Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-79822 | 7.1 High | HPE NonStop TNS/X Native Inspect - Execution flow vulnerability | Oct 15, 2026 |
| CVE-2026-101302 | 6.5 Medium | Remote DoS via receive-side kernel TLS | Oct 15, 2026 |
| CVE-2026-110934 | 4.4 Medium | Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa. | Oct 15, 2026 |
| CVE-2026-110933 | 4.4 Medium | Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before fb10a5c8b833df7f152d4a563a61d6090a1790d7. | Oct 15, 2026 |
| CVE-2026-101306 | 9.8 Critical | Multiple jail filesystem root escapes | Oct 15, 2026 |
| CVE-2026-101305 | 8.8 High | Multiple jail filesystem root escapes | Oct 15, 2026 |
| CVE-2026-101304 | 7.1 High | Multiple jail filesystem root escapes | Oct 15, 2026 |
| CVE-2026-81534 | 8.8 High | Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter | Oct 15, 2026 |
| CVE-2026-11905 | 4.3 Medium | Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters | Oct 15, 2026 |
| CVE-2026-92429 | 5.3 Medium | Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook | Oct 15, 2026 |
| CVE-2026-92428 | 5.3 Medium | Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook | Oct 15, 2026 |
| CVE-2026-103324 | 5.3 Medium | Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret | Oct 15, 2026 |
| CVE-2026-79821 | 8.2 High | HPE NonStop SOAP 4.0 - Memory corruption | Oct 15, 2026 |
| CVE-2026-76668 | 6.3 Medium | HPE NonStop Kernel - Access to unmapped or privileged data | Oct 15, 2026 |
| CVE-2026-58100 | 7.0 High | Memory safety bugs in kqueue copy-on-fork implementation | Oct 15, 2026 |
| CVE-2026-58099 | 7.0 High | Memory safety bugs in kqueue copy-on-fork implementation | Oct 15, 2026 |
| CVE-2026-58098 | 8.4 High | Heap out-of-bounds access in semop(2) | Oct 15, 2026 |
| CVE-2026-96537 | 7.5 High | Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite | Oct 15, 2026 |
| CVE-2026-74920 | 7.1 High | Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute | Oct 15, 2026 |
| CVE-2026-109145 | 9.8 Critical | User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler | Oct 15, 2026 |
| CVE-2026-106031 | 6.5 Medium | Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result | Oct 15, 2026 |
| CVE-2026-104643 | 4.2 Medium | Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite | Oct 15, 2026 |
| CVE-2026-103304 | 5.3 Medium | eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update | Oct 15, 2026 |
| CVE-2026-78087 | 6.4 Medium | VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature | Oct 15, 2026 |
| CVE-2026-15090 | 7.5 High | Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter | Oct 15, 2026 |
| CVE-2026-15180 | 6.1 Medium | Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages' | Oct 15, 2026 |
| CVE-2026-88043 | 7.2 High | Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter | Oct 15, 2026 |
| CVE-2026-18557 | 6.1 Medium | Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter | Oct 15, 2026 |
| CVE-2026-18548 | 7.2 High | Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter | Oct 15, 2026 |
| CVE-2026-18586 | 7.2 High | Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email' | Oct 15, 2026 |
| CVE-2026-17031 | 8.1 High | Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID | Oct 15, 2026 |
| CVE-2026-17001 | 6.4 Medium | Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields | Oct 15, 2026 |
| CVE-2026-86803 | 6.5 Medium | Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template | Oct 15, 2026 |
| CVE-2026-78001 | 6.4 Medium | Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute | Oct 15, 2026 |
| CVE-2026-76667 | 5.7 Medium | HPE NonStop EXPAND - Out-of-Bounds memory read vulnerability | Oct 15, 2026 |
| CVE-2026-76666 | 4.7 Medium | HPE NonStop EXPAND - Out-of-Bounds memory read | Oct 15, 2026 |
| CVE-2026-76665 | 7.1 High | HPE NonStop EXPAND - Buffer Overflow vulnerability | Oct 15, 2026 |
| CVE-2026-14572 | 6.4 Medium | Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content | Oct 15, 2026 |
| CVE-2026-108587 | 9.8 Critical | 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter | Oct 15, 2026 |
| CVE-2026-3712 | 7.3 High | PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter | Oct 15, 2026 |
| CVE-2026-76664 | 6.4 Medium | HPE NonStop EXPAND - Out-of-Bounds memory read/write | Oct 15, 2026 |
| CVE-2026-93484 | 8.6 High | Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary… | Oct 15, 2026 |
| CVE-2026-93483 | 9.5 Critical | In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this… | Oct 15, 2026 |
| CVE-2026-110912 | 7.1 High | In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP… | Oct 15, 2026 |
| CVE-2026-110911 | 9.8 Critical | Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value),… | Oct 15, 2026 |
| CVE-2026-110909 | 5.0 Medium | Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code… | Oct 15, 2026 |
| CVE-2026-110908 | 8.8 High | Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a… | Oct 15, 2026 |
| CVE-2026-76663 | 7.5 High | HPE NonStop TELSERV - Memory corruption vulnerability | Oct 15, 2026 |
| CVE-2026-76662 | 5.9 Medium | HPE NonStop TELSERV - Memory corruption vulnerability | Oct 15, 2026 |
| CVE-2026-110907 | 7.5 High | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for… | Oct 15, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.