CVE Vulnerability Database

Browse vulnerabilities in plain English. Updated hourly from NVD, CVE List, GHSA, OSV, CISA KEV, EPSS and Vulnrichment.

Last 24 hours: 1991 vulnerabilities 7 days: 34899

16 critical 131 high 232 medium 20 low 1592 awaiting score

Latest:

ScoreVulnerabilityExploit oddsAge

4.7 iWebShop-5 search function allows remote database tampering CVE-2026-112032 The search feature in iWebShop-5 versions up to 5.16 can be tricked into running unintended database commands, letting attackers read, change, or delete data. T - 1h 3.5 Chamilo LMS lets attackers run malicious scripts CVE-2026-112031 The Ticket module in Chamilo LMS versions up to 1.11.40, 2.0.3 and 3.0.1 can be tricked into executing unwanted code when a specially crafted project name is su - 1h 5.1 Bootstrap Shortcodes plugin lets logged‑in users run scripts CVE-2026-112111 The Bootstrap Shortcodes add‑on for WordPress versions earlier than 3.4.6 lets someone with a contributor or higher account add code that will run in any visito - 1h 5.5 light0011 CMS VoteController allows remote logic error CVE-2026-112028 The VoteController component in light0011 CMS can be tricked by sending a specially crafted X-Requested-With header, causing it to process requests incorrectly. - 1h 5.5 light0011 CMS discloses file names via Uploadify CVE-2026-112027 The Uploadify component in light0011 CMS reveals the existence of files and directories when a remote user supplies a filename to the check-exists.php script. T - 1h 2.9 light0011 CMS weak SHA-1 password hashing CVE-2026-112026 The content management system light0011 CMS stores passwords using the outdated SHA‑1 algorithm, which can be broken more easily than modern methods. This makes - 1h - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2026-108519 - 1h 6.3 diem-project dmDataLoad.php allows default password CVE-2026-112030 The dmDataLoad.php file in diem-project versions up to 5.1.3 uses a default password that can be triggered remotely. An attacker could gain access without knowi - 1h 2.3 BIRD daemon can let peers filter traffic improperly CVE-2026-112112 The BIRD Internet Routing Daemon’s IPv6 flow rules can be tricked, allowing a trusted network partner to add rules that affect traffic outside the intended addr - 1h 1.1 diem up to 5.1.3 allows easy password cracking CVE-2026-112029 The diEM software (versions through 5.1.3) uses a weak method to store passwords, making them easier to guess if an attacker can get access to the password file - 1h

Recent days

Today 0 No vulnerabilities Yesterday 1991 Sat 17 Oct 5130 Fri 16 Oct 9671 Thu 15 Oct 10217 Wed 14 Oct 3895 Tue 13 Oct 3995

RSS feed · Data sourced from NVD, CVE List, GHSA, OSV, CISA KEV, EPSS, and Vulnrichment.