Export limit exceeded: 417680 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417680 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417680 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-69035 | 1 Wordpress | 1 Wordpress | 2026-10-26 | 8.8 High |
| Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6. | ||||
| CVE-2026-78850 | 1 Matomo | 1 Matomo | 2026-10-26 | 5 Medium |
| An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary. | ||||
| CVE-2026-116212 | 1 Webasyst | 1 Webasyst-framework | 2026-10-26 | 5.4 Medium |
| Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions. | ||||
| CVE-2026-5147 | 1 Yunaiv | 1 Yudao-cloud | 2026-10-26 | 7.3 High |
| A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue. | ||||
| CVE-2026-107656 | 1 Fortinet | 2 Fortisandbox, Fortisandboxpaas | 2026-10-26 | 9.6 Critical |
| An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests | ||||
| CVE-2026-65218 | 2026-10-26 | N/A | ||
| The reported issue is tracked under CVE-2026-18451. This CVE ID is rejected as a duplicate. | ||||
| CVE-2026-65216 | 2026-10-26 | N/A | ||
| The reported issue is tracked under CVE-2026-18450. This CVE ID is rejected as a duplicate. | ||||
| CVE-2026-65214 | 2026-10-26 | N/A | ||
| The reported issue is tracked under CVE-2026-18449. This CVE ID is rejected as a duplicate. | ||||
| CVE-2026-65221 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65212 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-116368 | 1 Deepseek | 1 Harness | 2026-10-26 | 7.3 High |
| A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-65202 | 2026-10-26 | N/A | ||
| The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65222 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced, and the affected products are end-of-life. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65217 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65215 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-65203 | 2026-10-26 | N/A | ||
| The reported issue could not be reproduced. This CVE ID is unused by the CNA. | ||||
| CVE-2026-96867 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-26 | 7.8 High |
| Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. | ||||
| CVE-2026-116367 | 1 Deepseek | 1 Harness | 2026-10-26 | 6.3 Medium |
| A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-105010 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-10-26 | 9.8 Critical |
| Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-96868 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-10-26 | 7 High |
| Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||