CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
228874 CVEs matched. Showing 451–500 (page 10 of 4578).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-95519 |
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) | HIGH | 7.8 | — | — | redhat | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-91187 |
Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy | CRITICAL | 9.3 | — | — | EEF | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-19072 |
Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal | CRITICAL | 9.9 | — | — | rapid7 | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-88916 |
Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF | MEDIUM | 6.8 | — | — | TR-CERT | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-88907 |
SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF | HIGH | 7.4 | — | — | TR-CERT | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-94416 |
Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery | MEDIUM | 6.8 | — | — | redhat | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-97182 |
halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization | MEDIUM | 6.9 | — | — | VulDB | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-96515 |
Command Injection Vulnerability in Netlink ICT HG323RW Router | HIGH | 8.6 | — | — | CERT-In | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-19532 |
Path Traversal in HAVELSAN's Liman MYS | MEDIUM | 5.3 | — | — | TR-CERT | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-16302 |
Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure | MEDIUM | 4.3 | — | — | Wordfence | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-4806 |
Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings R… | MEDIUM | 6.5 | — | — | Wordfence | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-3253 |
MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and… | MEDIUM | 4.3 | — | — | Wordfence | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-97311 |
Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization | MEDIUM | 4.3 | — | — | redhat | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-7169 |
Uncontrolled Search Path Element in Evope Collector | HIGH | 7.5 | — | — | INCIBE | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-4638 |
Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor | HIGH | 7.1 | — | — | SEC-VLab | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-79680 |
Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module | MEDIUM | 4.5 | — | — | Qt | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-97179 |
O2OA Cipher Connection CipherConnectionAction.java list information disclosure | MEDIUM | 5.3 | — | — | VulDB | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-4637 |
Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor | MEDIUM | 5.1 | — | — | SEC-VLab | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-12227 |
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter | CRITICAL | 9.8 | — | — | Wordfence | 2026-09-24 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-18335 |
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery… | MEDIUM | 5.4 | — | — | Wordfence | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-15731 |
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting … | MEDIUM | 6.4 | — | — | Wordfence | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-57590 |
Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations | — | — | — | — | apache | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-92905 |
Denial of Service Vulnerability | MEDIUM | 5.3 | — | — | Zohocorp | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-78313 |
Improper Access Control in DIAEnergie | MEDIUM | 6.5 | — | — | Deltaww | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-78312 |
Path Traversal in DIAEnergie | CRITICAL | 9.1 | — | — | Deltaww | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-78310 |
Authorization Bypass Through User-Controlled Key in DIAEnergie | MEDIUM | 4.3 | — | — | Deltaww | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-78311 |
SQL Injection in DIAEnergie | HIGH | 8.8 | — | — | Deltaww | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-78309 |
SQL Injection in DIAEnergie | HIGH | 8.8 | — | — | Deltaww | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-78308 |
Authentication Bypass in DIAEnergie | CRITICAL | 9.8 | — | — | Deltaww | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-97185 |
Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file | HIGH | 7.8 | — | — | redhat | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-85682 |
YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redir… | HIGH | 8.8 | — | — | Wordfence | 2026-09-24 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-77193 |
eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Qu… | HIGH | 7.5 | — | — | Wordfence | 2026-09-24 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-97181 |
ezGlobal｜GPM LIGHT - Sensitive Data Exposure | MEDIUM | 6.9 | — | — | twcert | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-11744 |
PaperCut Hive Embedded App for Ricoh: Javascript injection | LOW | 3.8 | — | — | PaperCut | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-87739 |
PaperCut MF/NG: User permissions are not evaluated on report generation | MEDIUM | 6.9 | — | — | PaperCut | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-82077 |
PaperCut NG/MF: Remote Code Execution via Scan2Fax | HIGH | 7.3 | — | — | PaperCut | 2026-09-24 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-81645 |
CVE-2026-81645 | MEDIUM | 5.9 | — | — | huawei | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-93662 |
Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-93661 |
Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-89005 |
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-89004 |
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-89002 |
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-88847 |
MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-88846 |
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-88845 |
MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-88843 |
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-84151 |
The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-82850 |
Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-82849 |
Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |
CVE-2026-82195 |
10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion | — | — | — | — | WPScan | 2026-09-24 | — | — | raw · ⬇ |