CVE-2026 list

CVE-2026 records published in October 2026

Page 10 of 14: records 9,001 to 10,000 of the 13,324 published in October 2026, newest first. The first page carries the figures for October 2026.

CVE-2026 records published in October 2026, newest first: records 9,001 to 10,000 of 13,324
CVE Summary CVSS EPSS Published Signals
CVE-2026-96261IBM Power Systems firmware buffer overflow7.3CNA v3.10.1%2026-10-12Fix
CVE-2026-96119IBM i code injection9.9CNA v3.10.5%2026-10-12Fix
CVE-2026-96012IBM Db2 Mirror for i privilege escalation9.9CNA v3.10.5%2026-10-12Fix
CVE-2026-95838containerd algorithmic complexity4.6CNA v4.00.2%2026-10-12Fix
CVE-2026-95837containerd CRI plugin: Checkpoint restore bypasses destination security context7.8CNA v3.10.1%2026-10-12Fix
CVE-2026-94451Red Hat build of Quarkus denial of service6.5CNA v3.10.3%2026-10-12Fix
CVE-2026-93892Security vulnerability identified in IBM TRIRIGA information disclosure in Admin console8.1CNA v3.10.3%2026-10-12Fix
CVE-2026-93891Security vulnerability identified in IBM TRIRIGA XXE7.6CNA v3.10.3%2026-10-12Fix
CVE-2026-93886IBM i cross-site scripting8.3CNA v3.10.2%2026-10-12Fix
CVE-2026-93695Progress ShareFile Storage Zones Controller path traversal7.4CNA v3.10.2%2026-10-12Fix
CVE-2026-93694Progress ShareFile Storage Zones Controller hard-coded cryptographic key4.0CNA v3.10.1%2026-10-12Fix
CVE-2026-93693Progress ShareFile Storage Zones Controller missing authentication6.5CNA v3.10.2%2026-10-12Fix
CVE-2026-93582OTRS authentication bypass via Spoofed Remote-User header in HTTP Basic Authentication9.4CNA v3.10.4%2026-10-12
CVE-2026-93581OTRS Insufficient Neutralization of Formula Elements in CSV Exports6.1CNA v3.10.2%2026-10-12
CVE-2026-92877Eclipse Foundation jaxb-ri (core) XML external entity injection8.3CNA v4.00.3%2026-10-12
CVE-2026-92876IBM Maximo Application Suite IoT component denial of service7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-92832IBM Aspera Enterprise WebApps information disclosure5.1CNA v3.10.1%2026-10-12Fix
CVE-2026-92682@neo4j/graphql: Authorization relationship and connection filters invert the none quantifier8.6CNA v4.00.3%2026-10-12Fix
CVE-2026-92681@neo4j/graphql: Schema-level and type-level @authentication not enforced on top-level @cypher fields9.3CNA v4.00.4%2026-10-12Fix
CVE-2026-92120Apache Allura: Oauth1 Replay Attack9.1CISA ADP v3.10.3%2026-10-12Fix
CVE-2026-92119Apache Allura: REST API mass assignment9.1CISA ADP v3.10.3%2026-10-12Fix
CVE-2026-92116Apache Allura: OAuth1 missing callback validation9.1CISA ADP v3.10.3%2026-10-12Fix
CVE-2026-90921IBM Maximo AI Service denial of service7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-90920IBM Maximo AI Service code injection9.8CNA v3.10.5%2026-10-12Fix
CVE-2026-90912IBM Maximo AI Service denial of service7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-90911IBM Maximo AI Service denial of service7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-89140Temporal Server Scheduler V2 insecure direct object reference6.0CNA v4.00.3%2026-10-12Fix
CVE-2026-87765Improper input validation in Kernel APsys DVFS5.5CNA v3.10.1%2026-10-12Fix
CVE-2026-87744Red Hat Quarkus REST Data Panache missing authorization9.1CNA v3.10.4%2026-10-12Fix
CVE-2026-87690Rapid7 Metasploit Framework ios_image_gather module path traversal8.8CNA v3.10.4%2026-10-12Exploit codeFix
CVE-2026-85976HTTP response splitting in Progress MarkLogic Server Query console5.4CNA v3.10.1%2026-10-12Fix
CVE-2026-85975Cleartext transmission in Progress MarkLogic Server Amazon S3 connections7.5CNA v3.10.2%2026-10-12Fix
CVE-2026-85974Improper TLS hostname verification in Progress MarkLogic Server7.4CNA v3.10.1%2026-10-12Fix
CVE-2026-85973Cleartext transmission in Progress MarkLogic Server cluster join operations7.4CNA v3.10.1%2026-10-12Fix
CVE-2026-85972Improper Kerberos server verification in Progress MarkLogic Server7.4CNA v3.10.3%2026-10-12Fix
CVE-2026-85971Incorrect log file permissions in Progress MarkLogic Server7.1CNA v3.10.1%2026-10-12Fix
CVE-2026-85970Improper XML external entity restriction in Progress MarkLogic Server7.1CNA v3.10.3%2026-10-12Fix
CVE-2026-85969Out-of-bounds write in Progress MarkLogic Server7.1CNA v3.10.2%2026-10-12Fix
CVE-2026-85968Out-of-bounds read in Progress MarkLogic Server7.1CNA v3.10.3%2026-10-12Fix
CVE-2026-85967Cross-site scripting in Progress MarkLogic Server6.1CNA v3.10.2%2026-10-12Fix
CVE-2026-85966Exposure of sensitive information in Progress MarkLogic Server7.7CNA v3.10.3%2026-10-12Fix
CVE-2026-85965Progress Software MarkLogic Server JavaScript engine integration use-after-free8.0CNA v3.10.2%2026-10-12Fix
CVE-2026-85964Path traversal in Progress MarkLogic Server Query console7.7CNA v3.10.4%2026-10-12Fix
CVE-2026-85963Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-85962Improper authentication in Progress MarkLogic Server SAML processing7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-85961Sensitive information exposure in Progress MarkLogic Server Azure deployments7.5CNA v3.10.4%2026-10-12Fix
CVE-2026-85960Cross-site request forgery in Progress MarkLogic Server Query console7.5CNA v3.10.2%2026-10-12Fix
CVE-2026-85959Insufficient authentication logging in Progress MarkLogic Server7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-85958Improper OAuth token validation in Progress MarkLogic Server7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-85957Improper XML external entity restriction in Progress MarkLogic Server SAML processing7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-85956Improper privilege management in Progress MarkLogic Server backup and restore operations9.6CNA v3.10.3%2026-10-12Fix
CVE-2026-85955Improper privilege management in Progress MarkLogic Server xdmp:eval-in9.9CNA v3.10.4%2026-10-12Fix
CVE-2026-85954Improper privilege management in Progress MarkLogic Server higher-order XQuery functions8.6CNA v3.10.2%2026-10-12Fix
CVE-2026-85953Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio8.5CNA v3.10.3%2026-10-12Fix
CVE-2026-85952Server-side request forgery in Progress MarkLogic Server Linux cloud deployments8.5CNA v3.10.2%2026-10-12Fix
CVE-2026-85951Server-side request forgery in Progress MarkLogic Server Azure deployments8.5CNA v3.10.2%2026-10-12Fix
CVE-2026-85950Improper privilege management in Progress MarkLogic Server REST extensions8.4CNA v3.10.3%2026-10-12Fix
CVE-2026-85949Sensitive information exposure in Progress MarkLogic Server trace logs8.1CNA v3.10.2%2026-10-12Fix
CVE-2026-85948Improper privilege management in Progress MarkLogic Server Management API9.9CNA v3.10.3%2026-10-12Fix
CVE-2026-85947Improper privilege management in Progress MarkLogic Server forest operations9.9CNA v3.10.3%2026-10-12Fix
CVE-2026-85499Apache SkyWalking BanyanDB improper authorization9.1CISA ADP v3.10.3%2026-10-12Fix
CVE-2026-85471Quay: Quay: Webhook notification SSRF -- hostname-string blocklist trivially bypassable6.4CNA v3.10.2%2026-10-12
CVE-2026-85457IBM Planning Analytics Local stack-based buffer overflow8.1CNA v3.10.4%2026-10-12Fix
CVE-2026-84418IBM DataStage on Cloud Pak for Data improper certificate validation7.4CNA v3.10.1%2026-10-12Fix
CVE-2026-843600xJacky nginx-ui nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools8.1CNA v3.10.3%2026-10-12Fix
CVE-2026-843210xJacky nginx-ui insufficient session expiration5.4CNA v3.10.2%2026-10-12Fix
CVE-2026-843200xJacky nginx-ui nginx UI: Auto backup name allows path traversal outside validated storage path6.3CNA v3.10.2%2026-10-12Fix
CVE-2026-843190xJacky nginx-ui MCP configuration interface protection mechanism failure8.3CNA v3.10.3%2026-10-12Fix
CVE-2026-843180xJacky nginx-ui Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation Authenticated RCE8.8CNA v3.10.6%2026-10-12Fix
CVE-2026-843170xJacky nginx-ui MCP nginx_config_add vulnerability8.8CNA v3.10.4%2026-10-12Fix
CVE-2026-843160xJacky nginx-ui ValidateConfigDirectives vulnerability8.8CNA v3.10.4%2026-10-12Fix
CVE-2026-843150xJacky nginx-ui nginx UI OTP secure-session step-up is missing on sensitive mutation routes8.3CNA v3.10.3%2026-10-12Fix
CVE-2026-843140xJacky nginx-ui Nginx UI: Account takeover8.7CNA v4.00.3%2026-10-12Fix
CVE-2026-843130xJacky nginx-ui improper authentication8.8CNA v3.10.4%2026-10-12Fix
CVE-2026-843120xJacky nginx-ui nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)7.1CNA v3.10.2%2026-10-12Fix
CVE-2026-84286Turboderp-org ExLlamaV3 OOB read/Write via Negative Array Index in exllamav3_ext Kernel Table9.8CISA ADP v3.10.6%2026-10-12Fix
CVE-2026-84167Hotel Booking WordPress plugin Subscriber+ Booking order PII disclosure via IDOR4.3CISA ADP v3.10.2%2026-10-12
CVE-2026-84166Hotel Booking WordPress plugin Booking order creation, deletion, and modification via CSRF4.3CISA ADP v3.10.1%2026-10-12
CVE-2026-83536Red Hat OpenStack Platform openstack-network-exporter HTTP server denial of service5.3CNA v3.10.3%2026-10-12
CVE-2026-83535Red Hat OpenStack Platform openstack-network-exporter information disclosure7.4CNA v3.10.3%2026-10-12
CVE-2026-82110IBM DataStage on Cloud Pak for Data path traversal9.6CNA v3.10.5%2026-10-12Fix
CVE-2026-82108IBM DataStage on Cloud Pak for Data code injection8.8CNA v3.10.5%2026-10-12Fix
CVE-2026-82103IBM DataStage on Cloud Pak for Data information disclosure9.6CNA v3.10.3%2026-10-12Fix
CVE-2026-82101IBM DataStage on Cloud Pak for Data path traversal9.6CNA v3.10.4%2026-10-12Fix
CVE-2026-82096IBM DataStage on Cloud Pak for Data command injection8.8CNA v3.10.4%2026-10-12Fix
CVE-2026-81858IBM i is affected by A denial of service vulnerability in Host Servers5.4CNA v3.10.5%2026-10-12Fix
CVE-2026-81856Terminal escape sequence injection in Hex via unneutralized server-supplied output2.3CNA v4.00.4%2026-10-12Fix
CVE-2026-78673IBM Maximo AI Service improper input validation7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-78404IBM® Db2® is vulnerable to local privilege escalation via the db2pd utility6.5CNA v3.10.1%2026-10-12Fix
CVE-2026-78359OTRS Duplicate Identity / Identity Shadowing across CustomerUser backends5.4CNA v3.10.2%2026-10-12
CVE-2026-78358OTRS cross-site request forgery in Administrative Actions4.3CNA v3.10.1%2026-10-12
CVE-2026-78357OTRS Insufficient Session Revocation for JWT Authentication9.1CNA v3.10.3%2026-10-12
CVE-2026-78356OTRS Unauthenticated Disclosure of Agent Frontend Configuration5.3CNA v3.10.3%2026-10-12
CVE-2026-78355OTRS path traversal in SendSupportBundle allows file deletion Outside the Intended Directory8.7CNA v3.10.7%2026-10-12
CVE-2026-77366obsidian-tc tokens can access arbitrary configured vaults9.9CNA v3.10.3%2026-10-12Fix
CVE-2026-77364obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets6.5CNA v3.10.2%2026-10-12Fix
CVE-2026-77363obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access8.8CNA v3.10.2%2026-10-12Fix
