CVE Vulnerability Database
Search and browse 425,004 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-104667 | MEDIUM | 6.8 | 0.2% | Oct 7, 2026 | The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level u... |
| CVE-2026-104653 | MEDIUM | 6.8 | 0.2% | Oct 7, 2026 | The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configurati... |
| CVE-2026-104652 | MEDIUM | 6.8 | 0.2% | Oct 7, 2026 | The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputt... |
| CVE-2026-104651 | MEDIUM | 4.3 | 0.1% | Oct 7, 2026 | The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requestin... |
| CVE-2026-104050 | MEDIUM | 4.3 | 0.1% | Oct 7, 2026 | The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting... |
| CVE-2026-104049 | MEDIUM | 4.3 | 0.1% | Oct 7, 2026 | The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a le... |
| CVE-2026-103681 | MEDIUM | 4.3 | 0.1% | Oct 7, 2026 | The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, all... |
| CVE-2026-103378 | MEDIUM | 6.5 | 0.1% | Oct 7, 2026 | The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file i... |
| CVE-2026-103323 | MEDIUM | 5.9 | 0.1% | Oct 7, 2026 | The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on o... |
| CVE-2026-59347 | HIGH | 8.1 | 0.2% | Oct 7, 2026 | VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local ... |
| CVE-2026-59346 | CRITICAL | 9.3 | 0.3% | Oct 7, 2026 | VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative pri... |
| CVE-2026-103870 | MEDIUM | 5 | 0.3% | Oct 7, 2026 | A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as dir... |
| CVE-2026-103869 | MEDIUM | 6.5 | 0.2% | Oct 7, 2026 | A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-l... |
| CVE-2026-103868 | MEDIUM | 6.5 | 0.2% | Oct 7, 2026 | A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one ... |
| CVE-2026-102173 | HIGH | 7.2 | 0.4% | Oct 7, 2026 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site ... |
| CVE-2026-19572 | CRITICAL | 9.3 | 0.4% | Oct 7, 2026 | A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, w... |
| CVE-2026-84897 | MEDIUM | 5.3 | 0.3% | Oct 7, 2026 | src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_M... |
| CVE-2026-83742 | HIGH | 8.8 | 0.3% | Oct 7, 2026 | Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows pla... |
| CVE-2026-83540 | HIGH | 8.8 | 0.3% | Oct 7, 2026 | When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired f... |
| CVE-2026-81535 | CRITICAL | 9.1 | 0.3% | Oct 7, 2026 | In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel open... |
| CVE-2026-16516 | HIGH | 7.4 | 0.1% | Oct 7, 2026 | wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiate... |
| CVE-2026-14911 | CRITICAL | 9.3 | 0.3% | Oct 7, 2026 | Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a rem... |
| CVE-2026-106061 | MEDIUM | 5.5 | 0.1% | Oct 7, 2026 | A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it a... |
| CVE-2026-19396 | HIGH | 7.7 | 0.1% | Oct 7, 2026 | A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE5... |
| CVE-2026-19386 | CRITICAL | 9.3 | 0.2% | Oct 7, 2026 | A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code v... |