Total
417697 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-27061 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | |||||
| CVE-2026-118090 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | |||||
| CVE-2026-119619 | 2026-10-30 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-62023 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26. | |||||
| CVE-2026-115947 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | |||||
| CVE-2026-116405 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. | |||||
| CVE-2026-118089 | 2026-10-30 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | |||||
| CVE-2026-119526 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0. | |||||
| CVE-2026-62056 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6. | |||||
| CVE-2026-39732 | 2026-10-30 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | |||||
| CVE-2026-62121 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26. | |||||
| CVE-2026-119553 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../ sequences, copying server files like config.php into their draft area. | |||||
| CVE-2026-119556 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them. | |||||
| CVE-2026-115642 | 2026-10-30 | N/A | 8.3 HIGH | ||
| In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges. | |||||
| CVE-2026-119568 | 2026-10-30 | N/A | 7.4 HIGH | ||
| vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data. | |||||
| CVE-2025-49602 | 2026-10-30 | N/A | N/A | ||
| An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), which results in the former administrator retaining access that they should no longer have. | |||||
| CVE-2026-119567 | 2026-10-30 | N/A | 3.1 LOW | ||
| vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories. | |||||
| CVE-2026-9239 | 2026-10-30 | N/A | 6.4 MEDIUM | ||
| The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick. | |||||
| CVE-2026-97782 | 1 Microsoft | 1 Sharepoint Server | 2026-10-30 | N/A | 6.8 MEDIUM |
| Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. | |||||
| CVE-2026-97638 | 2026-10-30 | N/A | 7.5 HIGH | ||
| The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue later" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page. | |||||