CVE-2026-75888Openshift/console: Openshift/console: Authenticated SSRF via helm chart URL fetch7.7CNA v3.10.3%2026-10-12Fix
CVE-2026-75881IBM Maximo Application Suite IoT component denial of service7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-75782IBM Aspera Enterprise WebApps untrusted search path7.8CNA v3.10.1%2026-10-12Fix
CVE-2026-75621IBM Aspera Enterprise WebApps execution with unnecessary privileges6.2CNA v3.10.1%2026-10-12Fix
CVE-2026-75095IBM Aspera Enterprise WebApps denial of service7.5CNA v3.10.3%2026-10-12Fix
CVE-2026-75076IBM Aspera Enterprise WebApps information disclosure4.3CNA v3.10.2%2026-10-12Fix
CVE-2026-75063IBM Planning Analytics Local cross-site scripting5.4CNA v3.10.2%2026-10-12Fix
CVE-2026-75061IBM Planning Analytics Local path traversal7.5CNA v3.10.4%2026-10-12Fix
CVE-2026-66086Stack-based buffer overflow in Modem8.3CNA v3.10.5%2026-10-12Fix
CVE-2026-66085Information disclosure in Modem5.5CNA v3.10.1%2026-10-12Fix
CVE-2026-65954PHPCSUtils: Remote code execution via eval in AbstractArrayDeclarationSniff::getActualArrayKey8.6CNA v3.10.2%2026-10-12Fix
CVE-2026-61994WP-Members WordPress plugin broken access control5.4CNA v3.10.1%2026-10-12
CVE-2026-59977ConvertX: Cross-site request forgery (CSRF) leading to Unauthorized Data Destruction8.1CNA v3.10.1%2026-10-12Fix
CVE-2026-59976ConvertX: Path traversal vulnerability leading to arbitrary file write8.1CNA v3.10.6%2026-10-12Fix
CVE-2026-57143MervinPraison praisonaiagents PraisonAI: Server-side request forgery in SearxNG / search_web tools8.8CNA v3.10.2%2026-10-12Fix
CVE-2026-57118PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints9.8CNA v3.10.3%2026-10-12Fix
CVE-2026-54459FileRise: Missing CSRF enforcement for file creation and share-link creation4.3CNA v3.10.1%2026-10-12Fix
CVE-2026-53997NetHerman Portal del Hermano account takeover via Password Reset Oracle9.1CNA v4.00.4%2026-10-12Fix
CVE-2026-53922OpenWrt odhcpd dhcpv6_ia_handle_IAs stack-based buffer overflow6.5CNA v3.10.3%2026-10-12Fix
CVE-2026-52903manageiq YAML safe_load production fallback to unsafe_load enables RCE via deserialization8.8CNA v3.10.4%2026-10-12
CVE-2026-49484codefori vscode-ibmi code for IBM i: Temporary files are visible to all users5.1CNA v4.00.2%2026-10-12Fix
CVE-2026-49483vscode-ibmi IBMiComponent arbitrary code execution8.9CNA v4.00.1%2026-10-12Fix
CVE-2026-48212OTRS stored XSS in external pages4.8CNA v3.10.1%2026-10-12
CVE-2026-48211OTRS cross-site request forgery in Import/Export Admin console5.4CNA v3.10.1%2026-10-12
CVE-2026-44828Qexo initialization endpoint can reset setup state and expose stored credentials9.3CNA v4.00.4%2026-10-12Fix
CVE-2026-42689Events Manager WordPress plugin race condition3.7CNA v3.10.2%2026-10-12
CVE-2026-41510OWASP Coraza WAF ArgumentLimit protection mechanism failure7.2CNA v3.10.5%2026-10-12Fix
CVE-2026-41508OWASP Coraza WAF multipart processor protection mechanism failure5.8CNA v3.10.5%2026-10-12Fix
CVE-2026-41504OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery5.8CNA v3.10.4%2026-10-12Fix
CVE-2026-41210Moonlight Qt H.264 SPS fixup path out-of-bounds write6.5CNA v3.10.3%2026-10-12Fix
CVE-2026-21139Samsung Mobile Samsung Continuity Service improper access control7.3CNA v4.00.1%2026-10-12
CVE-2026-21138Samsung Mobile Smart Switch insufficient verification of data authenticity6.9CNA v4.00.1%2026-10-12
CVE-2026-21137Samsung Mobile Smart Switch path traversal5.1CNA v4.00.2%2026-10-12
CVE-2026-21136Samsung Mobile Smart Switch improper authorization6.8CNA v4.00.1%2026-10-12
CVE-2026-21135Samsung Mobile Samsung Internet improper access control5.9CNA v4.00.1%2026-10-12
CVE-2026-21134Samsung Mobile Samsung Flow improper authentication6.1CNA v4.00.2%2026-10-12
CVE-2026-21133Samsung Mobile Samsung Flow path traversal5.1CNA v4.00.1%2026-10-12
CVE-2026-21132Samsung Mobile Samsung Internet improper input validation6.0CNA v4.00.5%2026-10-12
CVE-2026-21131Samsung Mobile Samsung Flow incorrect default permissions2.1CNA v4.00.1%2026-10-12
CVE-2026-21130Samsung Mobile Samsung Checkout CreditCardRetrieveActivity improper input validation5.1CNA v4.00.1%2026-10-12
CVE-2026-21129Samsung Mobile Samsung Checkout GuestCreditCardRegisterActivity improper input validation5.1CNA v4.00.1%2026-10-12
CVE-2026-21128Samsung Mobile Samsung Checkout CreditCardRegisterActivity improper input validation5.1CNA v4.00.1%2026-10-12
CVE-2026-21127Samsung Mobile Samsung Account improper export of Android application components6.9CNA v4.00.1%2026-10-12
CVE-2026-21126Samsung Mobile Devices improper input validation6.9CNA v4.00.2%2026-10-12
CVE-2026-21125Samsung Mobile Devices improper input validation8.6CNA v4.00.2%2026-10-12
CVE-2026-21124Samsung Mobile Devices improper input validation8.6CNA v4.00.2%2026-10-12
CVE-2026-21123Samsung Mobile Devices Locksettings improper privilege management6.7CNA v4.00.1%2026-10-12
CVE-2026-21122Samsung Mobile Devices libsamsungtts.so out-of-bounds write7.0CNA v4.00.2%2026-10-12
CVE-2026-21121Samsung Mobile Devices CmcCore improper permissions6.9CNA v4.00.2%2026-10-12
CVE-2026-21120Samsung Mobile Devices WSM service use-after-free8.9CNA v4.00.2%2026-10-12
CVE-2026-21119Samsung Mobile Devices lib_sag_ai_sound_sep_v2.00.so out-of-bounds read4.8CNA v4.00.1%2026-10-12
CVE-2026-21118Samsung Mobile Devices DownloadProvider improper access control6.9CNA v4.00.1%2026-10-12
CVE-2026-21117Samsung Mobile Devices CocktailBarService improper access control5.1CNA v4.00.2%2026-10-12
CVE-2026-21116Samsung Mobile Devices libsmkvextractor.so out-of-bounds write5.1CNA v4.00.2%2026-10-12
CVE-2026-21115Samsung Mobile Devices libcodec2-sec-flacdec.so out-of-bounds write5.1CNA v4.00.2%2026-10-12
CVE-2026-21114Samsung Mobile Devices libsmkvextractor.so out-of-bounds write7.0CNA v4.00.2%2026-10-12
CVE-2026-19938zephyrproject zephyr Bluetooth ATT transmit path use-after-free5.9CNA v3.10.2%2026-10-12Fix
CVE-2026-19937zephyrproject zephyr Bluetooth Mesh Access layer vulnerability5.7CNA v3.10.2%2026-10-12
CVE-2026-19936zephyrproject zephyr Bluetooth Mesh delayable message queue null pointer dereference4.8CNA v3.10.1%2026-10-12
CVE-2026-19627IBM Planning Analytics Local path traversal8.2CNA v3.10.4%2026-10-12Fix
CVE-2026-19622IBM Planning Analytics Local authentication bypass8.8CNA v3.10.3%2026-10-12Fix
CVE-2026-19620IBM Planning Analytics Local authentication bypass8.8CNA v3.10.3%2026-10-12Fix
CVE-2026-18541IBM Planning Analytics Local Web UI stored cross-site scripting6.4CNA v3.10.1%2026-10-12Fix
CVE-2026-18537IBM Maximo Application Suite Location service for Esri component code execution8.7CNA v3.10.2%2026-10-12Fix
CVE-2026-18533IBM Maximo Application Suite Location service for Esri component code execution6.5CNA v3.10.2%2026-10-12Fix
CVE-2026-18529IBM Maximo Application Suite Location service for Esri component code execution8.7CNA v3.10.7%2026-10-12Fix
CVE-2026-18517IBM Maximo Application Suite Location service for Esri component improper access control7.7CNA v3.10.2%2026-10-12Fix
CVE-2026-18513IBM Maximo Application Suite Location service for Esri component improper privilege management7.2CNA v3.10.3%2026-10-12Fix
CVE-2026-18390Command injection in Ministry of Justice's UYAP Document Editor7.8CNA v3.10.5%2026-10-12Fix
CVE-2026-18343IBM i is affected by an improper privilege management4.4CNA v3.10.1%2026-10-12Fix
CVE-2026-18318IBM i information disclosure5.3CNA v3.10.3%2026-10-12Fix
CVE-2026-18166IBM Db2 CREATE WRAPPER command improper authorization7.7CNA v3.10.4%2026-10-12Fix
CVE-2026-17487IBM i is information disclosure5.3CNA v3.10.2%2026-10-12Fix
CVE-2026-17484IBM i is information disclosure5.3CNA v3.10.1%2026-10-12Fix
CVE-2026-17475IBM Planning Analytics Local improper authorization7.1CNA v3.10.2%2026-10-12Fix
CVE-2026-16678IBM Power Systems firmware denial of service4.5CNA v3.10.2%2026-10-12Fix
CVE-2026-12613Ministry of Justice UYAP Document Editor insecure deserialization8.8CNA v3.10.3%2026-10-12Fix
CVE-2026-9191Insufficient isolation of user-supplied code in Progress MarkLogic Server9.6CNA v3.10.2%2026-10-12Fix
CVE-2026-6232Out-of-bounds write in LR11xx Transceiver5.2CNA v4.00.2%2026-10-12Fix
CVE-2026-1907Kong Gateway SQL injection in Clustering Communication (Hybrid Mode)7.5CNA v4.00.1%2026-10-12Fix
CVE-2026-108978Samsung Open Source rlottie heap-based buffer overflow5.5CNA v3.10.1%2026-10-11
CVE-2026-108976GNU Emacs incomplete denylist7.8CNA v3.10.5%2026-10-11Fix
CVE-2026-108963David-Crty databasement argument injection8.8CNA v3.11.7%2026-10-11Fix
CVE-2026-108925Cohesity improper neutralization of script-related HTML tags in a web page (basic XSS)6.1CNA v3.10.2%2026-10-11
CVE-2026-108913Omarchy inclusion of untrusted functionality7.1CNA v3.10.4%2026-10-11Fix
CVE-2026-108905pH7Builder Hard-Coded API Key Bypass via host header8.7CNA v4.00.3%2026-10-11Fix
CVE-2026-108904pH7Builder sensitive data exposure via Member API UserController7.1CNA v4.00.3%2026-10-11Fix
CVE-2026-108903pH7Builder CAPTCHA Bypass via Client-Chosen Form ID6.9CNA v4.00.3%2026-10-11Fix
CVE-2026-108902pH7Builder path traversal arbitrary file deletion via picture_link7.2CNA v4.00.4%2026-10-11Fix
CVE-2026-108891JeecgBoot missing authorization via /sys/user/getUserDetailByUserId5.3CNA v4.00.2%2026-10-11
CVE-2026-108888JeecgBoot missing authorization via /sys/sysDepartRole/exportXls5.3CNA v4.00.2%2026-10-11
CVE-2026-108887JeecgBoot missing authorization via /sys/comment/exportXls5.3CNA v4.00.2%2026-10-11
CVE-2026-108886JeecgBoot missing authorization via /sys/user/queryChildrenByUsername5.3CNA v4.00.2%2026-10-11
CVE-2026-108885JeecgBoot missing authorization via /sys/message/sysMessage/delete5.3CNA v4.00.2%2026-10-11
CVE-2026-108884JeecgBoot missing authorization via sysMessageTemplate Delete endpoint5.3CNA v4.00.2%2026-10-11
CVE-2026-108883JeecgBoot missing authorization via /sys/thirdApp/editThirdAppConfig7.1CNA v4.00.2%2026-10-11
CVE-2026-108882JeecgBoot missing authorization via /sys/position/removePositionUser5.3CNA v4.00.2%2026-10-11
CVE-2026-108881JeecgBoot missing authorization via /sys/tenant/getTenantPackInfo5.3CNA v4.00.2%2026-10-11
CVE-2026-108880JeecgBoot missing authorization via /sys/dict/editDictByLowAppId5.3CNA v4.00.2%2026-10-11
CVE-2026-108879JeecgBoot IDOR via /airag/API/getChatVariable Username parameter5.3CNA v4.00.2%2026-10-11
CVE-2026-108878JeecgBoot missing authorization via /airag/app/queryById5.3CNA v4.00.2%2026-10-11
CVE-2026-108877JeecgBoot missing authorization via /airag/prompts/delete5.3CNA v4.00.2%2026-10-11
CVE-2026-108876JeecgBoot missing authorization via /sys/user/putCancelQuit5.3CNA v4.00.2%2026-10-11
CVE-2026-108875JeecgBoot missing authorization via /sys/user/addSysUserGroup5.3CNA v4.00.2%2026-10-11
