Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,619 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-116216 | 6.9 Medium | MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment | Oct 26, 2026 |
| CVE-2026-116215 | 2.3 Low | MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption | Oct 26, 2026 |
| CVE-2026-116214 | 9.3 Critical | MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code | Oct 26, 2026 |
| CVE-2026-116213 | 6.9 Medium | Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks | Oct 26, 2026 |
| CVE-2026-116212 | 5.1 Medium | Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL | Oct 26, 2026 |
| CVE-2026-116210 | 7.1 High | Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions | Oct 26, 2026 |
| CVE-2026-116281 | 4.8 Medium | Kameleo Profile Controller t.cs ListProfiles information disclosure | Oct 26, 2026 |
| CVE-2026-107157 | 2.0 Low | Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework | Oct 26, 2026 |
| CVE-2026-115196 | 5.4 Medium | An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that… | Oct 26, 2026 |
| CVE-2026-115195 | 6.5 Medium | A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables… | Oct 26, 2026 |
| CVE-2026-115194 | 6.5 Medium | A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets… | Oct 26, 2026 |
| CVE-2026-115193 | 8.2 High | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a… | Oct 26, 2026 |
| CVE-2026-115192 | 7.1 High | An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard… | Oct 26, 2026 |
| CVE-2026-116280 | 5.1 Medium | Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery | Oct 26, 2026 |
| CVE-2026-115191 | 7.1 High | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a… | Oct 26, 2026 |
| CVE-2026-115190 | 8.0 High | An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without… | Oct 26, 2026 |
| CVE-2026-115189 | 8.8 High | A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg) does not fully enforce its… | Oct 26, 2026 |
| CVE-2026-115188 | 9.9 Critical | An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without… | Oct 26, 2026 |
| CVE-2026-116275 | 5.3 Medium | AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection | Oct 26, 2026 |
| CVE-2026-116492 | 7.1 High | Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API | Oct 26, 2026 |
| CVE-2026-110475 | 9.3 Critical | Improper Authentication Vulnerability in CreditNirvana Collections Platform | Oct 26, 2026 |
| CVE-2026-116274 | 5.3 Medium | JIZHICMS Front-end Order OrderController.php pay improper authorization | Oct 26, 2026 |
| CVE-2026-110474 | 8.7 High | Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application | Oct 26, 2026 |
| CVE-2026-115720 | 5.3 Medium | Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect | Oct 26, 2026 |
| CVE-2026-116263 | 2.1 Low | HaschekSolutions PictShare File Upload core.php architect race condition | Oct 26, 2026 |
| CVE-2026-105947 | 6.5 Medium | Arbitrary File Read in Innotim Software's Logsign SIEM | Oct 26, 2026 |
| CVE-2026-116262 | 5.3 Medium | libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow | Oct 26, 2026 |
| CVE-2026-115717 | 6.3 Medium | Frappe Builder before 1.36.1 SSRF via convert_to_webp | Oct 26, 2026 |
| CVE-2026-115718 | 5.3 Medium | Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt | Oct 26, 2026 |
| CVE-2026-96432 | 2.1 Low | Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt | Oct 26, 2026 |
| CVE-2026-116261 | 5.1 Medium | libimobiledevice AFC File afc.c afc_file_open out-of-bounds | Oct 26, 2026 |
| CVE-2026-94380 | 8.1 High | Host Header Injection in HAVELSAN's Liman MYS | Oct 26, 2026 |
| CVE-2026-116260 | 6.9 Medium | libimobiledevice AFC Service afc.c service_receive double free | Oct 26, 2026 |
| CVE-2026-116259 | 4.8 Medium | libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption | Oct 26, 2026 |
| CVE-2026-116258 | 5.3 Medium | libimobiledevice AFC afc.c heap-based overflow | Oct 26, 2026 |
| CVE-2026-89209 | 7.6 High | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of… | Oct 26, 2026 |
| CVE-2026-114708 | 6.5 Medium | WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability | Oct 26, 2026 |
| CVE-2026-115595 | 5.3 Medium | WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability | Oct 26, 2026 |
| CVE-2026-116469 | 7.1 High | MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding | Oct 26, 2026 |
| CVE-2026-115959 | 5.3 Medium | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability | Oct 26, 2026 |
| CVE-2026-115960 | 4.3 Medium | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability | Oct 26, 2026 |
| CVE-2026-115955 | 6.5 Medium | WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability | Oct 26, 2026 |
| CVE-2026-115956 | 6.5 Medium | WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability | Oct 26, 2026 |
| CVE-2026-115961 | 6.5 Medium | WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability | Oct 26, 2026 |
| CVE-2026-116257 | 6.9 Medium | BillaBear Installation InstallController.php processInstall missing authentication | Oct 26, 2026 |
| CVE-2026-114707 | 6.5 Medium | WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability | Oct 26, 2026 |
| CVE-2026-115594 | 6.5 Medium | WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability | Oct 26, 2026 |
| CVE-2026-115608 | 8.5 High | WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability | Oct 26, 2026 |
| CVE-2026-115953 | 6.5 Medium | WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability | Oct 26, 2026 |
| CVE-2026-115954 | 5.4 Medium | WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability | Oct 26, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.