CVE Database
1963 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-75873 | CRITICAL | 9.8 | The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one o… | — |
|
2026-09-30 |
| CVE-2026-103110 | CRITICAL | 9.8 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that … | — |
|
2026-09-30 |
| CVE-2026-102911 | CRITICAL | 9.9 | A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the fi… | — |
|
2026-09-30 |
| CVE-2026-103056 | CRITICAL | 9.0 | AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service … | — |
|
2026-09-30 |
| CVE-2026-102794 | CRITICAL | 9.1 | A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown proces… | — |
|
2026-09-30 |
| CVE-2026-102793 | CRITICAL | 9.1 | A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_tim… |
T1190
T1203
|
|
2026-09-30 |
| CVE-2026-103044 | CRITICAL | 9.8 | XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - Easy… | — |
|
2026-09-29 |
| CVE-2026-103041 | CRITICAL | 9.8 | LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pick… | — |
|
2026-09-29 |
| CVE-2026-103040 | CRITICAL | 9.8 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service… | — |
|
2026-09-29 |
| CVE-2026-102792 | CRITICAL | 9.1 | A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of … | — |
|
2026-09-29 |
| CVE-2026-72510 | CRITICAL | 9.0 | The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-bas… | — |
|
2026-09-29 |
| CVE-2026-72507 | CRITICAL | 9.0 | The "reportType" parameter in the product summary report feature within the balancing reports sectio… | — |
|
2026-09-29 |
| CVE-2026-71379 | CRITICAL | 10.0 | The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by … | — |
|
2026-09-29 |
| CVE-2026-70356 | CRITICAL | 9.1 | The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attack… | — |
|
2026-09-29 |
| CVE-2026-68954 | CRITICAL | 9.0 | The "pattern" parameter used in search function in the home page of the TMS application is vulnerabl… | — |
|
2026-09-29 |
| CVE-2026-68068 | CRITICAL | 9.0 | The "screenID" parameter in the electronic transaction queue viewer feature within the manual transa… | — |
|
2026-09-29 |
| CVE-2026-63713 | CRITICAL | 9.0 | The "search" parameter in the view audit logs feature within the utilities section is susceptible to… | — |
|
2026-09-29 |
| CVE-2026-96587 | CRITICAL | 10.0 | The Viidure Android application embeds permanent, plaintext cloud storage credentials within its com… | — |
|
2026-09-29 |
| CVE-2026-94952 | CRITICAL | 9.8 | A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150R… | — |
|
2026-09-29 |
| CVE-2026-79538 | CRITICAL | 9.8 | metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP i… | — |
|
2026-09-29 |