CVE-2026-108874JeecgBoot missing authorization via /sys/user/changeDepartChargePerson5.3CNA v4.00.2%2026-10-11
CVE-2026-108873JeecgBoot missing authorization via /sys/user/doUpdateDepartInfo5.3CNA v4.00.2%2026-10-11
CVE-2026-108872JeecgBoot missing authorization via /sys/user/batchEditUsers5.3CNA v4.00.2%2026-10-11
CVE-2026-108871JeecgBoot missing authorization via POST /sys/sysDepartRole/datarule5.3CNA v4.00.2%2026-10-11
CVE-2026-108870JeecgBoot missing authorization via POST /sys/role/datarule5.3CNA v4.00.2%2026-10-11
CVE-2026-108869JeecgBoot missing authorization via /sys/API/sendSysAnnouncement5.3CNA v4.00.2%2026-10-11
CVE-2026-108868JeecgBoot missing authorization via /sys/API/sendBusTemplateAnnouncement5.3CNA v4.00.2%2026-10-11
CVE-2026-108867JeecgBoot missing authorization via /sys/API/getUserRoleSetById5.3CNA v4.00.2%2026-10-11
CVE-2026-108866JeecgBoot missing authorization via /sys/API/queryUserAuths5.3CNA v4.00.2%2026-10-11
CVE-2026-108865AmoyLab Unla OAuth2 authentication bypass via /authorize8.8CNA v4.00.3%2026-10-11
CVE-2026-108864iFlytek Astron agent authorization bypass via /workflow/v1/resume endpoint2.3CNA v4.00.2%2026-10-11
CVE-2026-108863Katanemo Plano missing authentication on Envoy Admin interface8.7CNA v4.00.5%2026-10-11
CVE-2026-108862APIPark IDOR via application authorization endpoints6.0CNA v4.00.2%2026-10-11
CVE-2026-108861Odoo MCP information disclosure via execute_method tool5.3CNA v4.00.2%2026-10-11
CVE-2026-108860BotSharp authentication bypass via Hard-Coded JWT Signing Key9.3CNA v4.00.5%2026-10-11
CVE-2026-108859mcp-go denial of service via Unbounded POST Body Buffering8.7CNA v4.00.5%2026-10-11
CVE-2026-108858Predibase LoRAX API token exposure via Router Logs6.8CNA v4.00.1%2026-10-11
CVE-2026-108857Hugging Face Text Embeddings Inference Cleartext API Key Logging4.8CNA v4.00.1%2026-10-11
CVE-2026-108856UnicomAI Wanwu authorization bypass via /v1/appspace/app/key AppKey Minting2.3CNA v4.00.2%2026-10-11
CVE-2026-108855UnicomAI Wanwu missing authorization via delete /v1/appspace/app/publish5.3CNA v4.00.2%2026-10-11
CVE-2026-108854Wanwu IDOR AppKey Deletion via delete /v1/appspace/app/key5.3CNA v4.00.2%2026-10-11Fix
CVE-2026-108853UnicomAI Wanwu IDOR via delete /v1/appspace/app7.2CNA v4.00.3%2026-10-11Fix
CVE-2026-108852Deep Chat XSS via Markdown Link Validation Bypass2.1CNA v4.00.2%2026-10-11
CVE-2026-108851phpMyFAQ missing authorization via MCP Server faq_search tool4.8CNA v4.00.1%2026-10-11
CVE-2026-108850guy-hartstein company-research-agent Company Research Agent SSRF via /generate-pdf ReportLab Markup6.9CNA v4.00.2%2026-10-11
CVE-2026-108839thClaws symlink following File Write via POST /v1/inputs2.3CNA v4.00.3%2026-10-11
CVE-2026-108778erzhongxmu JEEWMS Inbound Quality Check Pda Interface SQL injection5.3CNA v4.00.2%2026-10-11
CVE-2026-108777erzhongxmu JEEWMS WvGiController.java WvGiController.list SQL injection5.3CNA v4.00.2%2026-10-11
CVE-2026-108775erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list SQL injection5.3CNA v4.00.3%2026-10-11
CVE-2026-108774erzhongxmu JEEWMS MdBinController.java getbinallagv SQL injection5.3CNA v4.00.3%2026-10-11
CVE-2026-108773erzhongxmu JEEWMS WmOmNoticeHController.java docheck SQL injection5.3CNA v4.00.2%2026-10-11
CVE-2026-108772bleenco abstruse Cache endpoint download_cache.go filepath.Join path traversal6.9CNA v4.00.7%2026-10-11
CVE-2026-108770Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery6.9CNA v4.00.4%2026-10-11Fix
CVE-2026-108769zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service5.3CNA v4.00.5%2026-10-11
CVE-2026-108768zhayujie CowAgent Streaming Tool-Call argument json.loads allocation of resources5.3CNA v4.00.5%2026-10-11
CVE-2026-108760LlamaFarm Unauthenticated API Exposed on All Interfaces7.2CNA v4.00.2%2026-10-11
CVE-2026-108759Mistral.rs sandbox escape via symlink following in mistralrs-code-exec7.6CNA v4.00.3%2026-10-11
CVE-2026-108758alextselegidis easyappointments Easy!Appointments authorization bypass via booking/register endpoint8.8CNA v4.00.3%2026-10-11
CVE-2026-108757Nexting pinclaw missing authentication via POST /pinclaw/send7.1CNA v4.00.2%2026-10-11
CVE-2026-108756Abilityai Trinity missing authorization in Telegram Binding Routes5.3CNA v4.00.2%2026-10-11
CVE-2026-108755Hatchet Unauthenticated memory exhaustion via SNS Ingestion endpoint6.9CNA v4.00.3%2026-10-11
CVE-2026-108754GPT-Load Cleartext Proxy Key Logging via Access Logger4.8CNA v4.00.1%2026-10-11
CVE-2026-108753Agnaistic agnai hard-coded credentials in self-host Docker Compose9.3CNA v4.00.3%2026-10-11
CVE-2026-108752JupyterHub OAuth Client ID Collision via Unescaped Hyphen2.3CNA v4.00.2%2026-10-11Fix
CVE-2026-108751MoAI-ADK symlink following via moai init Template Deployer4.8CNA v4.00.1%2026-10-11
CVE-2026-108750OpenDocMan decompression bomb DoS via Upload Text Extraction5.3CNA v4.00.3%2026-10-11
CVE-2026-108748quarkiverse quarkus-langchain4j quarkus LangChain4j memory exhaustion via /_chat/routes WebSocket6.9CNA v4.00.3%2026-10-11
CVE-2026-108747Lightdash authorization bypass via Personal Access Token Deletion2.3CNA v4.00.2%2026-10-11
CVE-2026-108746Vearch incorrect authorization via Role.HasPermissionForResources8.7CNA v4.00.3%2026-10-11
CVE-2026-108745CloudBeaver missing authorization via /API/sql-result-value Servlet2.3CNA v4.00.2%2026-10-11
CVE-2026-108744pbi-cli OS command injection via Desktop Sync7.3CNA v4.00.5%2026-10-11
CVE-2026-108742CloudBeaver missing authorization via initConnection GraphQL Mutation5.3CNA v4.00.2%2026-10-11
CVE-2026-108741Shepherd SSRF via DNS Rebinding in Citation Checker2.3CNA v4.00.2%2026-10-11
CVE-2026-108740GoatCounter privilege escalation via /user/pref mass assignment7.2CNA v4.00.3%2026-10-11
CVE-2026-108739OpenAgents Workspace through launcher- unauthenticated credential exposure via /v1/workspaces8.7CNA v4.00.3%2026-10-11
CVE-2026-108738Traccar Login CSRF via OpenID Connect Callback2.3CNA v4.00.1%2026-10-11
CVE-2026-108737Traccar weak password recovery via TokenManager Token Purpose Confusion7.6CNA v4.00.3%2026-10-11
CVE-2026-108736alexjustesen speedtest-tracker Speedtest Tracker IP Allowlist Bypass via X-Forwarded-for spoofing6.3CNA v4.00.2%2026-10-11
CVE-2026-108735Miniflux SSRF via Per-Feed Proxy URL5.3CNA v4.00.3%2026-10-11
CVE-2026-108734Frappe CRM missing authorization via get_linked_docs_of_document5.3CNA v4.00.3%2026-10-11
CVE-2026-108733Frappe HR (hrms) missing authorization via expire_allocation5.3CNA v4.00.3%2026-10-11Fix
CVE-2026-108732Frappe HR (hrms) missing authorization via get_account_and_amount5.3CNA v4.00.3%2026-10-11Fix
CVE-2026-108731Raven missing authorization via join_workspace Invite-Only Bypass5.3CNA v4.00.2%2026-10-11
CVE-2026-108730Raven missing authorization via Legacy message and File APIs5.3CNA v4.00.3%2026-10-11
CVE-2026-108729Corteza Unauthenticated Attachment Access via Compose Attachment endpoints8.2CNA v4.00.3%2026-10-11
CVE-2026-108728Flyte Cleartext secret exposure via Admission Webhook7.1CNA v4.00.2%2026-10-11
CVE-2026-108727EdgeEver missing authorization via Memo-Template API Routes5.3CNA v4.00.3%2026-10-11
CVE-2026-108726GLPI missing authorization via ajax/map.php5.3CNA v4.00.3%2026-10-11
CVE-2026-108725Cheshire Cat AI core stored XSS via uploads plugin5.1CNA v4.00.2%2026-10-11
CVE-2026-108724Sylius authorization bypass via Shop API Product-Review endpoint6.9CNA v4.00.3%2026-10-11
CVE-2026-108723answer-me-with-html symlink following in Code block src Embedding2.0CNA v4.00.1%2026-10-11
CVE-2026-108722open-computer-use through commit 610bac8 stored XSS via log.html Session Log2.3CNA v4.00.2%2026-10-11
CVE-2026-108721iFurySt open-computer-use Open Computer Use Denylist Bypass via Case-Variant Bundle ID5.8CNA v4.00.1%2026-10-11
CVE-2026-108720phpIPAM missing authorization in Customers, Locations and NAT pages5.3CNA v4.00.3%2026-10-11
CVE-2026-108719LLMGateway blind SSRF via Video-Generation callback_url5.3CNA v4.00.3%2026-10-11
CVE-2026-108718Rill OAuth missing authorization via Dynamic Client Registration8.6CNA v4.00.3%2026-10-11
CVE-2026-108717Combodo iTop missing authorization via LinkSetController5.3CNA v4.00.3%2026-10-11
CVE-2026-108716mcp-remote Cleartext Credential Transmission via --device-code OAuth Grant6.0CNA v4.00.2%2026-10-11
CVE-2026-108715LibreNMS authorization bypass via Smokeping Graph auth.inc.php5.3CNA v4.00.3%2026-10-11
CVE-2026-108714modelcontextprotocol kotlin-sdk MCP Kotlin SDK memory exhaustion via Application.mcpWebSocket8.7CNA v4.00.4%2026-10-11
CVE-2026-108713SuiteCRM and missing authorization via setCampaignMarketingAndTemplate5.3CNA v4.00.3%2026-10-11
CVE-2026-108712SuiteCRM and missing authorization via DetailUserRole Entry Point5.3CNA v4.00.3%2026-10-11
CVE-2026-108711Plastic Labs Honcho incorrect authorization via POST /v3/workspaces5.3CNA v4.00.3%2026-10-11
CVE-2026-108710NornicDB missing authorization via Vector Search endpoints7.1CNA v4.00.3%2026-10-11
CVE-2026-108708Wukong_HRM through commit 186115e missing authorization via EmployeeAspect and EmployeeUtil8.7CNA v4.00.3%2026-10-11
CVE-2026-108707Wukong_HRM through commit 186115e authentication bypass via ParamAspect9.3CNA v4.00.6%2026-10-11
CVE-2026-108706eladmin through commit 55fbf70 missing authorization via S3 Storage Download endpoint5.3CNA v4.00.2%2026-10-11
CVE-2026-108705CordysCRM missing authorization via /custom-form/data/import5.3CNA v4.00.2%2026-10-11
CVE-2026-108704CordysCRM authorization bypass via Follow-Up Record Add endpoints5.3CNA v4.00.2%2026-10-11
CVE-2026-108703CordysCRM missing authorization via /approval-resource/push5.3CNA v4.00.2%2026-10-11
CVE-2026-108702CordysCRM missing authorization and blind SSRF via Webhook Test5.3CNA v4.00.2%2026-10-11
CVE-2026-1087011Panel-dev CordysCRM missing authorization via POST /contract/sort5.3CNA v4.00.2%2026-10-11Fix
CVE-2026-1087001Panel-dev CordysCRM missing authorization via /field/source/business-title7.1CNA v4.00.2%2026-10-11Fix
CVE-2026-108699hyper-mcp improper signature verification of OCI WebAssembly plugins8.3CNA v4.00.1%2026-10-11
CVE-2026-108698hyper-mcp OCI plugin signature verification TOCTOU race condition8.3CNA v4.00.2%2026-10-11
CVE-2026-108697CoreShop missing authorization via ResourceController listAction5.3CNA v4.00.2%2026-10-11
CVE-2026-108696CoreShop authorization bypass via OrderController OrderConfirm and SendReship5.3CNA v4.00.2%2026-10-11
CVE-2026-108695MultiVendorX incorrect authorization via Settings REST endpoint7.1CNA v4.00.3%2026-10-11
CVE-2026-108694ConvertX arbitrary file read via Pandoc Converter7.1CNA v4.00.3%2026-10-11
CVE-2026-108693ImageMagick and uncontrolled search path via Ghostscript Delegate7.3CNA v4.00.1%2026-10-11
CVE-2026-1086921Panel-dev CordysCRM missing authorization via /field/source endpoints7.1CNA v4.00.2%2026-10-11Fix
