CVE Database
1963 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-100716 | CRITICAL | 9.9 | Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (… | — |
|
2026-09-26 |
| CVE-2026-100715 | CRITICAL | 9.6 | Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP dat… | — |
|
2026-09-26 |
| CVE-2026-100714 | CRITICAL | 9.1 | Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlik… | — |
|
2026-09-26 |
| CVE-2026-100706 | CRITICAL | 9.9 | kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath… | — |
|
2026-09-26 |
| CVE-2026-18143 | CRITICAL | 9.8 | The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in a… |
T1190
T1059
+1
|
|
2026-09-26 |
| CVE-2026-97064 | CRITICAL | 9.1 | X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled… | — |
|
2026-09-25 |
| CVE-2026-97063 | CRITICAL | 9.1 | X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated end… | — |
|
2026-09-25 |
| CVE-2026-92161 | CRITICAL | 9.8 | FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other pro… | — |
|
2026-09-25 |
| CVE-2026-62262 | CRITICAL | 9.1 | Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earl… | — |
|
2026-09-25 |
| CVE-2026-42322 | CRITICAL | 9.1 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/… | — |
|
2026-09-25 |
| CVE-2026-39353 | CRITICAL | 9.1 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. … | — |
|
2026-09-25 |
| CVE-2026-93647 | CRITICAL | 9.3 | An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. … | — |
|
2026-09-25 |
| CVE-2026-93643 | CRITICAL | 9.8 | When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an … | — |
|
2026-09-25 |
| CVE-2026-93642 | CRITICAL | 9.3 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Z… | — |
|
2026-09-25 |
| CVE-2026-93641 | CRITICAL | 9.3 | An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Z… | — |
|
2026-09-25 |
| CVE-2026-100075 | CRITICAL | 9.8 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ct… | — |
|
2026-09-25 |
| CVE-2026-92609 | CRITICAL | 9.8 | Session fixation in HTTP management authentication allows remote attackers to gain unauthorized acce… | — |
|
2026-09-25 |
| CVE-2026-93399 | CRITICAL | 9.1 | The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to,… | — |
|
2026-09-25 |
| CVE-2026-89055 | CRITICAL | 9.1 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in a… | — |
|
2026-09-25 |
| CVE-2026-14281 | CRITICAL | 9.8 | The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin fo… | — |
|
2026-09-25 |