CVE Vulnerability Database
Search and browse 420,257 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-117627 | MEDIUM | 5.4 | 0.2% | Oct 29, 2026 | A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Googl... |
| CVE-2026-117548 | MEDIUM | 6.5 | 0.3% | Oct 29, 2026 | A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an at... |
| CVE-2026-93293 | MEDIUM | 6.4 | 0.2% | Oct 29, 2026 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's ... |
| CVE-2026-89216 | HIGH | 8.6 | 0.2% | Oct 29, 2026 | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL stat... |
| CVE-2026-88928 | MEDIUM | 6.5 | 0.1% | Oct 29, 2026 | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment not... |
| CVE-2026-86794 | HIGH | 8.8 | 0.2% | Oct 29, 2026 | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public ev... |
| CVE-2026-85007 | LOW | 3.8 | 0.1% | Oct 29, 2026 | The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJA... |
| CVE-2026-78396 | MEDIUM | 5.3 | 0.1% | Oct 29, 2026 | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose ... |
| CVE-2026-78395 | MEDIUM | 5.3 | 0.1% | Oct 29, 2026 | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when proc... |
| CVE-2026-19610 | MEDIUM | 6.5 | 0.2% | Oct 29, 2026 | A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and... |
| CVE-2026-15564 | HIGH | 7.4 | 0.1% | Oct 29, 2026 | Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who ... |
| CVE-2026-118905 | HIGH | 7 | 0.1% | Oct 29, 2026 | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.... |
| CVE-2026-115302 | MEDIUM | 5.3 | 0.1% | Oct 29, 2026 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes st... |
| CVE-2026-115301 | HIGH | 7.2 | 0.3% | Oct 29, 2026 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its fo... |
| CVE-2026-115300 | MEDIUM | 4.3 | 0.1% | Oct 29, 2026 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two ad... |
| CVE-2026-115299 | MEDIUM | 5.4 | 0.1% | Oct 29, 2026 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settin... |
| CVE-2026-115282 | MEDIUM | 5.3 | 0.1% | Oct 29, 2026 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts... |
| CVE-2026-115259 | MEDIUM | 4.9 | 0.1% | Oct 29, 2026 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks w... |
| CVE-2026-115245 | CRITICAL | 9.8 | 0.2% | Oct 29, 2026 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spo... |
| CVE-2026-114488 | HIGH | 7.4 | 0.3% | Oct 29, 2026 | A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security i... |
| CVE-2026-114270 | MEDIUM | 5.3 | 0.1% | Oct 29, 2026 | The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, all... |
| CVE-2026-113617 | CRITICAL | 9.9 | 0.2% | Oct 29, 2026 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before u... |
| CVE-2026-113616 | CRITICAL | 9.8 | 0.1% | Oct 29, 2026 | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved accou... |
| CVE-2026-111739 | HIGH | 7.5 | 0.2% | Oct 29, 2026 | The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 ... |
| CVE-2026-110983 | MEDIUM | 4.3 | 0.1% | Oct 29, 2026 | The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its... |