Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,217 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-42689 | 3.7 Low | WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability | Oct 12, 2026 |
| CVE-2026-77363 | 8.8 High | obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access | Oct 12, 2026 |
| CVE-2026-108917 | 10.0 Critical | Edimax BR-6208AC formAutoFWupgrade command injection | Oct 12, 2026 |
| CVE-2026-109448 | 5.9 Medium | psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters | Oct 12, 2026 |
| CVE-2026-108479 | 8.1 High | WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability | Oct 12, 2026 |
| CVE-2026-108481 | 7.4 High | WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability | Oct 12, 2026 |
| CVE-2026-103080 | 5.3 Medium | WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-108916 | 6.9 Medium | Edimax BR-6208AC formAccept command injection | Oct 12, 2026 |
| CVE-2026-6232 | 5.2 Medium | Out-of-bounds write in LR11xx Transceiver | Oct 12, 2026 |
| CVE-2026-108915 | 9.4 Critical | Edimax BR-6208AC formWlanMP buffer overflow | Oct 12, 2026 |
| CVE-2026-108482 | 6.5 Medium | WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability | Oct 12, 2026 |
| CVE-2026-107862 | 6.5 Medium | WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability | Oct 12, 2026 |
| CVE-2026-108486 | 5.3 Medium | WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-107418 | 5.4 Medium | WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-108478 | 6.5 Medium | WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability | Oct 12, 2026 |
| CVE-2026-108475 | 4.3 Medium | WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-108476 | 5.0 Medium | WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-84286 | 9.8 Critical | OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table | Oct 12, 2026 |
| CVE-2026-108914 | 9.4 Critical | Edimax BR-6208AC formWlSiteSurvey buffer overflow | Oct 12, 2026 |
| CVE-2026-85976 | 5.4 Medium | HTTP response splitting in Progress MarkLogic Server Query Console | Oct 12, 2026 |
| CVE-2026-85975 | 7.5 High | Cleartext transmission in Progress MarkLogic Server Amazon S3 connections | Oct 12, 2026 |
| CVE-2026-85974 | 7.4 High | Improper TLS hostname verification in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-85973 | 7.4 High | Cleartext transmission in Progress MarkLogic Server cluster join operations | Oct 12, 2026 |
| CVE-2026-108909 | 5.3 Medium | Netcore NR268 CGI Endpoint cross-site request forgery | Oct 12, 2026 |
| CVE-2026-105274 | 2.1 Low | hex_core decompresses registry and Erlang term API responses without size limits | Oct 12, 2026 |
| CVE-2026-85972 | 7.4 High | Improper Kerberos server verification in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-85971 | 7.1 High | Incorrect log file permissions in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-85970 | 7.1 High | Improper XML external entity restriction in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-85969 | 7.1 High | Out-of-bounds write in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-85968 | 7.1 High | Out-of-bounds read in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-75888 | 7.7 High | Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch | Oct 12, 2026 |
| CVE-2026-85967 | 6.1 Medium | Cross-site scripting in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-108477 | 5.3 Medium | WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-85966 | 7.7 High | Exposure of sensitive information in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-108908 | 4.8 Medium | Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting | Oct 12, 2026 |
| CVE-2026-85965 | 8.0 High | Use-after-free in Progress MarkLogic Server JavaScript engine integration | Oct 12, 2026 |
| CVE-2026-85964 | 7.7 High | Path traversal in Progress MarkLogic Server Query Console | Oct 12, 2026 |
| CVE-2026-85963 | 7.5 High | Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector | Oct 12, 2026 |
| CVE-2026-94451 | 6.5 Medium | Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache | Oct 12, 2026 |
| CVE-2026-108907 | 10.0 Critical | Netcore NR268 CGI Execution user_ok improper authentication | Oct 12, 2026 |
| CVE-2026-85962 | 7.5 High | Improper authentication in Progress MarkLogic Server SAML processing | Oct 12, 2026 |
| CVE-2026-85961 | 7.5 High | Sensitive information exposure in Progress MarkLogic Server Azure deployments | Oct 12, 2026 |
| CVE-2026-85960 | 7.5 High | Cross-site request forgery in Progress MarkLogic Server Query Console | Oct 12, 2026 |
| CVE-2026-85959 | 7.5 High | Insufficient authentication logging in Progress MarkLogic Server | Oct 12, 2026 |
| CVE-2026-109374 | 5.1 Medium | ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation | Oct 12, 2026 |
| CVE-2026-109373 | 9.2 Critical | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie | Oct 12, 2026 |
| CVE-2026-109372 | 9.3 Critical | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion | Oct 12, 2026 |
| CVE-2026-109371 | 8.8 High | ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1 | Oct 12, 2026 |
| CVE-2026-109366 | 6.3 Medium | Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height | Oct 12, 2026 |
| CVE-2026-109365 | 6.3 Medium | Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.