CVE-2026-108691mall4j Operator Precedence Error Deletes other Users' Cart Items via /p/shopCart/cleanExpiryProdList5.3CNA v4.00.2%2026-10-11
CVE-2026-108690mall4j Operator Precedence Error exposes other Users' Cart Items via /p/shopCart/expiryProdList5.3CNA v4.00.2%2026-10-11
CVE-2026-108689Wukong AICRM authorization bypass via User-Controlled Session ID in POST /chat/send5.3CNA v4.00.2%2026-10-11
CVE-2026-108688Eladmin missing authorization via /API/localStorage/pictures upload5.3CNA v4.00.2%2026-10-11
CVE-2026-108684erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData SQL injection5.3CNA v4.00.3%2026-10-11
CVE-2026-108683zhayujie CowAgent Media Download memory allocation5.3CNA v4.00.3%2026-10-11Fix
CVE-2026-108682zhayujie CowAgent Web console upload read denial of service5.3CNA v4.00.4%2026-10-11
CVE-2026-108681zhayujie CowAgent Web console web_channel.py denial of service5.3CNA v4.00.5%2026-10-11
CVE-2026-108584FunnyWolf Viper config hard-coded credentials6.9CNA v4.00.4%2026-10-11
CVE-2026-108578Neterbit NW-431F Embedded Web Server sms.json information disclosure6.9CNA v4.01.0%2026-10-11NucleiExploit code
CVE-2026-108577Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption5.3CNA v4.00.3%2026-10-11
CVE-2026-108576TOZED X300 IPPingDiagnostics process_ping os command injection10.0CNA v4.02.5%2026-10-11
CVE-2026-108575BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization5.3CNA v4.00.2%2026-10-11
CVE-2026-108574BerriAI LiteLLM Spend Tracking authorization bypass5.3CNA v4.00.2%2026-10-11Fix
CVE-2026-108573Open Asset Import Library Assimp PLY file getNextBlock out-of-bounds5.1CNA v4.00.2%2026-10-11
CVE-2026-108572Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery5.3CNA v4.00.2%2026-10-11Fix
CVE-2026-108571Xinhu Rainrock RockOA Openkqj action openkqjAction.php returnchuli SQL injection6.9CNA v4.00.3%2026-10-11
CVE-2026-108570Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine5.3CNA v4.00.2%2026-10-11
CVE-2026-108569Furion .NET Framework StringRenderExtensions.cs String.Replace SQL injection5.3CNA v4.00.3%2026-10-11
CVE-2026-108568InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity5.3CNA v4.00.1%2026-10-11
CVE-2026-108567InstantSoft icms2 Image image.php files_delete_file path traversal5.3CNA v4.00.5%2026-10-11
CVE-2026-108566InstantSoft icms2 Private message index.tpl.php index cross-site scripting5.1CNA v4.00.2%2026-10-11
CVE-2026-108544Lippu Docx Reader Office Viewer App path traversal5.3CNA v4.00.3%2026-10-11
CVE-2026-108543ag2ai ag2 UserProxyAgent os.path.join path traversal5.3CNA v4.00.3%2026-10-11
CVE-2026-108542021is elvix-sdk MCP request index.ts server-side request forgery5.3CNA v4.00.2%2026-10-11
CVE-2026-108541highwarden Super Store Finder index.php SQL injection5.3CNA v4.00.2%2026-10-11
CVE-2026-108540OpenSpug File Transfer transfer os command injection9.4CNA v4.01.7%2026-10-11
CVE-2026-108539GPAC MP4Box filter_queue.c gf_fq_pop use-after-free5.3CNA v4.00.3%2026-10-11
CVE-2026-108538GPAC MP4Box os_thread.c gf_mx_v use-after-free5.3CNA v4.00.2%2026-10-11
CVE-2026-108523Studio-Saelix Sencho git-sources Browse API endpoint outboundTarget.ts server-side request forgery5.3CNA v4.00.3%2026-10-11
CVE-2026-108522Studio-Saelix Sencho Login endpoint login improper authentication6.9CNA v4.00.4%2026-10-11
CVE-2026-108521Studio-Saelix Sencho Add Remote Node API Endpoint server-side request forgery5.1CNA v4.00.2%2026-10-11
CVE-2026-107761gitroomhq postiz-app channel tokens and organization API key exposed in API responses5.3CNA v4.00.3%2026-10-11Fix
CVE-2026-107694Dokan AI Powered WooCommerce Multivendor Marketplace Solution information disclosure2.7CISA ADP v3.10.2%2026-10-11Fix
CVE-2026-107507Squadeno WordPress plugin Trainer+ Section and Age Group Reassignment via Quick Edit2.7CISA ADP v3.10.2%2026-10-11Fix
CVE-2026-106029WeddingCity Lite WordPress plugin unauthenticated arbitrary post and Attachment deletion7.5CISA ADP v3.10.3%2026-10-11
CVE-2026-104684Envira Gallery WordPress plugin Author+ IDOR via shortcode2.7CISA ADP v3.10.2%2026-10-11Fix
CVE-2026-104682Envira Gallery WordPress plugin Contributor missing authorization via Convert Gallery REST Route2.7CISA ADP v3.10.2%2026-10-11Fix
CVE-2026-104681Envira Gallery WordPress plugin Non-Public post Title and Excerpt disclosure via Gallery REST field2.7CISA ADP v3.10.2%2026-10-11Fix
CVE-2026-104680Envira Gallery onboarding wizard improper privilege management7.2CISA ADP v3.10.3%2026-10-11Fix
CVE-2026-104028Anton Extensions WordPress plugin unauthenticated arbitrary file upload to RCE9.8CISA ADP v3.10.6%2026-10-11
CVE-2026-103695Mobile Builder WordPress plugin unauthenticated SQLi via vendor_id parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-103694Mobile builder WordPress plugin Subscriber+ privilege escalation to admin8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-103305Prenotazioni WordPress plugin unauthenticated stored XSS via settings update8.8CISA ADP v3.10.2%2026-10-11
CVE-2026-97183WP-Invoice WordPress plugin Subscriber+ user PII disclosure via Unprotected AJAX Handlers4.3CISA ADP v3.10.2%2026-10-11
CVE-2026-96227Piotnet Forms WordPress plugin unauthenticated stored XSS via file upload8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-94235MemberHero WordPress plugin missing authorization4.3CISA ADP v3.10.2%2026-10-11
CVE-2026-93550Veeqo for WooCommerce WordPress plugin arbitrary file upload4.3CISA ADP v3.10.2%2026-10-11
CVE-2026-91829Subscribe to Comments WordPress plugin reflected XSS via ref parameter7.1CISA ADP v3.10.2%2026-10-11Fix
CVE-2026-89305Paymendo Bank Transfer WordPress plugin Subscriber+ SQLi via orderBy parameter6.5CISA ADP v3.10.2%2026-10-11
CVE-2026-89304Paymendo Bank Transfer WordPress plugin unauthenticated blind SQLi6.5CISA ADP v3.10.2%2026-10-11
CVE-2026-89302Post Voting System WordPress plugin unauthenticated SQLi via id parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89299WP Verify API WordPress plugin unauthenticated SQLi via verify parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89297Loja Automática WordPress plugin unauthenticated SQLi via id parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89287ASPL Product Quotation WordPress plugin unauthenticated SQLi via quote_id parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89285Datalist it WordPress plugin unauthenticated SQLi via dli_fronted_action8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89283WP Posts Password Batch Manager WordPress plugin unauthenticated Bulk post password Rewrite8.6CISA ADP v3.10.2%2026-10-11
CVE-2026-89234WP-Partner WordPress plugin unauthenticated SQLi via id parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89232RecordBrowser WordPress plugin unauthenticated SQLi via recordid parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89214WpCues Basic Quiz WordPress plugin unauthenticated SQLi via Quiz Result Submission8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89213Llavero.io WordPress plugin unauthenticated blind SQLi via cill_login parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-89195Site Setup Wizard WordPress plugin unauthenticated SQLi via ssw_check_admin_email_exists8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-88930Social Web Suite WordPress plugin unauthenticated blind SQLi via Unset Shared Secret8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-88905KeyWord Collector WordPress plugin unauthenticated stored XSS and settings update8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-88903Topcontent WordPress plugin unauthenticated stored XSS via content Webhook8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-88827The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-88826SmugMug Embed WordPress plugin unauthenticated stored XSS via saveSelectedAlbums8.8CISA ADP v3.10.2%2026-10-11
CVE-2026-88785Simple Membership WordPress plugin Newly Registered Member password disclosure via URL Query String4.7CISA ADP v3.10.1%2026-10-11Fix
CVE-2026-87764BuddyPress Instant Chat WordPress plugin unauthenticated stored XSS via Chat Message8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-87762Adwised Web Push Notification WordPress plugin unauthenticated stored XSS8.8CISA ADP v3.10.4%2026-10-11
CVE-2026-87761Adwised Web Push Notification WordPress plugin Subscriber+ stored XSS via Pop-up settings8.0CISA ADP v3.10.3%2026-10-11
CVE-2026-87760Web Vitals Tracking WordPress plugin unauthenticated stored XSS via Tracking Beacon Metric Name8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-86798HootBoard WordPress plugin unauthenticated stored XSS via Board Configuration REST endpoint8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-86717Insurify WordPress plugin unauthenticated arbitrary option deletion via removeimg_popup9.1CISA ADP v3.10.3%2026-10-11
CVE-2026-86706Quick quotes WordPress plugin unauthenticated Integer-Value option update9.1CISA ADP v3.10.3%2026-10-11
CVE-2026-85126Crowdfundly WordPress plugin Crowdfundly Manager+ privilege escalation7.2CISA ADP v3.10.3%2026-10-11
CVE-2026-85121Insurify WordPress plugin saveemailtemplatedesign AJAX action vulnerability9.1CISA ADP v3.10.3%2026-10-11
CVE-2026-85118AI Content Generator Marketing WordPress plugin unauthenticated privilege escalation9.8CISA ADP v3.10.3%2026-10-11
CVE-2026-84737Freeton WP WordPress plugin unauthenticated account takeover via secod parameter9.8CISA ADP v3.10.3%2026-10-11
CVE-2026-84734Mindstien Quick Login WordPress plugin unauthenticated Administrator account takeover9.8CISA ADP v3.10.3%2026-10-11
CVE-2026-84261click5 CRM add-on to Contact Form 7 WordPress plugin unauthenticated stored XSS8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-84260click5 CRM add-on to Gravity Forms WordPress plugin unauthenticated stored XSS8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-84259click5 CRM add-on to WPForms WordPress plugin unauthenticated stored XSS via post_notifications8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-84258click5 CRM add-on to Ninja Forms WordPress plugin unauthenticated stored XSS via post_notifications8.8CISA ADP v3.10.3%2026-10-11
CVE-2026-84254click5 CRM add-on to Contact Form 7 WordPress plugin unauthenticated arbitrary options update9.8CISA ADP v3.10.2%2026-10-11
CVE-2026-84253click5 CRM add-on to Gravity Forms WordPress plugin unauthenticated arbitrary options update9.8CISA ADP v3.10.2%2026-10-11
CVE-2026-84252click5 CRM add-on to WPForms WordPress plugin unauthenticated arbitrary options update9.8CISA ADP v3.10.2%2026-10-11
CVE-2026-84251click5 CRM add-on to Ninja Forms WordPress plugin unauthenticated arbitrary options update9.8CISA ADP v3.10.2%2026-10-11
CVE-2026-81649Fundiin WordPress plugin unauthenticated Payment Gateway settings update and credential disclosure9.1CISA ADP v3.10.3%2026-10-11
