Mobile · coming soon
The mobile layout isn't finished yet and currently breaks parts of the site. Come back on a larger screen in the meantime. Mobile support is on the way.
Trackers · Security
Every newly published CVE, the public ID given to a software security flaw, with its severity score. Hundreds come out every day; filter down to what matters to you.
4375 results.
Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-352 · NVD · Advisory
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-79 · NVD · Advisory
A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990. Affected is the function _detail of the file application/controllers/doc.php of the component URI Sanitizer. The manipulation of the argument uri_string leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model t…
Published Oct 26, 2026 by VulDB · CVSS 4.0 · CWE-22 · NVD · Advisory
Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-862 · NVD · Advisory
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-79 · NVD · Advisory
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2.4.1.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-79 · NVD · Advisory
Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-862 · NVD · Advisory
Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser.
Published Oct 26, 2026 by INCIBE · CVSS 4.0 · CWE-79 · NVD · Advisory
A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor w…
Published Oct 26, 2026 by VulDB · CVSS 4.0 · CWE-346, CWE-345 · NVD · Advisory
A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 in…
Published Oct 26, 2026 by bizerba · CVSS 3.1 · CWE-532 · NVD · Advisory
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
Published Oct 26, 2026 by VulDB · CVSS 4.0 · CWE-94, CWE-74 · NVD · Advisory
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who …
Published Oct 26, 2026 by INCIBE · CVSS 4.0 · CWE-79 · NVD · Advisory
A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published Oct 26, 2026 by VulDB · CVSS 4.0 · CWE-93, CWE-74 · NVD · Advisory
A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure b…
Published Oct 26, 2026 by VulDB · CVSS 4.0 · CWE-434, CWE-284 · NVD · Advisory
SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.
Published Oct 26, 2026 by ENISA · CVSS 3.1 · CWE-125, CWE-787, CWE-191, CWE-129 · NVD · Advisory
Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.
Published Oct 26, 2026 by jpcert · CVSS 4.0 · CWE-304 · NVD · Advisory
SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.
Published Oct 26, 2026 by ENISA · CVSS 3.1 · CWE-476, CWE-690 · NVD · Advisory
SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device presenting more than EC_MAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory str…
Published Oct 26, 2026 by ENISA · CVSS 3.1 · CWE-787, CWE-129, CWE-120 · NVD · Advisory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose flags the fix …
Published Oct 26, 2026 by apache · CVSS 3.1 · CWE-22 · NVD · Advisory
SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the at…
Published Oct 26, 2026 by ENISA · CVSS 3.1 · CWE-787, CWE-131, CWE-120 · NVD · Advisory
Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-862 · NVD · Advisory
Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-352 · NVD · Advisory
Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.
Published Oct 26, 2026 by Patchstack · CVSS 3.1 · CWE-862 · NVD · Advisory
A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published Oct 26, 2026 by VulDB · CVSS 4.0 · CWE-93, CWE-74 · NVD · Advisory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling tool in CLI mode, the default, and tells it where to write the converted document through the --output flag. When the CamelDoclingOutputFilePath header was …
Published Oct 26, 2026 by apache · CVSS 3.1 · CWE-22 · NVD · Advisory
Insufficient Session Expiration vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.16.0 before 4.18.5, from 4.19.0 before 4.22.2. When token introspection is enabled on the camel-keycloak KeycloakSecurityPolicy (useTokenIntrospection=true), the security processor validates the access token of a request by sending it to Keycloak's OAuth 2.0 token introspection endpoint, an…
Published Oct 26, 2026 by apache · CVSS 3.1 · CWE-613 · NVD · Advisory
SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.
Published Oct 26, 2026 by ENISA · CVSS 3.1 · CWE-125, CWE-195, CWE-200 · NVD · Advisory
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the keyName optio…
Published Oct 26, 2026 by apache · CVSS 3.1 · CWE-917 · NVD · Advisory
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.2. When the CoAP consumer could not build its response once the route had completed, CamelCoapResource caught the resulting exception and sent its message back to the CoAP client as the payload of a 5.00 Internal Server Err…
Published Oct 26, 2026 by apache · CVSS 3.1 · CWE-209 · NVD · Advisory
MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that…
Published Oct 26, 2026 by CIRCL · CVSS 4.0 · CWE-20 · NVD · Advisory
CVE records are from the CVE Program (cve.org), used under its terms of use. Severity is the issuer's own CVSS score where given, otherwise CISA's; "exploit code public" is CISA's assessment.