CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
229687 CVEs matched. Showing 1251–1300 (page 26 of 4594).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-79680 |
Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module | MEDIUM | 4.5 | — | — | Qt | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-97179 |
O2OA Cipher Connection CipherConnectionAction.java list information disclosure | MEDIUM | 5.3 | — | — | VulDB | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-4637 |
Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor | MEDIUM | 5.1 | — | — | SEC-VLab | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-12227 |
Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter | CRITICAL | 9.8 | — | — | Wordfence | 2026-09-24 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-18335 |
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery… | MEDIUM | 5.4 | — | — | Wordfence | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-15731 |
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting … | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-57590 |
Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations | — | — | — | — | apache | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-92905 |
Denial of Service Vulnerability | MEDIUM | 5.3 | — | — | Zohocorp | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-78313 |
Improper Access Control in DIAEnergie | MEDIUM | 6.5 | — | — | Deltaww | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-78312 |
Path Traversal in DIAEnergie | CRITICAL | 9.1 | — | — | Deltaww | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-78310 |
Authorization Bypass Through User-Controlled Key in DIAEnergie | MEDIUM | 4.3 | — | — | Deltaww | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-78311 |
SQL Injection in DIAEnergie | HIGH | 8.8 | — | — | Deltaww | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-78309 |
SQL Injection in DIAEnergie | HIGH | 8.8 | — | — | Deltaww | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-78308 |
Authentication Bypass in DIAEnergie | CRITICAL | 9.8 | 9.8 | — | Deltaww | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-97185 |
Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file | HIGH | 7.8 | — | — | redhat | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-85682 |
YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redir… | HIGH | 8.8 | — | — | Wordfence | 2026-09-24 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-77193 |
eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Qu… | HIGH | 7.5 | — | — | Wordfence | 2026-09-24 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-97181 |
ezGlobal｜GPM LIGHT - Sensitive Data Exposure | MEDIUM | 6.9 | — | — | twcert | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-11744 |
PaperCut Hive Embedded App for Ricoh: Javascript injection | LOW | 3.8 | — | — | PaperCut | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-87739 |
PaperCut MF/NG: User permissions are not evaluated on report generation | MEDIUM | 6.9 | — | — | PaperCut | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-82077 |
PaperCut NG/MF: Remote Code Execution via Scan2Fax | HIGH | 7.3 | — | — | PaperCut | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-81645 |
CVE-2026-81645 | MEDIUM | 5.9 | 5.9 | — | huawei | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-93662 |
Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter | — | — | 4.3 | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-93661 |
Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR | — | — | 2.7 | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-89005 |
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-89004 |
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-89002 |
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-88847 |
MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-88846 |
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-88845 |
MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-88843 |
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-84151 |
The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-82850 |
Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-82849 |
Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-82195 |
10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion | — | — | 6.5 | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-80513 |
wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-80338 |
CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler | — | — | — | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-74991 |
WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent | — | — | 6.8 | — | WPScan | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-97177 |
Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission | MEDIUM | 6.6 | — | — | redhat | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-97176 |
Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator | MEDIUM | 4.2 | 4.2 | — | redhat | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-14780 |
PaperCut NG/MF: Remote Code Execution via Scripting Subsystem | HIGH | 7.5 | — | — | PaperCut | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-97155 |
CVE-2026-97155 | MEDIUM | 6.5 | — | — | mitre | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-96898 |
yhx070424 ShopXO Ueditor Upload ueditor.php path traversal | MEDIUM | 6.9 | — | — | VulDB | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-97152 |
CVE-2026-97152 | HIGH | 8.6 | — | — | mitre | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-96892 |
Edimax BR-6428nC goform websRedirect redirect | MEDIUM | 5.3 | 4.3 | — | VulDB | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-97151 |
CVE-2026-97151 | HIGH | 8.4 | — | — | mitre | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-96891 |
D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write | CRITICAL | 9.3 | 9.8 | — | VulDB | 2026-09-24 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-96884 |
MantisZip Preview MainWindow.UI.cs Path.Combine path traversal | MEDIUM | 5.3 | 6.3 | — | VulDB | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-96882 |
TaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization | MEDIUM | 6.9 | 5.3 | — | VulDB | 2026-09-24 | 10 | — | raw · ⬇ |
CVE-2026-97149 |
CVE-2026-97149 | MEDIUM | 5.3 | — | — | mitre | 2026-09-24 | 10 | — | raw · ⬇ |