CVE-2026-81420Tcard WP WordPress plugin unauthenticated SQLi via group_id parameter8.6CISA ADP v3.10.3%2026-10-11
CVE-2026-81156Robo Gallery WordPress plugin Contributor+ stored XSS via Gallery settings6.8CISA ADP v3.10.3%2026-10-11Fix
CVE-2026-81155Robo Gallery WordPress plugin Author+ stored XSS via Gallery Search Label6.8CISA ADP v3.10.3%2026-10-11Fix
CVE-2026-81154Robo Gallery WordPress plugin Author+ stored XSS via Image Alt Text6.8CISA ADP v3.10.3%2026-10-11Fix
CVE-2026-81153Robo Gallery WordPress plugin Author+ stored XSS via Image Overlay Effect Meta6.8CISA ADP v3.10.3%2026-10-11Fix
CVE-2026-59508Interuse i-Bos improper neutralization of special elements used in an SQL command (SQL injection)5.9CNA v3.10.3%2026-10-11
CVE-2026-19935zephyrproject Zephyr Bluetooth host L2CAP CoC channel use-after-free7.5CNA v3.10.2%2026-10-11
CVE-2026-19740zephyrproject Zephyr Bluetooth LE Controller memory leak6.5CNA v3.10.1%2026-10-11Fix
CVE-2026-19739zephyrproject zephyr Bluetooth LE controller memory leak6.5CNA v3.10.1%2026-10-11Fix
CVE-2026-19738zephyrproject zephyr Bluetooth Controller CIS Create procedures memory leak6.5CNA v3.10.1%2026-10-11Fix
CVE-2026-19737zephyrproject Zephyr ESP32 I2S driver null pointer dereference5.5CNA v3.10.1%2026-10-11Fix
CVE-2026-19736zephyrproject zephyr NXP MCUX TRNG entropy driver out-of-bounds write7.8CNA v3.10.1%2026-10-11
CVE-2026-19735zephyrproject Zephyr TCP stack insufficient randomness4.8CNA v3.10.2%2026-10-11
CVE-2026-19669zephyrproject zephyr fuel gauge syscall verifiers out-of-bounds write7.8CNA v3.10.1%2026-10-11Fix
CVE-2026-19577zephyrproject zephyr IPv6 route forwarding out-of-bounds read7.1CNA v3.10.2%2026-10-11Fix
CVE-2026-19576zephyrproject zephyr Goodix GT911 touch controller driver out-of-bounds write6.8CNA v3.10.2%2026-10-11
CVE-2026-18418zephyrproject zephyr zbus proxy agent IPC backend out-of-bounds read3.4CNA v3.10.1%2026-10-11Fix
CVE-2026-14854WooCommerce Bookings WordPress plugin unauthenticated denial of service7.5CISA ADP v3.10.3%2026-10-11Fix
CVE-2026-12980Post Snippets WordPress plugin Contributor+ stored XSS via Snippet Variable6.8CISA ADP v3.10.3%2026-10-11
CVE-2026-108680JeecgBoot missing authorization via /sys/API/sendTemplateAnnouncement5.3CNA v4.00.2%2026-10-10
CVE-2026-108679JeecgBoot missing authorization via /sys/API/sendBusAnnouncement5.3CNA v4.00.2%2026-10-10
CVE-2026-108678JeecgBoot missing authorization via /sys/API/queryUserRoles5.3CNA v4.00.2%2026-10-10
CVE-2026-108677JeecgBoot missing authorization via /sys/API/getUserByName7.1CNA v4.00.2%2026-10-10
CVE-2026-108676JeecgBoot missing authorization via /sys/annountCement/downLoadFiles5.3CNA v4.00.2%2026-10-10
CVE-2026-108675JeecgBoot missing authorization via /sys/annountCement/editIzTop5.3CNA v4.00.2%2026-10-10
CVE-2026-108674JeecgBoot missing authorization via /openapi/queryById5.3CNA v4.00.2%2026-10-10
CVE-2026-108673JeecgBoot missing authorization via /airag/prompts/exportXls5.3CNA v4.00.2%2026-10-10
CVE-2026-108672JeecgBoot authorization bypass via /airag/video/listByUser5.3CNA v4.00.2%2026-10-10
CVE-2026-108671JeecgBoot missing authorization via /airag/airagMcp/queryById7.1CNA v4.00.3%2026-10-10
CVE-2026-108670JeecgBoot missing authorization via /airag/prompts/experiment5.3CNA v4.00.2%2026-10-10
CVE-2026-108669JeecgBoot missing authorization via /airag/knowledge/embedding/search5.3CNA v4.00.2%2026-10-10
CVE-2026-108668JeecgBoot missing authorization via /airag/prompts/deleteRecycleBin5.3CNA v4.00.2%2026-10-10
CVE-2026-108667JeecgBoot missing authorization via /airag/prompts/revertRecycleBin5.3CNA v4.00.2%2026-10-10
CVE-2026-108666JeecgBoot missing authorization via /airag/prompts/deleteBatch5.3CNA v4.00.2%2026-10-10
CVE-2026-108665JeecgBoot missing authorization via /airag/prompts/edit5.3CNA v4.00.2%2026-10-10
CVE-2026-108664JeecgBoot missing authorization via /airag/prompts/queryById5.3CNA v4.00.2%2026-10-10
CVE-2026-108663JeecgBoot missing authorization via /sys/tenant/deleteApply5.3CNA v4.00.2%2026-10-10
CVE-2026-108662JeecgBoot missing authorization via /sys/tenant/deleteTenantPackUser5.3CNA v4.00.2%2026-10-10
CVE-2026-108661JeecgBoot missing authorization via /sys/tenant/changeOwenUserTenant7.1CNA v4.00.2%2026-10-10
CVE-2026-108660JeecgBoot missing authorization via /sys/tenant/updateApplyStatus5.3CNA v4.00.2%2026-10-10
CVE-2026-108659JeecgBoot missing authorization via /sys/tenant/listPackByTenantUserId5.3CNA v4.00.2%2026-10-10
CVE-2026-108658JeecgBoot missing authorization via /sys/tenant/queryTenantAuthInfo5.3CNA v4.00.2%2026-10-10
CVE-2026-108657JeecgBoot missing authorization via /sys/tenant/passApply8.6CNA v4.00.2%2026-10-10
CVE-2026-108656JeecgBoot missing authorization via getTenantPackApplyUsers endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108655JeecgBoot missing authorization via /sys/quartzJob/queryById5.3CNA v4.00.2%2026-10-10
CVE-2026-108654JeecgBoot missing authorization via /sys/oss/file/queryById5.3CNA v4.00.2%2026-10-10
CVE-2026-108653JeecgBoot missing authorization via GET /openapi/list5.3CNA v4.00.2%2026-10-10
CVE-2026-108652JeecgBoot missing authorization via /sys/API/updateAvatar5.3CNA v4.00.2%2026-10-10
CVE-2026-108651JeecgBoot missing authorization via /sys/API/getRolesByUserId5.3CNA v4.00.2%2026-10-10
CVE-2026-108650JeecgBoot missing authorization via /sys/API/getUserPermissionSet5.3CNA v4.00.2%2026-10-10
CVE-2026-108649JeecgBoot missing authorization via /sys/API/queryUserRolesById5.3CNA v4.00.2%2026-10-10
CVE-2026-108648JeecgBoot missing authorization via getDynamicDbSourceByCode endpoint7.1CNA v4.00.3%2026-10-10
CVE-2026-108647JeecgBoot missing authorization via /sys/checkRule/importExcel5.3CNA v4.00.3%2026-10-10
CVE-2026-108646JeecgBoot missing authorization via /sys/category/importExcel5.3CNA v4.00.2%2026-10-10
CVE-2026-108645JeecgBoot missing authorization via /sys/category/edit5.3CNA v4.00.2%2026-10-10
CVE-2026-108644JeecgBoot missing authorization via /sys/category/delete5.3CNA v4.00.3%2026-10-10
CVE-2026-108643JeecgBoot missing authorization via /sys/category/deleteBatch5.3CNA v4.00.3%2026-10-10
CVE-2026-108642JeecgBoot IDOR via PUT /sys/sysAnnouncementSend/edit5.3CNA v4.00.2%2026-10-10
CVE-2026-108641JeecgBoot IDOR via /sys/sysAnnouncementSend/getOne5.3CNA v4.00.2%2026-10-10
CVE-2026-108640JeecgBoot missing authorization via /sys/sysDepartRole/queryById5.3CNA v4.00.2%2026-10-10
CVE-2026-108639JeecgBoot SysDictController missing authorization5.3CNA v4.00.3%2026-10-10
CVE-2026-108638JeecgBoot missing authorization via /sys/user/deleteGroupUser5.3CNA v4.00.2%2026-10-10
CVE-2026-108637JeecgBoot missing authorization via deleteUserGroupBatch endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108636JeecgBoot missing authorization via /sys/sysDepart/appImportExcel5.3CNA v4.00.2%2026-10-10
CVE-2026-108635JeecgBoot missing authorization via getDepartmentHead endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108634JeecgBoot missing authorization via sysDepartPermission deleteBatch endpoint5.3CNA v4.00.3%2026-10-10
CVE-2026-108633JeecgBoot missing authorization via /sys/sysDepartPermission/add5.3CNA v4.00.2%2026-10-10
CVE-2026-108632JeecgBoot missing authorization via sysDepartPermission queryById endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108631JeecgBoot missing authorization via /sys/sysDepartPermission/delete5.3CNA v4.00.3%2026-10-10
CVE-2026-108630JeecgBoot missing authorization via /sys/sysDepartPermission/edit5.3CNA v4.00.2%2026-10-10
CVE-2026-108629JeecgBoot missing authorization via sysDepartPermission datarule endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108628JeecgBoot missing authorization via saveDeptRolePermission endpoint8.6CNA v4.00.2%2026-10-10
CVE-2026-108627JeecgBoot missing authorization via /sys/role/datarule endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108626JeecgBoot missing authorization via sysMessage queryById endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108625JeecgBoot missing authorization via sysMessage Edit endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108624JeecgBoot missing authorization via sysMessage deleteBatch endpoint5.3CNA v4.00.3%2026-10-10
CVE-2026-108623JeecgBoot missing authorization via /sys/log/deleteBatch7.1CNA v4.00.3%2026-10-10
CVE-2026-108622JeecgBoot missing authorization via /sys/log/delete endpoint5.3CNA v4.00.3%2026-10-10
CVE-2026-108621JeecgBoot missing authorization via /sys/position/edit5.3CNA v4.00.2%2026-10-10
CVE-2026-108620JeecgBoot missing authorization via /sys/position/deleteBatch5.3CNA v4.00.3%2026-10-10
CVE-2026-108619JeecgBoot missing authorization via sysMessageTemplate deleteBatch endpoint5.3CNA v4.00.3%2026-10-10
CVE-2026-108618JeecgBoot missing authorization via sysMessageTemplate Edit endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108617JeecgBoot missing authorization via sysMessageTemplate/add endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108616JeecgBoot missing authorization via /airag/extData/deleteBatch5.3CNA v4.00.3%2026-10-10
CVE-2026-108615JeecgBoot missing authorization via /airag/extData/delete5.3CNA v4.00.3%2026-10-10
CVE-2026-108614JeecgBoot missing authorization via /airag/extData/exportXls5.3CNA v4.00.2%2026-10-10
CVE-2026-108613JeecgBoot missing authorization via /airag/app/release endpoint5.3CNA v4.00.3%2026-10-10
CVE-2026-108612JeecgBoot missing authorization via /airag/word/deleteBatch5.3CNA v4.00.3%2026-10-10
CVE-2026-108611JeecgBoot missing authorization via /airag/word/delete endpoint5.3CNA v4.00.3%2026-10-10
CVE-2026-108610JeecgBoot missing authorization via /airag/word/edit endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108609JeecgBoot IDOR via /airag/voice/listByUser userId parameter5.3CNA v4.00.2%2026-10-10
CVE-2026-108608JeecgBoot IDOR via deleteVoiceRecord userId parameter5.3CNA v4.00.2%2026-10-10
CVE-2026-108607JeecgBoot IDOR via deleteVideoRecord userId parameter5.3CNA v4.00.2%2026-10-10
CVE-2026-108606JeecgBoot missing authorization via /airag/ocr/deleteById5.3CNA v4.00.3%2026-10-10
CVE-2026-108605JeecgBoot missing authorization via /airag/ocr/edit endpoint5.3CNA v4.00.2%2026-10-10
CVE-2026-108604Tabularis Read-Only Bypass via MCP run_query SELECT Classification5.8CNA v4.00.1%2026-10-10
CVE-2026-108603slide-maker path traversal via generate_images_openai.py4.8CNA v4.00.1%2026-10-10
CVE-2026-108602Helicone SSRF via Jawn Webhook Sender DNS Resolution5.3CNA v4.00.2%2026-10-10
CVE-2026-108600open-multi-agent sandbox escape via file_write Dangling Symlink5.7CNA v4.00.1%2026-10-10
CVE-2026-108599Phi Symlink Workspace Write Restriction Bypass5.7CNA v4.00.2%2026-10-10
CVE-2026-108598Floci RCE via API Gateway VTL Mapping templates9.3CNA v4.00.7%2026-10-10Exploit codeFix
