Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
83,150 matching · page 55/1663Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-62016(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | Oct 29, 2026 |
| CVE-2026-62015(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | Oct 29, 2026 |
| CVE-2026-62014(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | Oct 29, 2026 |
| CVE-2026-62013(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | Oct 29, 2026 |
| CVE-2026-62012(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | Oct 29, 2026 |
| CVE-2026-62011(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | Oct 29, 2026 |
| CVE-2026-62010(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | Oct 29, 2026 |
| CVE-2026-62009(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | Oct 29, 2026 |
| CVE-2026-62008(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | Oct 29, 2026 |
| CVE-2026-62006(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | Oct 29, 2026 |
| CVE-2026-62005(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | Oct 29, 2026 |
| CVE-2026-62004(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | Oct 29, 2026 |
| CVE-2026-62003(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | Oct 29, 2026 |
| CVE-2026-62002(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | Oct 29, 2026 |
| CVE-2026-62001(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | Oct 29, 2026 |
| CVE-2026-61998(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | Oct 29, 2026 |
| CVE-2026-61997(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | Oct 29, 2026 |
| CVE-2026-61996(opens NVD record) | High | 8.5 | Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. | Oct 29, 2026 |
| CVE-2026-61995(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. | Oct 29, 2026 |
| CVE-2026-61993(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. | Oct 29, 2026 |
| CVE-2026-61992(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | Oct 29, 2026 |
| CVE-2026-61991(opens NVD record) | Critical | 10.0 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | Oct 29, 2026 |
| CVE-2026-61989(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | Oct 29, 2026 |
| CVE-2026-61988(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions. | Oct 29, 2026 |
| CVE-2026-54866(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions. | Oct 29, 2026 |
| CVE-2026-54865(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. | Oct 29, 2026 |
| CVE-2026-54864(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | Oct 29, 2026 |
| CVE-2026-54860(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | Oct 29, 2026 |
| CVE-2026-54859(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | Oct 29, 2026 |
| CVE-2026-54858(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | Oct 29, 2026 |
| CVE-2026-54857(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | Oct 29, 2026 |
| CVE-2026-54856(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | Oct 29, 2026 |
| CVE-2026-48200(opens NVD record) | Medium | 5.3 | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0. | Oct 29, 2026 |
| CVE-2026-42701(opens NVD record) | High | 7.2 | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | Oct 29, 2026 |
| CVE-2026-42694(opens NVD record) | Medium | 4.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. | Oct 29, 2026 |
| CVE-2026-42692(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | Oct 29, 2026 |
| CVE-2026-42690(opens NVD record) | Medium | 5.4 | Subscriber Broken Access Control in LearnPress <= 4.4.10 versions. | Oct 29, 2026 |
| CVE-2026-27394(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | Oct 29, 2026 |
| CVE-2026-20942(opens NVD record) | Medium | 4.3 | Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | Oct 29, 2026 |
| CVE-2026-18894(opens NVD record) | Medium | 6.5 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code. | Oct 29, 2026 |
| CVE-2026-119145(opens NVD record) | Critical | 9.9 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achieve remote code execution on the server. | Oct 29, 2026 |
| CVE-2026-119144(opens NVD record) | High | 8.8 | Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates in an unrestricted context. | Oct 29, 2026 |
| CVE-2026-119143(opens NVD record) | Medium | 4.8 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated addresses, causing Direct{Source,Destination}::remaining to panic and crash WASIp3 embedders. | Oct 29, 2026 |
| CVE-2026-119142(opens NVD record) | Medium | 4.8 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::call_async can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting error, crashing embedders that cancel pending calls. | Oct 29, 2026 |
| CVE-2026-119141(opens NVD record) | Medium | 5.3 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, such as cancelling the active read or re-waiting a waitable-set, crashing the host. | Oct 29, 2026 |
| CVE-2026-119140(opens NVD record) | Medium | 4.8 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing an undisposed fiber drop that crashes embedders. | Oct 29, 2026 |
| CVE-2026-119139(opens NVD record) | Medium | 4.8 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export through Func::call. | Oct 29, 2026 |
| CVE-2026-119138(opens NVD record) | Medium | 4.8 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store. | Oct 29, 2026 |
| CVE-2026-119137(opens NVD record) | Medium | 5.3 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack. | Oct 29, 2026 |
| CVE-2026-119136(opens NVD record) | Medium | 4.8 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables. | Oct 29, 2026 |