CVE records
39811 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.
| CVE | Title | Published | Top score | KEV |
|---|---|---|---|---|
| CVE-2026-128790 | 13 Nov 2026 | 7.1 | ||
| CVE-2026-77706 | Denial of Service via Maliciously Compressed Spreadsheet File in Fileorbis's FileOrbis NextGen FileServer | 13 Nov 2026 | 6.5 | |
| CVE-2026-92241 | Bluetooth Classic AVRCP browsing channel can deadlock the Bluetooth receive thread, hanging the host | 13 Nov 2026 | 5.7 | |
| CVE-2026-116411 | 13 Nov 2026 | 8.8 | ||
| CVE-2026-91094 | 13 Nov 2026 | |||
| CVE-2026-109095 | X.Org Server glamor Xv Image Size Integer Overflow | 13 Nov 2026 | 6.9 | |
| CVE-2026-82179 | 13 Nov 2026 | 4.9 | ||
| CVE-2026-116412 | 13 Nov 2026 | 5.5 | ||
| CVE-2026-127125 | NULL pointer dereference when a response fragment is not acknowledged | 13 Nov 2026 | 6.0 | |
| CVE-2026-116413 | 13 Nov 2026 | 7.1 | ||
| CVE-2026-127124 | RPC session pool exhausted by unfinished fragmented requests | 13 Nov 2026 | 7.1 | |
| CVE-2026-127123 | Fragment with another data representation releases an Application Relationship | 13 Nov 2026 | 6.0 | |
| CVE-2026-127122 | Out-of-bounds write with too many MCR blocks in a Connect request | 13 Nov 2026 | 7.2 | |
| CVE-2026-124762 | RPC reject, fault and cancel PDUs abort an Application Relationship | 13 Nov 2026 | 6.0 | |
| CVE-2026-124761 | A DCP Set of the IP suite that is refused is still stored | 13 Nov 2026 | 7.1 | |
| CVE-2026-124760 | Alarm receiver stops delivering alarms after a malformed alarm notification | 13 Nov 2026 | 2.3 | |
| CVE-2026-124758 | Integer underflow of the record data length in IODWrite requests | 13 Nov 2026 | 2.3 | |
| CVE-2026-109096 | X.Org Server XvPutImage Negative Image Size Length Bypass | 13 Nov 2026 | 5.5 | |
| CVE-2026-124759 | Alarm frames are accepted from any source address | 13 Nov 2026 | 7.1 | |
| CVE-2026-125800 | WordPress Spectra plugin <= 2.20.5 - Cross Site Scripting (XSS) vulnerability | 13 Nov 2026 | 6.5 | |
| CVE-2026-86353 | 13 Nov 2026 | 5.0 | ||
| CVE-2026-107525 | 13 Nov 2026 | 5.3 | ||
| CVE-2026-125801 | WordPress WooCommerce plugin 11.0.0-11.2.2 - Race Condition vulnerability | 13 Nov 2026 | 6.5 | |
| CVE-2026-105880 | WordPress WebinarIgnition plugin <= 4.27.125 - Insecure Direct Object References (IDOR) vulnerability | 13 Nov 2026 | 5.3 | |
| CVE-2026-112830 | WordPress Brizy plugin <= 2.8.25 - Broken Access Control vulnerability | 13 Nov 2026 | 5.3 | |
| CVE-2026-125816 | WordPress MapSVG plugin <= 9.0.4 - Cross Site Scripting (XSS) vulnerability | 13 Nov 2026 | 6.5 | |
| CVE-2026-119518 | WordPress Royal Elementor Addons plugin <= 1.7.1070 - Cross Site Scripting (XSS) vulnerability | 13 Nov 2026 | 6.5 | |
| CVE-2026-121721 | WordPress Gutenberg Blocks plugin <= 3.7.6 - Cross Site Scripting (XSS) vulnerability | 13 Nov 2026 | 6.5 | |
| CVE-2025-41725 | DoS vulnerability in JBL Flip 4 | 13 Nov 2026 | 6.5 | |
| CVE-2026-125814 | WordPress Product Feed PRO for WooCommerce plugin <= 13.5.8 - Content Injection vulnerability | 13 Nov 2026 | 5.3 | |
| CVE-2026-125833 | WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.24.0 - Cross Site Scripting (XSS) vulnerability | 13 Nov 2026 | 6.5 | |
| CVE-2026-95518 | TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus Package Installer | 13 Nov 2026 | 7.0 | |
| CVE-2026-128834 | WordPress Spectra plugin <= 2.20.5 - Broken Access Control vulnerability | 13 Nov 2026 | 5.3 | |
| CVE-2026-121771 | WordPress Gutenberg Blocks plugin <= 3.7.6 - Sensitive Data Exposure vulnerability | 13 Nov 2026 | 5.3 | |
| CVE-2026-107526 | 13 Nov 2026 | 4.6 | ||
| CVE-2026-125815 | WordPress We’re Open! plugin <= 2.8 - Content Injection vulnerability | 13 Nov 2026 | 5.3 | |
| CVE-2026-86355 | 13 Nov 2026 | 8.3 | ||
| CVE-2026-86356 | 13 Nov 2026 | 8.8 | ||
| CVE-2026-120221 | frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect | 13 Nov 2026 | 8.2 | |
| CVE-2026-109903 | X.Org Server XvQueryImageAttributes Negative Size Reply | 13 Nov 2026 | 7.8 | |
| CVE-2026-123274 | Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch | 13 Nov 2026 | ||
| CVE-2026-123338 | Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch | 13 Nov 2026 | ||
| CVE-2026-109904 | X.Org Server XRes QueryClientIds Request Size Overflow | 13 Nov 2026 | 6.9 | |
| CVE-2026-125659 | Information Disclosure Vulnerability in eMudhra emBridge | 13 Nov 2026 | 2.1 | |
| CVE-2026-112182 | Multiple Vulnerabilities in OpenKM Community Edition | 13 Nov 2026 | 8.7 | |
| CVE-2026-112181 | Multiple Vulnerabilities in OpenKM Community Edition | 13 Nov 2026 | 8.3 | |
| CVE-2023-54423 | OpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor | 13 Nov 2026 | 8.3 | |
| CVE-2024-58404 | Zipline 3.4.5 before 3.7.10 Path Traversal via user export endpoint | 13 Nov 2026 | 8.3 | |
| CVE-2024-58405 | Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint | 13 Nov 2026 | 8.8 | |
| CVE-2025-71459 | Zipline through 4.3.2 Path Traversal via x-zipline-filename Header | 13 Nov 2026 | 8.1 |