CVE-2026-108597cohere-ai cohere-python Cohere Python SDK path traversal via SageMaker Tar Extraction5.9CNA v4.00.3%2026-10-10
CVE-2026-108596OpenLIT authorization bypass via x-openlit-project-id header6.0CNA v4.00.3%2026-10-10
CVE-2026-108595Phi permission bypass via agent_spawn Workdir6.0CNA v4.00.3%2026-10-10
CVE-2026-108594Mealie SSRF via OIDC Picture Claim Avatar Fetch2.3CNA v4.00.2%2026-10-10
CVE-2026-1085939router Config injection RCE via hermes-settings endpoint7.3CNA v4.00.3%2026-10-10
CVE-2026-108592mini-swe-agent Environment Exposure via BubblewrapEnvironment6.0CNA v4.00.3%2026-10-10Exploit code
CVE-2026-108591InnoShop Local File Disclosure via AI Core MCP file_upload tool5.9CNA v4.00.3%2026-10-10
CVE-2026-1085861MCP Agent OAuth Tag-Scope Bypass via Negated Tag Filter5.3CNA v4.00.2%2026-10-10
CVE-2026-108585argocd-mcp path traversal via delete_application tool5.3CNA v4.00.3%2026-10-10
CVE-2026-108583zotero-mcp SSRF via zotero_add_by_url tool2.3CNA v4.00.2%2026-10-10
CVE-2026-108582GenOffice insecure permissions in HTTP MCP Server File Store6.8CNA v4.00.1%2026-10-10Fix
CVE-2026-108581Octop missing authorization exposes Provider API Keys via /API/providers7.1CNA v4.00.2%2026-10-10
CVE-2026-108580AniWorld Downloader WebUI login brute force via /login6.9CNA v4.00.3%2026-10-10Fix
CVE-2026-108579OpenPanel CSV formula injection via Cohort Member Export2.3CNA v4.00.2%2026-10-10
CVE-2026-108555PairDrop IP spoofing via cf-connecting-ip header2.3CNA v4.00.1%2026-10-10
CVE-2026-108554PDFMathTranslate SSRF via Gradio Web GUI Link Input6.9CNA v4.00.2%2026-10-10
CVE-2026-108553OpenRefine CSRF to RCE via get-rows command7.7CNA v4.00.2%2026-10-10
CVE-2026-108551openapi-typescript-codegen code injection via Handlebars templates9.3CNA v4.00.4%2026-10-10
CVE-2026-108550SkillHub account takeover via Account Merge Flow8.7CNA v4.00.3%2026-10-10Fix
CVE-2026-108549cc-connect missing authentication via MAX Webhook sender spoofing9.2CNA v4.00.5%2026-10-10
CVE-2026-108548iflytek astron-rpa AstronRPA authentication bypass via arbitrary Bearer Token6.9CNA v4.00.3%2026-10-10
CVE-2026-108547iflytek astron-rpa AstronRPA Cross-Tenant Shared Variable Disclosure via get-batch-shared-var7.1CNA v4.00.2%2026-10-10
CVE-2026-108546Spotweb OS command injection via Spot Title in Runcommand Integration7.7CNA v4.00.8%2026-10-10
CVE-2026-108545SillyTavern Pre-authentication denial of service via Body Parsing8.2CNA v4.00.6%2026-10-10
CVE-2026-108506Unauthorized access vulnerability in ZTE Z80 Ultra product5.5CNA v3.10.1%2026-10-10
CVE-2026-108505Information disclosure vulnerability in ZTE Z80 Ultra product3.3CNA v3.10.1%2026-10-10
CVE-2026-108504Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product5.5CNA v3.10.1%2026-10-10
CVE-2026-108503Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product3.3CNA v3.10.1%2026-10-10
CVE-2026-108502Information disclosure vulnerability in ZTE Z80 Ultra product3.3CNA v3.10.1%2026-10-10
CVE-2026-108501Unauthorized access vulnerability in ZTE Z80 Ultra product5.7CNA v3.10.2%2026-10-10
CVE-2026-108165Immich missing authorization in Partner Sync exposes Locked Folder Metadata5.3CNA v4.00.2%2026-10-10
CVE-2026-108164opensource-socialnetwork Open Source Social Network (OSSN) IDOR via Message Attachment route7.1CNA v4.00.3%2026-10-10
CVE-2026-108163smp46 pingvin-share-x Pingvin Share X Ineffective Authentication Rate Limiting via Throttler TTL6.9CNA v4.00.2%2026-10-10Fix
CVE-2026-108162smp46 pingvin-share-x Pingvin Share X Rate Limit Bypass via Spoofed X-Forwarded-For6.9CNA v4.00.2%2026-10-10Fix
CVE-2026-108161FusionPBX OS command injection via Caller ID in Recording ZIP Download7.7CNA v4.01.1%2026-10-10
CVE-2026-108115Kortix Suna SSRF Guard Bypass via IPv6 6to4 Addresses2.3CNA v4.00.2%2026-10-10Fix
CVE-2026-108114Strapi improper authorization via Admin API Token Field Permissions5.3CNA v4.00.2%2026-10-10
CVE-2026-107794ExtUtils::Typemaps::STL::List versions for Perl allocate a 32 GiB array on an empty list7.5CISA ADP v3.10.4%2026-10-10Fix
CVE-2026-10774210Web Booster WordPress plugin unauthenticated stored cross-site scripting via comment Author Name7.2CNA v3.10.2%2026-10-10Fix
CVE-2026-107712WP Booking System WordPress plugin SQL injection6.5CNA v3.10.3%2026-10-10Fix
CVE-2026-107657HivePress WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-10Fix
CVE-2026-107645Blocksy Companion WordPress plugin unauthenticated privilege escalation to role parameter9.1CNA v3.10.3%2026-10-10Fix
CVE-2026-107434MicroPayments WordPress plugin bypass vulnerability vulnerability5.4CNA v3.10.3%2026-10-10Fix
CVE-2026-107420narinder-singh Pay With MetaMask For WooCommerce insufficient verification of data authenticity5.3CNA v3.10.1%2026-10-10Fix
CVE-2026-107373Perl ExtUtils::Typemaps::STL::String T_STD_STRING typemap out-of-bounds read9.1CISA ADP v3.10.4%2026-10-10Fix
CVE-2026-107323Gallery PhotoBlocks Contributor+ stored XSS6.8CISA ADP v3.10.3%2026-10-10Fix
CVE-2026-107321W3 Total Cache WordPress plugin Author+ path traversal via CDN Media Library import5.4CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-107120Contest Gallery registration email-verification step vulnerability5.3CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-106610miniorange otp verification WordPress plugin privilege escalation9.8CNA v3.10.5%2026-10-10Exploit codeFix
CVE-2026-106609Bayarcash WooCommerce WordPress plugin broken access control7.5CNA v3.10.2%2026-10-10Fix
CVE-2026-106608WooCommerce WordPress plugin Automattic incorrect privilege assignment7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-106606YITH WooCommerce Affiliates WordPress plugin PHP object injection7.2CNA v3.10.4%2026-10-10Fix
CVE-2026-106139Cross-site scripting via Chart Tooltip in Kendo UI for Vue5.4CNA v3.10.2%2026-10-10Fix
CVE-2026-106138Cross-site scripting via Chart Tooltip in KendoReact5.4CNA v3.10.2%2026-10-10Fix
CVE-2026-105995Booking Package WordPress plugin information disclosure5.3CISA ADP v3.10.3%2026-10-10Fix
CVE-2026-105990Accept PayPal Payments using Contact Form 7 CSV export vulnerability5.3CISA ADP v3.10.3%2026-10-10Fix
CVE-2026-105989Accept PayPal Payments using Contact Form 7 plugin missing authorization5.3CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-105977Portfolio Filter Gallery pfg_delete_video_thumbnail incorrect authorization2.2CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-105976Portfolio Filter Gallery WordPress plugin missing authorization4.7CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-105892rtMedia for WordPress, BuddyPress and bbPress plugin arbitrary file deletion9.8CNA v3.10.4%2026-10-10Fix
CVE-2026-105889Tickera WordPress plugin SQL injection9.3CNA v3.10.3%2026-10-10Fix
CVE-2026-105885Slider by 10Web WordPress plugin PHP object injection8.8CNA v3.10.3%2026-10-10Fix
CVE-2026-104993GeoDirectory WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-104915Academy LMS WordPress plugin missing authorization authenticated arbitrary Academy comment deletion6.5CNA v3.10.2%2026-10-10Fix
CVE-2026-104899GeoDirectory WordPress plugin unauthenticated local file inclusion via design_type parameter8.1CNA v3.10.6%2026-10-10Fix
CVE-2026-104898Online Scheduling and Appointment Booking System WordPress plugin insecure direct object reference6.8CNA v3.10.3%2026-10-10Fix
CVE-2026-104803WPCOM Member WordPress plugin unauthenticated authentication bypass9.8CNA v3.10.4%2026-10-10Fix
CVE-2026-104801PPOM WordPress plugin unauthenticated arbitrary file deletion9.1CNA v3.10.8%2026-10-10Fix
CVE-2026-104797Advanced Form Integration WordPress plugin authentication bypass8.1CNA v3.10.4%2026-10-10Fix
CVE-2026-104766Appointment Booking Plugin WordPress plugin privilege escalation8.8CNA v3.10.3%2026-10-10Fix
CVE-2026-104763Post Export Import with Media WordPress plugin path traversal to arbitrary file read4.9CNA v3.10.7%2026-10-10Fix
CVE-2026-104762Kadence Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-104759WPO365 SEAMLESS WORDPRESS + MICROSOFT INTEGRATION plugin unauthenticated authentication bypass8.1CNA v3.10.5%2026-10-10Fix
CVE-2026-104754Rank Math SEO WordPress plugin Admin+ stored XSS via Redirection Source URL3.5CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-104753Rank Math SEO WordPress plugin Admin+ SQLi via per_page parameter4.1CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-104752Rank Math SEO WordPress plugin Admin+ arbitrary file upload to RCE via settings import7.2CISA ADP v3.10.5%2026-10-10Fix
CVE-2026-104742AI Puffer WordPress plugin missing authorization authenticated Semantic Search settings modification3.1CNA v3.10.3%2026-10-10Fix
CVE-2026-104741AI Puffer WordPress plugin missing authorization authenticated Global plugin settings modification3.1CNA v3.10.3%2026-10-10Fix
CVE-2026-104735RSS Aggregator by Feedzy WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-104732Advanced IP Blocker WordPress plugin unauthenticated authentication bypass9.8CNA v3.10.5%2026-10-10Fix
CVE-2026-104728AutomatorWP WordPress plugin missing authorization authenticated sensitive information disclosure4.3CNA v3.10.3%2026-10-10Fix
CVE-2026-104725Groundhogg WordPress plugin authenticated (Custom+) privilege escalation to user parameter8.8CNA v3.10.3%2026-10-10Fix
CVE-2026-104724FireBox WordPress plugin authenticated (Author+) SQL injection via FireBox form Display condition5.3CNA v3.10.2%2026-10-10Fix
CVE-2026-104723LifterLMS WordPress plugin authenticated (Custom+) PHP object injection via custom Lesson data8.8CNA v3.10.4%2026-10-10Fix
CVE-2026-104722Webilia Listdom LSD_Menus_IX_CSV::import function path traversal4.9CNA v3.10.6%2026-10-10Fix
CVE-2026-104398AFFI Affiliate Marketing for WooCommerce WordPress plugin PHP object injection9.8CNA v3.10.3%2026-10-10Fix
CVE-2026-104023Smart Popup by Supsystic WordPress plugin SQL injection4.9CNA v3.10.4%2026-10-10Fix
CVE-2026-104022Academy LMS WordPress plugin authenticated (Custom+) privilege escalation to add_child REST endpoint5.4CNA v3.10.1%2026-10-10Fix
CVE-2026-104021Fastcache by Host.it WordPress plugin code injection7.2CNA v3.10.4%2026-10-10Fix
CVE-2026-104006SpeedyCache WordPress plugin unauthenticated sensitive information exposure3.7CNA v3.10.3%2026-10-10Fix
CVE-2026-103998Form Maker by 10Web WordPress plugin reflected cross-site scripting via inputs parameter Array Key6.1CNA v3.10.2%2026-10-10Fix
CVE-2026-103964Download Manager WordPress plugin sensitive information exposure4.3CNA v3.10.2%2026-10-10Fix
CVE-2026-103912JetFormBuilder WordPress plugin reflected DOM-based cross-site scripting4.7CNA v3.10.2%2026-10-10Fix
CVE-2026-103897Responsive Lightbox and Gallery WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2026-10-10Fix
