CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
252033 CVEs matched. Showing 151–200 (page 4 of 5041).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-124309 |
Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124307 |
Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition | MEDIUM | 5.8 | — | — | VulnCheck | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99282 |
net/sched: sch_teql: fix use-after-free on lower qdisc drop | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99281 |
tun: Require CAP_NET_ADMIN to attach to an ownerless device | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99280 |
ksmbd: drain session procfs readers before dropping table references | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99279 |
ksmbd: reclaim ended sessions on logoff and expiration | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99278 |
ksmbd: limit sessions on each connection | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99277 |
ksmbd: hold a connection reference for each session channel | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99276 |
ksmbd: defer connection scavenging while session locks are busy | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99275 |
smb: client: reject short SESSION_SETUP responses | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99274 |
smb: client: fix fiemap wild read on empty truncated response | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99273 |
ksmbd: reserve space for the UTF-16 terminator in stream info | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99272 |
smb: client: validate the data area in SMB2_read() | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-99271 |
ALSA: line6: Clear prev_fbuf on capture buffer release | — | — | — | — | Linux | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123988 |
SililaWijesinghe Food Ordering System admin exposure of information through directory listing | MEDIUM | 6.9 | — | — | VulDB | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123966 |
Tenda AC19 saveParentControlInfo heap-based overflow | CRITICAL | 10.0 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120984 |
Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import | CRITICAL | 9.1 | 9.1 | — | redhat | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123860 |
WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123964 |
OpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loop | MEDIUM | 5.3 | — | — | VulDB | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123861 |
WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120839 |
WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability | HIGH | 8.8 | 8.8 | — | Patchstack | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-120841 |
WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability | HIGH | 8.8 | 8.8 | — | Patchstack | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-121777 |
WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123467 |
WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122659 |
WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability | MEDIUM | 5.4 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121579 |
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XS… | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121575 |
WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122660 |
WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123483 |
WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123183 |
WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123474 |
WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121775 |
WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123462 |
WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122669 |
WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122663 |
WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121784 |
WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123477 |
WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123963 |
OpenBMB Internet of Agents Agent Registry app.py register missing authentication | MEDIUM | 6.9 | — | — | VulDB | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120579 |
Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripti… | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-109973 |
Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Param… | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122041 |
Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Del… | CRITICAL | 9.1 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-119156 |
Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotl… | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-119498 |
WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121765 |
WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability | HIGH | 7.1 | — | — | Patchstack | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123776 |
RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or dev… | — | — | — | — | CPANSec | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-93429 |
VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]… | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-121977 |
JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property | MEDIUM | 5.4 | — | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120509 |
Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter | MEDIUM | 4.7 | 4.7 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-115548 |
Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-111317 |
JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |