Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,217 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-105410 | 8.7 High | Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 | Oct 12, 2026 |
| CVE-2026-105409 | 8.7 High | Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 | Oct 12, 2026 |
| CVE-2026-105408 | 8.7 High | Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 | Oct 12, 2026 |
| CVE-2026-105407 | 8.8 High | OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 | Oct 12, 2026 |
| CVE-2026-103903 | 8.7 High | MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation | Oct 12, 2026 |
| CVE-2026-108825 | 5.3 Medium | yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management | Oct 12, 2026 |
| CVE-2026-103902 | 7.5 High | DigiDoc improper signature verification | Oct 12, 2026 |
| CVE-2026-108824 | 5.3 Medium | DataEase Utils.java Utils.buildCalcField sql injection | Oct 12, 2026 |
| CVE-2026-108822 | 6.9 Medium | Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow | Oct 12, 2026 |
| CVE-2026-108821 | 5.3 Medium | Tencent WeKnora SQL Validator inject.go validateSubquery sql injection | Oct 12, 2026 |
| CVE-2026-108820 | 5.3 Medium | agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges | Oct 12, 2026 |
| CVE-2026-108819 | 6.9 Medium | agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources | Oct 12, 2026 |
| CVE-2026-107864 | 6.5 Medium | WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability | Oct 12, 2026 |
| CVE-2026-107865 | 6.5 Medium | WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability | Oct 12, 2026 |
| CVE-2026-108818 | 6.9 Medium | agno-agi agno auth.py get_authentication_dependency missing authentication | Oct 12, 2026 |
| CVE-2026-107866 | 6.5 Medium | WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability | Oct 12, 2026 |
| CVE-2026-108817 | 5.1 Medium | agno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injection | Oct 12, 2026 |
| CVE-2026-1907 | 7.5 High | SQL Injection in Clustering Communication (Hybrid Mode) | Oct 12, 2026 |
| CVE-2026-108816 | 5.3 Medium | agno-agi agno PythonTools python.py run_python_code code injection | Oct 12, 2026 |
| CVE-2026-107423 | 4.3 Medium | WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-107869 | 4.3 Medium | WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-107863 | 5.3 Medium | WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-108168 | 6.5 Medium | WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability | Oct 12, 2026 |
| CVE-2023-25996 | 6.5 Medium | WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability | Oct 12, 2026 |
| CVE-2026-108815 | 5.1 Medium | idcCMS member_deal.php cross site scripting | Oct 12, 2026 |
| CVE-2026-108814 | 5.3 Medium | SEMCMS SEMCMS_Banner.php sql injection | Oct 12, 2026 |
| CVE-2026-107432 | 5.4 Medium | WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-103356 | 5.4 Medium | WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-107430 | 5.4 Medium | WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-108813 | 5.3 Medium | SEMCMS SEMCMS_Download.php sql injection | Oct 12, 2026 |
| CVE-2026-107429 | 4.3 Medium | WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability | Oct 12, 2026 |
| CVE-2026-107427 | 6.5 Medium | WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability | Oct 12, 2026 |
| CVE-2026-106605 | 5.3 Medium | WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability | Oct 12, 2026 |
| CVE-2026-108812 | 6.9 Medium | SEMCMS SEMCMS_User.php user improper authorization | Oct 12, 2026 |
| CVE-2026-108811 | 5.3 Medium | WMCMS index.php information disclosure | Oct 12, 2026 |
| CVE-2026-108810 | 6.9 Medium | tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure | Oct 12, 2026 |
| CVE-2026-93582 | 9.4 Critical | Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication | Oct 12, 2026 |
| CVE-2026-93581 | 6.1 Medium | Insufficient Neutralization of Formula Elements in CSV Exports | Oct 12, 2026 |
| CVE-2026-78359 | 5.4 Medium | Duplicate Identity / Identity Shadowing across CustomerUser backends | Oct 12, 2026 |
| CVE-2026-78358 | 4.3 Medium | Cross-Site Request Forgery in Administrative Actions | Oct 12, 2026 |
| CVE-2026-78357 | 9.1 Critical | Insufficient Session Revocation for JWT Authentication | Oct 12, 2026 |
| CVE-2026-78356 | 5.3 Medium | Unauthenticated Disclosure of Agent Frontend Configuration | Oct 12, 2026 |
| CVE-2026-78355 | 8.7 High | Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory | Oct 12, 2026 |
| CVE-2026-48212 | 4.8 Medium | Stored XSS in external pages | Oct 12, 2026 |
| CVE-2026-48211 | 5.4 Medium | Cross-Site Request Forgery in Import/Export Admin console | Oct 12, 2026 |
| CVE-2026-108809 | 5.1 Medium | Eleveo Call Recording Software logout session expiration | Oct 12, 2026 |
| CVE-2026-108808 | 2.1 Low | Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings | Oct 12, 2026 |
| CVE-2026-109082 | 6.8 Medium | Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients | Oct 12, 2026 |
| CVE-2026-108807 | 6.9 Medium | krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection | Oct 12, 2026 |
| CVE-2026-108806 | 6.9 Medium | krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.