CVE-2026-1038893D Product configurator for WooCommerce WordPress plugin unauthenticated remote code execution9.8CNA v3.10.7%2026-10-10Exploit codeFix
CVE-2026-103685VillaTheme ALD missing authorization4.3CNA v3.10.2%2026-10-10Fix
CVE-2026-103636Apache DataSketches VarOpt union deserialization out-of-bounds read7.5CISA ADP v3.10.5%2026-10-10Fix
CVE-2026-103635Apache DataSketches compact Theta sketch deserialization out-of-bounds read9.1CISA ADP v3.10.6%2026-10-10Fix
CVE-2026-103520HivePress WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-103513Apache DataSketches CPC sketch deserialization out-of-bounds read9.8CISA ADP v3.10.4%2026-10-10Fix
CVE-2026-103501Apache DataSketches HLL sketch deserialization heap-based buffer overflow9.8CISA ADP v3.10.7%2026-10-10Fix
CVE-2026-103482Simple Newsletter Plugin WordPress plugin stored cross-site scripting5.4CNA v3.10.3%2026-10-10Fix
CVE-2026-103478Premium Packages WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-10-10Fix
CVE-2026-103427Simple Membership WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-103424Anti-Spam by CleanTalk WordPress plugin unauthenticated stored cross-site scripting5.4CNA v3.10.2%2026-10-10Fix
CVE-2026-103365Bookly WordPress plugin information disclosure5.3CNA v3.10.3%2026-10-10Fix
CVE-2026-103357GIFT4U WordPress plugin broken access control6.9CNA v4.00.3%2026-10-10Fix
CVE-2026-103071Thank You Page Customizer for WooCommerce WordPress plugin content injection7.5CNA v3.10.3%2026-10-10Fix
CVE-2026-102774SureDash WordPress plugin stored DOM-based cross-site scripting6.4CNA v3.10.3%2026-10-10Fix
CVE-2026-102402Team WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-102401Download Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-102388Forminator WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-10Fix
CVE-2026-102291themeum Kirki TheFrontend::replace_content vulnerability5.4CNA v3.10.3%2026-10-10Fix
CVE-2026-101947ExifTool for photo and video local OS command injection through filenames during CSV export8.4CNA v4.00.1%2026-10-10
CVE-2026-101921WPForms WordPress plugin reflected cross-site scripting4.7CNA v3.10.3%2026-10-10Fix
CVE-2026-101920Molongui Authorship WordPress plugin unauthenticated stored DOM-based cross-site scripting7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-101324Fluent Forms WordPress plugin reflected cross-site scripting4.7CNA v3.10.2%2026-10-10Fix
CVE-2026-100196LazyLoad WordPress plugin unauthenticated stored cross-site scripting via comment content7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-100178WPAdverts WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2026-10-10Fix
CVE-2026-100161Photo Reviews for WooCommerce WordPress plugin unauthenticated stored DOM-based cross-site scripting7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-100147FunnelKit WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-10Reported exploitedFix
CVE-2026-97853Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS6.9CNA v4.00.1%2026-10-10Fix
CVE-2026-97670Avada (Fusion) Builder WordPress plugin authorization bypass9.1CNA v3.10.4%2026-10-10Reported exploitedFix
CVE-2026-97643GiveWP WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-97630FV Flowplayer Video Player WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-97396Email Marketing for WordPress and WooCommerce plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-97348SiteOrigin Widgets Bundle WordPress plugin arbitrary file read6.5CNA v3.10.7%2026-10-10Fix
CVE-2026-97340Avada Website Builder For WordPress and WooCommerce theme stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-97264WPAdverts WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-10Fix
CVE-2026-97263WPAdverts WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-10Fix
CVE-2026-96840Post Grid Gutenberg Blocks WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-10Fix
CVE-2026-96765WPO365 SEAMLESS WORDPRESS + MICROSOFT INTEGRATION plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-96743Table Field Add-on for ACF and SCF WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-96682Presto Player WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-10Fix
CVE-2026-96667Real Estate Manager WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-96662Appointment Booking WordPress plugin unauthenticated SQL injection via booking[service_id] parameter7.5CNA v3.10.4%2026-10-10Fix
CVE-2026-96653WP Directory Kit WordPress plugin SQL injection6.5CNA v3.10.2%2026-10-10Fix
CVE-2026-96648Data Tables Generator by Supsystic WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-96574User Frontend WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-96572WP Meteor Website Speed Optimization Addon WordPress plugin stored cross-site scripting7.2CNA v3.10.2%2026-10-10Fix
CVE-2026-96563Motors WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-96558Quiz and Survey Master (QSM) WordPress plugin unauthenticated stored DOM-based cross-site scripting7.2CNA v3.10.2%2026-10-10Fix
CVE-2026-96341Forminator WordPress plugin privilege escalation8.2CNA v3.10.3%2026-10-10Fix
CVE-2026-96278WP Photo Album Plus WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-95684VikBooking Hotel Booking Engine and PMS WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-10Fix
CVE-2026-94676Tainacan WordPress plugin PHP object injection7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-94590Sell Downloads WordPress plugin broken access control6.5CNA v3.10.2%2026-10-10Fix
CVE-2026-94589Extensions For CF7 WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.10.7%2026-10-10Fix
CVE-2026-94538WP File Download WordPress plugin authorization bypass8.1CNA v3.10.2%2026-10-10Fix
CVE-2026-94421Church Admin WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-94375Order Export and Order Import for WooCommerce WordPress plugin information disclosure5.3CNA v3.10.3%2026-10-10Fix
CVE-2026-94257SMS Alert - unauthenticated privilege escalation via arbitrary Password Reset8.1CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-94256SMS Alert unauthenticated authentication bypass via Login with OTP8.1CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-94160ThemeStek Extras for LabtechCO WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-10
CVE-2026-93951Zeinet WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-10
CVE-2026-93950Motors WordPress theme broken access control7.5CNA v3.10.2%2026-10-10
CVE-2026-93949Grocery Shopping Store WordPress theme broken authentication7.1CNA v3.10.2%2026-10-10
CVE-2026-93945Balance WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93944Camelia WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93943Convex WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93942Dwell WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93941Edema WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93940Greeny WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93938Hogwords WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93937Hygia WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93936IPharm WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93935Let's Play WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93934Partiso WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93933Rosalinda WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93932Smart Casa WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93931Smash WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93930Tantra WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93929Travesia WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93927Veto WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-93883Advanced Classifieds and Directory Pro WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-93775Podlove Podcast Publisher WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-93746WebToffee WooCommerce PDF Invoices WordPress plugin insecure direct object reference7.5CNA v3.10.5%2026-10-10Fix
CVE-2026-92975Groundhogg WordPress plugin unauthenticated privilege escalation to Support user Identity confusion8.1CNA v3.10.4%2026-10-10Fix
CVE-2026-91862Getwid WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-91136Divi Plus WordPress plugin unauthenticated arbitrary file read via svg_image parameter7.5CNA v3.11.8%2026-10-10Reported exploitedNucleiExploit codeFix
CVE-2026-91050Appointment Booking Plugin WordPress plugin insecure direct object reference4.3CNA v3.10.2%2026-10-10Fix
CVE-2026-89301rtMedia for WordPress, BuddyPress and bbPress WordPress plugin file deletion7.5CNA v3.10.4%2026-10-10Fix
CVE-2026-89100Payment Plugins for Stripe WooCommerce WordPress plugin reflected DOM-based cross-site scripting6.1CNA v3.10.2%2026-10-10Fix
CVE-2026-87869Filter Everything WordPress and WooCommerce Filters plugin reflected cross-site scripting6.1CNA v3.10.2%2026-10-10Fix
CVE-2026-87781LTL Freight Quotes Old Dominion Edition - unauthenticated SQLi via Shipping Rule edit_id parameter8.6CISA ADP v3.10.3%2026-10-10Fix
CVE-2026-87780LTL Freight Quotes Old Dominion Edition WordPress plugin unauthenticated stored XSS8.8CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-85571Tutor LMS - Instructor+ arbitrary Post Reparenting via IDOR6.5CISA ADP v3.10.2%2026-10-10Fix
CVE-2026-83526FV Player 8 WordPress plugin arbitrary file upload8.8CNA v3.10.6%2026-10-10Fix
CVE-2026-81797Buzz Stone Magazine and Viral Blog WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-78535Photolia WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-78534Educavo WordPress theme cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-10
CVE-2026-78533Qwery WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-78532LMS WordPress theme cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-10
CVE-2026-78531Jacqueline WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-78530FoodBakery WordPress theme arbitrary file deletion7.7CNA v3.10.4%2026-10-10
CVE-2026-78529Alliance WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-78068Table Field Add-on for ACF and SCF WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-77183FooSales WordPress plugin privilege escalation8.8CNA v3.10.3%2026-10-10Fix
CVE-2026-66569Kicker WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-66568Original WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-66567Anesta WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-66566Ambient WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-66565FC United WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-66564ShiftCV WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-66563Windsor WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-66483Education Center WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-66482Drone Media WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-66481Presto Player Pro WordPress plugin arbitrary file deletion6.8CNA v3.10.3%2026-10-10Fix
