Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,710 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-113501 | 3.1 Low | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal | Oct 23, 2026 |
| CVE-2026-113500 | 7.5 High | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization | Oct 23, 2026 |
| CVE-2026-113499 | 7.5 High | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting | Oct 23, 2026 |
| CVE-2026-113472 | 5.4 Medium | Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload | Oct 23, 2026 |
| CVE-2026-112230 | 3.7 Low | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter | Oct 23, 2026 |
| CVE-2026-112219 | 4.9 Medium | Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route | Oct 23, 2026 |
| CVE-2026-111982 | 7.2 High | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change | Oct 23, 2026 |
| CVE-2026-111966 | 6.8 Medium | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute | Oct 23, 2026 |
| CVE-2026-111738 | 5.5 Medium | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option | Oct 23, 2026 |
| CVE-2026-111737 | 3.5 Low | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists | Oct 23, 2026 |
| CVE-2026-110537 | 3.8 Low | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action | Oct 23, 2026 |
| CVE-2026-110510 | 3.5 Low | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag | Oct 23, 2026 |
| CVE-2026-109936 | 7.5 High | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter | Oct 23, 2026 |
| CVE-2026-109935 | 5.3 Medium | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API | Oct 23, 2026 |
| CVE-2026-109934 | 5.3 Medium | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API | Oct 23, 2026 |
| CVE-2026-109933 | 6.8 Medium | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes | Oct 23, 2026 |
| CVE-2026-107858 | 7.2 High | Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server | Oct 23, 2026 |
| CVE-2026-109198 | 7.2 High | Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter | Oct 23, 2026 |
| CVE-2026-115497 | 7.5 High | Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter | Oct 23, 2026 |
| CVE-2026-55835 | 6.9 Medium | Lookyloo: Potential sub-system DoS due to parameter missmatch in notification | Oct 23, 2026 |
| CVE-2026-86055 | 8.7 High | Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover | Oct 23, 2026 |
| CVE-2026-86020 | 4.6 Medium | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports | Oct 23, 2026 |
| CVE-2026-86019 | 5.3 Medium | Part-DB: Attachment Size Limit Bypass via API Base64 Upload | Oct 23, 2026 |
| CVE-2026-86018 | 5.3 Medium | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads | Oct 23, 2026 |
| CVE-2026-59188 | 5.4 Medium | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer | Oct 23, 2026 |
| CVE-2026-55600 | 5.7 Medium | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name | Oct 23, 2026 |
| CVE-2026-54631 | 6.3 Medium | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie | Oct 23, 2026 |
| CVE-2026-90458 | 5.4 Medium | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service. | Oct 23, 2026 |
| CVE-2026-54630 | 9.6 Critical | Part-DB: Authenticated RCE via .phar attachment upload served from public/media | Oct 23, 2026 |
| CVE-2026-54615 | 6.0 Medium | Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) | Oct 23, 2026 |
| CVE-2026-89419 | 5.0 Medium | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint. | Oct 23, 2026 |
| CVE-2026-115638 | 4.3 Medium | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb. | Oct 23, 2026 |
| CVE-2026-115547 | 9.1 Critical | Command Execution via Admin Console Input in Okta Access Gateway | Oct 23, 2026 |
| CVE-2026-115546 | 8.1 High | Authentication Source Verification Issue in Okta Access Gateway | Oct 23, 2026 |
| CVE-2026-115537 | 5.3 Medium | gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect | Oct 23, 2026 |
| CVE-2026-19678 | 8.7 High | Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure | Oct 23, 2026 |
| CVE-2026-19677 | 9.3 Critical | Authentication Bypass Leading to Server-Side Command Execution | Oct 23, 2026 |
| CVE-2026-115536 | 5.3 Medium | gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting | Oct 23, 2026 |
| CVE-2026-115486 | 7.1 High | Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning | Oct 23, 2026 |
| CVE-2026-115485 | 6.3 Medium | Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio | Oct 23, 2026 |
| CVE-2026-115484 | 7.6 High | Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg | Oct 23, 2026 |
| CVE-2026-115535 | 4.8 Medium | gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting | Oct 23, 2026 |
| CVE-2026-52356 | 8.8 High | An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters. | Oct 23, 2026 |
| CVE-2026-50787 | 7.5 High | e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images,… | Oct 23, 2026 |
| CVE-2026-106765 | 7.5 High | An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function. | Oct 23, 2026 |
| CVE-2026-106764 | 7.5 High | An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. | Oct 23, 2026 |
| CVE-2026-106763 | 7.5 High | An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. | Oct 23, 2026 |
| CVE-2025-45528 | 7.3 High | An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF | Oct 23, 2026 |
| CVE-2026-115534 | 5.3 Medium | gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting | Oct 22, 2026 |
| CVE-2026-110825 | 8.7 High | Kiloview E3 NDI Encoder Missing Authentication for Critical Function | Oct 22, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.