2026-115593 | 7.1 High | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability | Oct 28, 2026 |
| CVE-2026-115596 | 7.1 High | WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability | Oct 28, 2026 |
| CVE-2026-111411 | 9.3 Critical | WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability | Oct 28, 2026 |
| CVE-2026-115607 | 9.3 Critical | WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability | Oct 28, 2026 |
| CVE-2026-115957 | 6.5 Medium | WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability | Oct 28, 2026 |
| CVE-2026-115606 | 7.1 High | WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability | Oct 28, 2026 |
| CVE-2026-115609 | 7.1 High | WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability | Oct 28, 2026 |
| CVE-2026-55369 | 6.5 Medium | Waline login accepts a non-string email as a match-all MongoDB query | Oct 28, 2026 |
| CVE-2026-115904 | 9.6 Critical | Topluyo Desktop for Linux has an OS Command Injection issue | Oct 28, 2026 |
| CVE-2026-93515 | 6.8 Medium | .Org Server Present Extension Use-After-Free | Oct 28, 2026 |
| CVE-2026-21830 | 3.7 Low | HCL BigFix AEX is affected by multiple security vulnerabilities. | Oct 28, 2026 |
| CVE-2026-118037 | 7.5 High | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing | Oct 28, 2026 |
| CVE-2026-118036 | 7.5 High | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering | Oct 28, 2026 |
| CVE-2026-118035 | 7.5 High | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing | Oct 28, 2026 |
| CVE-2026-118040 | 7.5 High | Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing | Oct 28, 2026 |
| CVE-2026-118039 | 7.5 High | XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing | Oct 28, 2026 |
| CVE-2026-118038 | 7.1 High | Path Traversal in Telerik Document Processing Libraries AI Agent Tools | Oct 28, 2026 |
| CVE-2026-67077 | 4.2 Medium | HCL BigFix AEX is affected by multiple security vulnerabilities. | Oct 28, 2026 |
| CVE-2026-67079 | 6.4 Medium | HCL BigFix AEX is affected by multiple security vulnerabilities. | Oct 28, 2026 |
| CVE-2026-67080 | 6.5 Medium | HCL BigFix AEX is affected by multiple security vulnerabilities. | Oct 28, 2026 |
| CVE-2026-67073 | 8.6 High | HCL BigFix AEX is affected by multiple security vulnerabilities. | Oct 28, 2026 |
| CVE-2026-67074 | 9.1 Critical | HCL BigFix AEX is affected by multiple security vulnerabilities. | Oct 28, 2026 |
| CVE-2026-102790 | 8.6 High | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 | Oct 28, 2026 |
| CVE-2026-81472 | 4.2 Medium | Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection')… | Oct 28, 2026 |
| CVE-2026-114278 | 9.8 Critical | Unauthenticated Command Injection via kubeconfig Username in che-machine-exec | Oct 28, 2026 |
| CVE-2026-102799 | 5.3 Medium | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 | Oct 28, 2026 |
| CVE-2026-118485 | 7.0 High | Axel Download Accelerator Path Traversal via URL Filename Decoding | Oct 28, 2026 |
| CVE-2026-116855 | 5.4 Medium | WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability | Oct 28, 2026 |
| CVE-2026-118477 | 8.7 High | KaliFast Project Management Platform ei_git_repo_url OS Command Injection | Oct 28, 2026 |
| CVE-2026-6064 | 7.3 High | Norton, Avast, and AVG local privilege escalation via link following in Data Shredder | Oct 28, 2026 |
| CVE-2026-115223 | 4.9 Medium | Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block | Oct 28, 2026 |
| CVE-2026-110508 | 5.3 Medium | Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification | Oct 28, 2026 |
| CVE-2026-106648 | 5.3 Medium | Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes | Oct 28, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.