Export limit exceeded: 417581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417581 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62131 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | ||||
| CVE-2026-62016 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | ||||
| CVE-2026-62015 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | ||||
| CVE-2026-62014 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | ||||
| CVE-2026-62011 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | ||||
| CVE-2026-62010 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | ||||
| CVE-2026-62009 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | ||||
| CVE-2026-62005 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | ||||
| CVE-2026-62004 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | ||||
| CVE-2026-62003 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | ||||
| CVE-2026-61998 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | ||||
| CVE-2026-61997 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | ||||
| CVE-2026-61996 | 2026-10-30 | 8.5 High | ||
| Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. | ||||
| CVE-2026-61992 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | ||||
| CVE-2026-61991 | 2026-10-30 | 10 Critical | ||
| Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | ||||
| CVE-2026-61989 | 2 Merv Barrett, Wordpress-extensions | 2 Easy Property Listings, Easy Property Listings | 2026-10-30 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | ||||
| CVE-2026-5461 | 2 Wordpress-extensions, Wpmudev | 2 Forminator Forms, Forminator Forms | 2026-10-30 | 6.5 Medium |
| The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory. | ||||
| CVE-2026-57207 | 1 Netboxlabs | 1 Netbox-mcp-server | 2026-10-30 | 5.9 Medium |
| NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1. | ||||
| CVE-2026-54865 | 2026-10-30 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. | ||||
| CVE-2026-54864 | 2026-10-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | ||||