[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108359 | 22 Oct 2026 | CVSS 8.7 | PHPOffice PhpSpreadsheetPhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0… | |
| CVE-2026-108360 | 22 Oct 2026 | CVSS 6.4 | PHPOffice PhpSpreadsheetPhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0… | |
| CVE-2026-97631 | 22 Oct 2026 | CVSS 9.5 | TianoCore EDK2EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer… | |
| CVE-2026-115502 | 22 Oct 2026 | CVSS 6.3 | KNIME Business HubA missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of other users… | |
| CVE-2026-115513 | 22 Oct 2026 | CVSS 8.7 | OpenCATSOpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript… | |
| CVE-2026-75507 | 22 Oct 2026 | CVSS 7.5 | GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation ruleGraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule… | Fix |
| CVE-2026-75508 | 22 Oct 2026 | CVSS 7.5 | GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitGraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 and 3.3.0rc1, the parser's max_tokens limit in… | Fix |
| CVE-2026-114605 | 22 Oct 2026 | CVSS 7.5 | rthalley dnspythondnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a… | |
| CVE-2026-114606 | 22 Oct 2026 | CVSS 5.6 | jgraph drawio-desktopdraw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through… | |
| CVE-2026-114607 | 22 Oct 2026 | CVSS 9.1 | better-authBetter Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with… | |
| CVE-2026-114608 | 22 Oct 2026 | CVSS 5.4 | pylint-dev pylintPylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and… | |
| CVE-2026-115416 | 22 Oct 2026 | CVSS 7.7 | AWS Amazon AthenaIncorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account… | |
| CVE-2026-104068 | 22 Oct 2026 | CVSS 7.2 | JetBackupJetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress… | |
| CVE-2026-94482 | 22 Oct 2026 | CVSS 8.2 | Next.js: Denial of Service in App Router using Server ActionsNext.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router… | Fix |
| CVE-2026-51954 | 22 Oct 2026 | Not scored yet | VulnerabilityAn issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an… | |
| CVE-2026-115450 | 22 Oct 2026 | CVSS 7.1 | MarcosCamara01 Ecommerce TemplateExternal Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an… | |
| CVE-2026-115453 | 22 Oct 2026 | CVSS 7.1 | MarcosCamara01 Ecommerce TemplateAuthorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any… | |
| CVE-2026-115454 | 22 Oct 2026 | CVSS 5.3 | KNIME Business HubAn excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a… | |
| CVE-2026-115482 | 22 Oct 2026 | CVSS 7.5 | litespeedtech lsquicIn lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as… | |
| CVE-2026-115494 | 22 Oct 2026 | CVSS 5.3 | KNIME Business HubA flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform… | |
| CVE-2026-115496 | 22 Oct 2026 | CVSS 6.9 | KNIME Business HubOverly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote… | |
| CVE-2026-114485 | 22 Oct 2026 | Not scored yet | Devolutions ServerInsufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated… | |
| CVE-2026-114486 | 22 Oct 2026 | Not scored yet | Devolutions ServerIncorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated… | |
| CVE-2026-114487 | 22 Oct 2026 | Not scored yet | Devolutions ServerMissing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows… | |
| CVE-2026-114603 | 22 Oct 2026 | CVSS 5.3 | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiOpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in… | Fix |
| CVE-2026-78801 | 22 Oct 2026 | Not scored yet | VulnerabilityAn issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive… | |
| CVE-2026-78846 | 22 Oct 2026 | Not scored yet | VulnerabilityAiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing. | |
| CVE-2026-113872 | 22 Oct 2026 | CVSS 7.5 | multermulter is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with… | |
| CVE-2026-114510 | 22 Oct 2026 | CVSS 7.1 | stevereiner flexible-graphragFlexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search… | |
| CVE-2026-114515 | 22 Oct 2026 | CVSS 6.5 | schorschii OCO-ServerOCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to… | |
| CVE-2026-16477 | 22 Oct 2026 | CVSS 8.4 | MTW CleanShot XCleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation… | |
| CVE-2026-61791 | 22 Oct 2026 | CVSS 7.4 | schorschii OCO-ServerOCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to… | |
