CVE Database
29323 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-109848 | MEDIUM | 4.2 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API d… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-109209 | MEDIUM | 6.4 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plug… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-107745 | MEDIUM | 4.2 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to … |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-107625 | MEDIUM | 6.4 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Mem… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-105272 | MEDIUM | 4.2 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionalit… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2015-20129 | HIGH | 8.8 | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to p… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2014-125138 | HIGH | 8.8 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 cont… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2014-125137 | MEDIUM | 6.5 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 cont… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2014-125136 | MEDIUM | 5.9 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 cont… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2013-20009 | MEDIUM | 4.8 | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows aut… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2013-20008 | MEDIUM | 6.8 | Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to c… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2013-20007 | HIGH | 7.2 | Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authentic… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118272 | MEDIUM | 4.3 | A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118271 | MEDIUM | 4.3 | A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknow… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-106013 | CRITICAL | 9.8 | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Soc… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-110879 | CRITICAL | 9.8 | jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected cla… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-110747 | HIGH | 7.5 | ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118129 | MEDIUM | 6.3 | A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc.… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-104895 | HIGH | 7.5 | The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken fro… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-104016 | HIGH | 7.5 | ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len)… |
T1190
T1203
|
|
2026-10-28 |