Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
83,150 matching · page 74/1663Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-117726(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117725(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117724(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117723(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117722(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117721(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117720(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117719(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117718(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117717(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117716(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117715(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117714(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117713(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117712(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117711(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117710(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117709(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117708(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117707(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117706(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117705(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117704(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117703(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117702(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117701(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117700(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117699(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117698(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117697(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117696(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117695(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117694(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117693(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-117692(opens NVD record) | Unscored | — | Rejected reason: Reserved in error; never associated with a vulnerability. | Oct 28, 2026 |
| CVE-2026-115223(opens NVD record) | Medium | 4.9 | The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys. | Oct 28, 2026 |
| CVE-2026-112198(opens NVD record) | Unscored | — | XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed. | Oct 28, 2026 |
| CVE-2026-112197(opens NVD record) | Unscored | — | Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability. | Oct 28, 2026 |
| CVE-2026-110541(opens NVD record) | High | 7.2 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution. | Oct 28, 2026 |
| CVE-2026-110540(opens NVD record) | High | 7.1 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized operation. | Oct 28, 2026 |
| CVE-2026-110508(opens NVD record) | Medium | 5.3 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled. | Oct 28, 2026 |
| CVE-2026-106648(opens NVD record) | Medium | 5.3 | The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value. | Oct 28, 2026 |
| CVE-2026-103799(opens NVD record) | Critical | 9.6 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized system operation on managed systems. | Oct 28, 2026 |
| CVE-2026-103792(opens NVD record) | Critical | 9.6 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access to managed systems. | Oct 28, 2026 |
| CVE-2026-103780(opens NVD record) | Critical | 9.8 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution. | Oct 28, 2026 |
| CVE-2026-103779(opens NVD record) | High | 8.3 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | Oct 28, 2026 |
| CVE-2026-103330(opens NVD record) | Medium | 5.3 | The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment. | Oct 28, 2026 |
| CVE-2026-103313(opens NVD record) | Medium | 5.3 | The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid. | Oct 28, 2026 |
| CVE-2026-101274(opens NVD record) | Unscored | — | When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration. | Oct 28, 2026 |
| CVE-2026-101273(opens NVD record) | Unscored | — | Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card. | Oct 28, 2026 |