| CVE-2026-111181 | 22 Oct 2026 | CVSS 7.5 | body-parserbody-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request… | |
| CVE-2026-85080 | 22 Oct 2026 | CVSS 6.0 | Silicon Labs EmberZNetIn EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of… | |
| CVE-2026-89409 | 22 Oct 2026 | CVSS 5.3 | Silicon Labs Z-Wave SDKIn Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing checks in the… | |
| CVE-2026-89410 | 22 Oct 2026 | CVSS 5.1 | Silicon Labs Z-Wave SDKIn Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information. | |
| CVE-2026-92709 | 22 Oct 2026 | CVSS 8.1 | rsyslogRsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows… | |
| CVE-2026-94502 | 22 Oct 2026 | CVSS 7.5 | Silicon Labs EmberZNetIn EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code… | |
| CVE-2026-85079 | 22 Oct 2026 | CVSS 7.5 | Silicon Labs EmberZNetIn EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code… | |
| CVE-2026-66282 | 22 Oct 2026 | CVSS 6.0 | Silicon Labs EmberZNetIn EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end… | |
| CVE-2026-66279 | 22 Oct 2026 | CVSS 7.2 | Silicon Labs Connect SDKIn Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in… | |
| CVE-2026-66281 | 22 Oct 2026 | CVSS 6.0 | Silicon Labs EmberZNetIn EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These… | |
| CVE-2026-115400 | 22 Oct 2026 | CVSS 4.4 | crawlseocrawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth… | |
| CVE-2026-115411 | 22 Oct 2026 | CVSS 5.0 | crawlseocrawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved… | |
| CVE-2026-113582 | 22 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache AbderaUNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make… | |
| CVE-2026-115247 | 22 Oct 2026 | CVSS 4.3 | subhajitkhan online-clinic-management-systemA security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This… | |
| CVE-2026-115248 | 22 Oct 2026 | CVSS 5.4 | subhajitkhan online-clinic-management-systemA vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some… | |
| CVE-2026-115249 | 22 Oct 2026 | CVSS 4.6 | subhajitkhan online-clinic-management-systemA flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function… | |
| CVE-2026-107079 | 22 Oct 2026 | Not scored yet | VulnerabilityAn issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html… | |
| CVE-2026-111497 | 22 Oct 2026 | CVSS 9.2 | Google BrotliA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote… | |
| CVE-2026-115246 | 22 Oct 2026 | CVSS 3.5 | subhajitkhan online-clinic-management-systemA weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an… | |
| CVE-2026-102785 | 22 Oct 2026 | CVSS 10.0 | yootheme.com YOOtheme Pro extension for JoomlaJoomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image… | |
| CVE-2026-115329 | 22 Oct 2026 | CVSS 5.9 | uselotus lotusLotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset… | |
| CVE-2026-115330 | 22 Oct 2026 | CVSS 8.8 | uselotus lotusLotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending… | |
| CVE-2026-115331 | 22 Oct 2026 | CVSS 8.8 | uselotus lotusLotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable… | |
| CVE-2026-115332 | 22 Oct 2026 | CVSS 8.8 | uselotus lotusLotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted… | |
| CVE-2026-115333 | 22 Oct 2026 | CVSS 5.9 | uselotus lotusLotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only… | |
| CVE-2026-115334 | 22 Oct 2026 | CVSS 6.8 | uselotus lotusLotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any… | |
| CVE-2026-13411 | 22 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker… | |
| CVE-2026-115323 | 22 Oct 2026 | CVSS 7.3 | evershopcommerce evershopEverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to… | |
| CVE-2026-115324 | 22 Oct 2026 | CVSS 8.1 | mem0ai mem0mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by… | |
| CVE-2026-115325 | 22 Oct 2026 | CVSS 8.3 | gravitl netmakerNetmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify… | |
| CVE-2026-115326 | 22 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that… | |
| CVE-2026-115327 | 22 Oct 2026 | CVSS 5.3 | CESNET libyanglibyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc… | |
| CVE-2026-115328 | 22 Oct 2026 | CVSS 8.8 | riclolsen json-scadaJSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users… | |
| CVE-2026-115207 | 22 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated… | |
