CVE Vulnerability Database
Search and browse 423,806 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-111897 | HIGH | 7.1 | 0.3% | Oct 17, 2026 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted ed... |
| CVE-2026-111896 | MEDIUM | 5.4 | 0.2% | Oct 17, 2026 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that al... |
| CVE-2026-111895 | MEDIUM | 6.8 | 0.3% | Oct 17, 2026 | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID logi... |
| CVE-2026-111894 | MEDIUM | 5.4 | 0.2% | Oct 17, 2026 | phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that ... |
| CVE-2026-111893 | MEDIUM | 6.5 | — | Oct 17, 2026 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRes... |
| CVE-2026-111892 | MEDIUM | 6.5 | 0.3% | Oct 17, 2026 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and use... |
| CVE-2026-111891 | MEDIUM | 5.5 | 0.2% | Oct 17, 2026 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API,... |
| CVE-2026-111890 | MEDIUM | 5.5 | 0.2% | Oct 17, 2026 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUse... |
| CVE-2026-111889 | MEDIUM | 4.3 | — | Oct 17, 2026 | phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the... |
| CVE-2026-111888 | LOW | 2.7 | — | Oct 17, 2026 | phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking ... |
| CVE-2026-111887 | MEDIUM | 5.3 | — | Oct 17, 2026 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauth... |
| CVE-2026-111886 | MEDIUM | 6.5 | — | Oct 17, 2026 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpo... |
| CVE-2026-111885 | MEDIUM | 5.5 | — | Oct 17, 2026 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGro... |
| CVE-2026-111884 | HIGH | 8.3 | — | Oct 17, 2026 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e... |
| CVE-2026-111882 | HIGH | 8.1 | — | Oct 17, 2026 | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that... |
| CVE-2026-111881 | HIGH | 7.6 | 0.2% | Oct 17, 2026 | FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calcu... |
| CVE-2026-111880 | HIGH | 7.4 | 0.3% | Oct 17, 2026 | FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that ... |
| CVE-2026-110882 | MEDIUM | 4.3 | 0.2% | Oct 17, 2026 | Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows... |
| CVE-2025-71435 | MEDIUM | 4.2 | 0.2% | Oct 17, 2026 | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access ... |
| CVE-2024-58398 | MEDIUM | 4.3 | 0.3% | Oct 17, 2026 | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the... |
| CVE-2026-109701 | HIGH | 7.1 | 0.2% | Oct 17, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET ... |
| CVE-2026-110889 | HIGH | 7.5 | 0.3% | Oct 17, 2026 | Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows R... |
| CVE-2026-111110 | HIGH | 7.2 | 0.3% | Oct 17, 2026 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Si... |
| CVE-2026-110253 | MEDIUM | 5.4 | 0.3% | Oct 17, 2026 | The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media fi... |
| CVE-2026-109983 | MEDIUM | 6.4 | 0.2% | Oct 17, 2026 | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' paramete... |