CVE Vulnerability Database
Search and browse 420,257 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-39735 | MEDIUM | 6.5 | — | Oct 29, 2026 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access C... |
| CVE-2026-24533 | MEDIUM | 6.5 | — | Oct 29, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Bl... |
| CVE-2026-22386 | MEDIUM | 4.3 | — | Oct 29, 2026 | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access... |
| CVE-2026-118094 | MEDIUM | 6.5 | — | Oct 29, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inser... |
| CVE-2026-118093 | MEDIUM | 5.3 | — | Oct 29, 2026 | Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incor... |
| CVE-2026-118087 | MEDIUM | 6.5 | — | Oct 29, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site R... |
| CVE-2026-113690 | MEDIUM | 4.8 | — | Oct 29, 2026 | Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.... |
| CVE-2026-113689 | MEDIUM | 5.1 | — | Oct 29, 2026 | Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.... |
| CVE-2026-113688 | MEDIUM | 5.3 | — | Oct 29, 2026 | Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3... |
| CVE-2026-97860 | HIGH | 8.4 | — | Oct 29, 2026 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who h... |
| CVE-2026-97854 | CRITICAL | 9.8 | — | Oct 29, 2026 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitra... |
| CVE-2026-96767 | HIGH | 7.2 | — | Oct 29, 2026 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi... |
| CVE-2026-92086 | MEDIUM | 5.3 | — | Oct 29, 2026 | The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including... |
| CVE-2026-5702 | MEDIUM | 4.8 | — | Oct 29, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticat... |
| CVE-2026-5700 | MEDIUM | 4.8 | — | Oct 29, 2026 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code... |
| CVE-2026-5699 | MEDIUM | 4.8 | — | Oct 29, 2026 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code... |
| CVE-2026-5698 | MEDIUM | 4.8 | — | Oct 29, 2026 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code... |
| CVE-2026-5697 | MEDIUM | 4.8 | — | Oct 29, 2026 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code... |
| CVE-2026-27401 | MEDIUM | 5.3 | — | Oct 29, 2026 | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-fo... |
| CVE-2026-119028 | HIGH | 8.8 | — | Oct 29, 2026 | oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by suppl... |
| CVE-2026-119027 | HIGH | 7.5 | — | Oct 29, 2026 | oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by suppl... |
| CVE-2026-119025 | HIGH | 7.5 | 1.4% | Oct 29, 2026 | open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code... |
| CVE-2026-115821 | HIGH | 7.2 | — | Oct 29, 2026 | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_la... |
| CVE-2026-110184 | HIGH | 7.5 | — | Oct 29, 2026 | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, a... |
| CVE-2026-109822 | MEDIUM | 6.5 | — | Oct 29, 2026 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive in... |