| CVE-2026-115319 | 22 Oct 2026 | CVSS 2.5 | junegunn fzffzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust… | |
| CVE-2026-115321 | 22 Oct 2026 | CVSS 4.3 | bytebaseBytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to… | |
| CVE-2026-115322 | 22 Oct 2026 | CVSS 4.3 | bytebaseBytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows… | |
| CVE-2026-114665 | 22 Oct 2026 | CVSS 6.5 | zhenorzz goployGoploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows… | |
| CVE-2026-112832 | 22 Oct 2026 | CVSS 9.8 | CozyThemes RootbloxImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox… | |
| CVE-2026-112842 | 22 Oct 2026 | CVSS 6.5 | Cozmoslabs Paid Member SubscriptionsMissing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-112822 | 22 Oct 2026 | CVSS 8.5 | AmentoTech Workreap CoreImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows… | |
| CVE-2026-112820 | 22 Oct 2026 | CVSS 8.1 | Elated-Themes Academist CoreImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core… | |
| CVE-2026-112313 | 22 Oct 2026 | CVSS 7.1 | ACF ExtendedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows… | |
| CVE-2026-111079 | 22 Oct 2026 | CVSS 7.4 | Red Hat Enterprise Linux 10A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim… | |
| CVE-2024-58394 | 22 Oct 2026 | CVSS 6.1 | RetoolRetool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG… | |
| CVE-2024-58396 | 22 Oct 2026 | CVSS 7.5 | YouDataSum CPAS Audit Management SystemYouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by… | |
| CVE-2025-71434 | 22 Oct 2026 | CVSS 8.2 | Weaver Network Co., Ltd. E-cologyWeaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via… | |
| CVE-2022-51022 | 22 Oct 2026 | CVSS 9.1 | liukuo362573 YiShaAdminYiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile… | |
| CVE-2022-51023 | 22 Oct 2026 | CVSS 8.2 | PHPOKPHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the… | |
| CVE-2022-51024 | 22 Oct 2026 | CVSS 7.5 | Kareadita KavitaKavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../'… | |
| CVE-2022-51025 | 22 Oct 2026 | CVSS 6.5 | Penta Security Systems WAPPLESPenta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files… | |
| CVE-2023-54413 | 22 Oct 2026 | CVSS 6.1 | OnTheGoSystems WPML Multilingual CMSWPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers… | |
| CVE-2024-58393 | 22 Oct 2026 | CVSS 8.2 | i-Netsolution Readymade Unilevel Ecommerce MLMi-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to… | |
| CVE-2020-37284 | 22 Oct 2026 | CVSS 6.1 | midgetspy SickbeardSickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through… | |
| CVE-2021-48013 | 22 Oct 2026 | CVSS 7.5 | Weaver Network Co., Ltd. E-cologyWeaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter… | |
| CVE-2021-48014 | 22 Oct 2026 | CVSS 9.8 | FanRuan FineReportFineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers… | |
| CVE-2021-48015 | 22 Oct 2026 | CVSS 7.5 | erzhongxmu JeeWMSJeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the… | |
| CVE-2021-48016 | 22 Oct 2026 | CVSS 9.8 | DedeCMSDedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate… | |
| CVE-2021-48017 | 22 Oct 2026 | CVSS 7.5 | OrbiTeam BSCW ServerOrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of… | |
| CVE-2022-51021 | 22 Oct 2026 | CVSS 8.2 | WPDeveloper NotificationXNotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to… | |
| CVE-2017-20289 | 22 Oct 2026 | CVSS 7.5 | Broadstreet Ad WidgetBroadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to… | |
| CVE-2017-20290 | 22 Oct 2026 | CVSS 6.1 | DiscourseDiscourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject… | |
| CVE-2018-25438 | 22 Oct 2026 | CVSS 7.5 | Intermesh Group-OfficeIntermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to… | |
| CVE-2018-25439 | 22 Oct 2026 | CVSS 7.5 | MetInfoMetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary… | |
| CVE-2019-25778 | 22 Oct 2026 | CVSS 8.2 | SeaCMSSeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting… | |
| CVE-2019-25779 | 22 Oct 2026 | CVSS 7.5 | WooThemes DiariseWooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar… | |
| CVE-2017-20288 | 22 Oct 2026 | CVSS 6.1 | QCubedQCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through… | |
| CVE-2017-20287 | 22 Oct 2026 | CVSS 7.5 | Javo Themes Javo SpotJavo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via… |
Page 3 of 168