Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-46708 | 4.3 Medium | EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record | Oct 15, 2026 |
| CVE-2026-79841 | 5.8 Medium | HPE NonStop RDMA SERVICES NSK - Out-of-bounds memory write vulnerability | Oct 15, 2026 |
| CVE-2026-47168 | 9.1 Critical | EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params | Oct 15, 2026 |
| CVE-2026-103509 | 8.5 High | Credential Disclosure in P4 Search Configuration API | Oct 15, 2026 |
| CVE-2026-46694 | 6.5 Medium | EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes | Oct 15, 2026 |
| CVE-2026-79840 | 7.3 High | HPE NonStop XABroker - Memory corruption vulnerability | Oct 15, 2026 |
| CVE-2026-79839 | 7.3 High | HPE NonStop ODBC/MX Server - Memory corruption vulnerability | Oct 15, 2026 |
| CVE-2026-79838 | 7.3 High | HPE NonStop ODBC/MX Services - Memory corruption vulnerability | Oct 15, 2026 |
| CVE-2026-108116 | 7.5 High | MDX and SOAP Injection in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106153 | 5.4 Medium | Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar | Oct 15, 2026 |
| CVE-2026-106151 | 5.4 Medium | Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106150 | 5.4 Medium | Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip | Oct 15, 2026 |
| CVE-2026-106149 | 5.4 Medium | Cross-site Scripting (XSS) in Kendo UI for jQuery Menu | Oct 15, 2026 |
| CVE-2026-110746 | 7.8 High | CVE-2026-110746 | Oct 15, 2026 |
| CVE-2026-103508 | 7.3 High | Path traversal via logging configuration in P4Search | Oct 15, 2026 |
| CVE-2026-9703 | 7.1 High | Viewer role can create, modify and delete Loki alerting rules | Oct 15, 2026 |
| CVE-2026-110936 | 8.4 High | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to… | Oct 15, 2026 |
| CVE-2026-104024 | 4.6 Medium | Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation | Oct 15, 2026 |
| CVE-2026-93649 | 7.5 High | In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query… | Oct 15, 2026 |
| CVE-2026-106148 | 5.4 Medium | Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106147 | 5.4 Medium | Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106161 | 5.4 Medium | Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106160 | 5.4 Medium | Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106159 | 4.7 Medium | Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106158 | 4.7 Medium | Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106157 | 4.7 Medium | Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106162 | 4.7 Medium | Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery | Oct 15, 2026 |
| CVE-2026-106163 | 6.5 Medium | Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser | Oct 15, 2026 |
| CVE-2026-109686 | 9.8 Critical | WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability | Oct 15, 2026 |
| CVE-2026-109685 | 7.1 High | WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability | Oct 15, 2026 |
| CVE-2026-109892 | 9.8 Critical | WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability | Oct 15, 2026 |
| CVE-2026-102389 | 6.5 Medium | WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability | Oct 15, 2026 |
| CVE-2026-105882 | 6.5 Medium | WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability | Oct 15, 2026 |
| CVE-2026-109688 | 9.3 Critical | WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability | Oct 15, 2026 |
| CVE-2026-107416 | 7.5 High | WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability | Oct 15, 2026 |
| CVE-2026-109702 | 7.1 High | WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability | Oct 15, 2026 |
| CVE-2026-88794 | 8.2 High | XML External Entity injection in Sparx Enterprise Architect | Oct 15, 2026 |
| CVE-2026-99999 | 9.3 Critical | ipv4: validate checksum_start before completing checksum | Oct 15, 2026 |
| CVE-2026-110723 | 7.5 High | In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the… | Oct 15, 2026 |
| CVE-2026-110724 | 7.5 High | In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the… | Oct 15, 2026 |
| CVE-2026-109698 | 9.3 Critical | WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability | Oct 15, 2026 |
| CVE-2026-109692 | 7.1 High | WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability | Oct 15, 2026 |
| CVE-2026-109693 | 8.8 High | WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability | Oct 15, 2026 |
| CVE-2026-98432 | 9.8 Critical | ipv4: free inet_opt and ireq_opt after an RCU grace period | Oct 15, 2026 |
| CVE-2026-79837 | 7.3 High | HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerability | Oct 15, 2026 |
| CVE-2026-104025 | 8.4 High | Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name | Oct 15, 2026 |
| CVE-2026-110726 | 6.5 Medium | In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the… | Oct 15, 2026 |
| CVE-2026-79836 | 6.4 Medium | HPE NonStop SQL/MX Run-Time Statistics - Information disclosure and DoS vulnerability | Oct 15, 2026 |
| CVE-2026-8145 | 5.4 Medium | WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration' | Oct 15, 2026 |
| CVE-2026-79835 | 2.8 Low | HPE Nonstop KMS Server - Buffer overflow vulnerability | Oct 15, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.