CVE-2026-66480YITH WooCommerce Product Add-Ons WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-10Fix
CVE-2026-66435WP Rollback WordPress plugin sensitive data exposure5.9CNA v3.10.2%2026-10-10Fix
CVE-2026-65459Forminator WordPress plugin arbitrary content deletion vulnerability7.5CNA v3.10.2%2026-10-10Fix
CVE-2026-62130WooCommerce Multilingual and Multicurrency WordPress plugin PHP object injection7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-62129Creator LMS WordPress plugin arbitrary file upload9.9CNA v3.10.3%2026-10-10Fix
CVE-2026-62125Asia Garden WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-62124N7 Golf Club Sports and Events WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-62123Invetex WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-62120Law Office WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-62118Barcode Scanner with Inventory and Order Manager WordPress plugin broken access control7.3CNA v3.10.2%2026-10-10Fix
CVE-2026-62117Barcode Scanner with Inventory and Order Manager WordPress plugin SQL injection8.5CNA v3.10.3%2026-10-10Fix
CVE-2026-62116Barcode Scanner with Inventory and Order Manager WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10Fix
CVE-2026-62115KuteShop WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62100KuteShop WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62099Boutique WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62098Boutique WordPress theme arbitrary shortcode execution vulnerability6.5CNA v3.10.2%2026-10-10
CVE-2026-62096Biolife WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62095Biolife WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62094TechOne WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62093TechOne WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62092Armania WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62091Armania WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62090WineShop WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62087Equadio WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62086Juno WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62082Pin WP WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62077Avala WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62076Kalles WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62075Backhoe WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62074Ozeum WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62070Flipmart WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62069Fabius WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62068Teoro WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62067Kaven WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62066Volos WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62065Cardea WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-62064Ambed WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62054Yacht Rental WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62053Wine House WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62052Tipsy WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62051Stargaze WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62050Splendour WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-62046Gutentype WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-62045Booklovers WordPress theme PHP object injection9.8CNA v3.10.3%2026-10-10
CVE-2026-62044Super Video Player WordPress plugin PHP object injection7.2CNA v3.10.3%2026-10-10
CVE-2026-62043Contact Form 7 Dynamic Text Extension WordPress plugin sensitive data exposure7.5CNA v3.10.3%2026-10-10
CVE-2026-62038eRoom WordPress plugin broken authentication7.3CNA v3.10.3%2026-10-10
CVE-2026-62037Document Embedder WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62035AWS S3 for WordPress Plugin Upcasted broken access control6.3CNA v3.10.2%2026-10-10
CVE-2026-62034Before After Image Comparison Image comparison for WP WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62033uListing WordPress plugin settings Change vulnerability7.6CNA v3.10.3%2026-10-10
CVE-2026-62032DirectoryPress WordPress plugin local file inclusion9.8CNA v3.10.3%2026-10-10
CVE-2026-62031uListing WordPress plugin SQL injection9.3CNA v3.10.3%2026-10-10
CVE-2026-62030StreamCast WordPress plugin server side request forgery (SSRF)7.2CNA v3.10.2%2026-10-10
CVE-2026-62027Team Section Block WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-62025Tailored Tools WordPress plugin arbitrary file upload9.0CNA v3.10.3%2026-10-10
CVE-2026-62024CodeBard Help Desk WordPress plugin arbitrary file upload9.9CNA v3.10.4%2026-10-10
CVE-2026-62022Tonda Membership WordPress plugin privilege escalation9.8CNA v3.10.3%2026-10-10
CVE-2026-62021Angio WordPress theme PHP object injection8.8CNA v3.10.5%2026-10-10
CVE-2026-62020TouchUp WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10Fix
CVE-2026-57806Martfury - WooCommerce Marketplace WordPress theme reflected cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-57742Kids Planet WordPress theme cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-10
CVE-2026-48194DukaMarket WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-48193Uminex WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-45440WP Ultimate CSV Importer WordPress plugin SQL injection7.6CNA v3.10.3%2026-10-10Fix
CVE-2026-42777Aalto WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-42724CleanSkin WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-42723CleanSkin WordPress theme PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-42722Frontend Admin by DynamiApps WordPress plugin SQL injection7.6CNA v3.10.3%2026-10-10
CVE-2026-42719Dynamic User Directory WordPress plugin PHP object injection9.8CNA v3.10.5%2026-10-10
CVE-2026-42718Booster for WooCommerce WordPress plugin PHP object injection9.8CNA v3.10.4%2026-10-10Fix
CVE-2026-42717Leyka WordPress plugin SQL injection7.6CNA v3.10.3%2026-10-10
CVE-2026-42716Payever - WooCommerce Gateway WordPress plugin PHP object injection9.8CNA v3.10.4%2026-10-10
CVE-2026-42715Photo Gallery by 10Web WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-42712Qode Tours WordPress plugin SQL injection8.5CNA v3.10.3%2026-10-10
CVE-2026-42711Slider by 10Web WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-42709Food Menu Restaurant Menu and Online Ordering for WooCommerce WordPress plugin cross-site scripting7.1CNA v3.10.2%2026-10-10Fix
CVE-2026-42706DK WordPress theme broken access control7.5CNA v3.10.2%2026-10-10
CVE-2026-42705Grand News WordPress theme broken access control7.5CNA v3.10.2%2026-10-10
CVE-2026-42704Kids Care WordPress theme local file inclusion8.1CNA v3.10.3%2026-10-10
CVE-2026-42702Tutor LMS WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10Fix
CVE-2026-42699FV Player 8 WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10Fix
CVE-2026-42697Social Share Icons and Social Share Buttons WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10Fix
CVE-2026-42696SiteVault Backup, Restore, Migration and Cloning WordPress plugin remote code execution (RCE)10.0CNA v3.10.4%2026-10-10Fix
CVE-2026-42693Jannah WordPress theme cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-42633Events Manager WordPress plugin SQL injection8.5CNA v3.10.3%2026-10-10Fix
CVE-2026-42632Qode Real Estate WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-42631Qode Music WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-42630Web Plura Backup and Restore Manager WordPress plugin sensitive data exposure7.5CNA v3.10.3%2026-10-10
CVE-2026-42419Swish Migrate and Backup WordPress plugin sensitive data exposure5.9CNA v3.10.3%2026-10-10
CVE-2026-40808Jetpack VideoPress WordPress plugin broken access control6.5CNA v3.10.3%2026-10-10Fix
CVE-2026-40805PeepSo WordPress plugin arbitrary file deletion7.7CNA v3.10.5%2026-10-10
CVE-2026-40803Jotform AI Chatbot WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-40802Pubjet پاب جت WordPress plugin settings Change vulnerability7.6CNA v3.10.3%2026-10-10
CVE-2026-40801Wordable WordPress plugin broken access control8.1CNA v3.10.3%2026-10-10
CVE-2026-40800ELEX WooCommerce Advanced Bulk Edit Products, Prices and Attributes WordPress plugin SQL injection9.3CNA v3.10.4%2026-10-10
CVE-2026-40777WPSection WordPress plugin broken access control8.1CNA v3.10.4%2026-10-10
CVE-2026-39802Everest Backup WordPress plugin remote code execution (RCE)8.1CNA v3.10.5%2026-10-10
CVE-2026-39801AIWU WordPress plugin privilege escalation9.8CNA v3.10.5%2026-10-10
CVE-2026-39800Additional Order Filters for WooCommerce WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-39799WP File Download WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-10
CVE-2026-27350Builderius WordPress plugin server side request forgery (SSRF)7.2CNA v3.10.2%2026-10-10
CVE-2026-18558Embed Any Document WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-18496Booking Calendar WordPress plugin information disclosure5.3CNA v3.10.2%2026-10-10Fix
CVE-2026-17025Graphene WordPress theme authenticated (Subscriber+) stored cross-site scripting via Profile fields6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-16776MP3 Audio Player WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-15178Fluent Forms WordPress plugin authorization bypass5.4CNA v3.10.2%2026-10-10Fix
CVE-2026-14882Brizy WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-14877Data Tables Generator by Supsystic WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-14379GamiPress WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-14335Easy Digital Downloads WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-10Fix
CVE-2026-12626Online Scheduling and Appointment Booking System WordPress plugin PHP object injection7.2CNA v3.10.3%2026-10-10Fix
CVE-2026-12054Download Manager WordPress plugin unauthenticated DOM-based reflected cross-site scripting6.1CNA v3.10.2%2026-10-10Fix
CVE-2026-9696Download Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-6723Appointment Booking Calendar WordPress plugin incorrect authorization5.3CNA v3.10.2%2026-10-10Fix
CVE-2026-6243Frontend Admin by DynamiApps WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-5727Hello Plus WordPress plugin missing authorization Template activation5.4CNA v3.10.2%2026-10-10Fix
CVE-2026-5725Favicon Rotator WordPress plugin reflected cross-site scripting via fvrt_ prefix6.1CNA v3.10.2%2026-10-10Fix
CVE-2026-4791PeproDev Ultimate Profile Solutions WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-10Fix
CVE-2026-3717CV Builder WordPress plugin arbitrary file upload5.3CNA v3.10.2%2026-10-10Fix
CVE-2026-108474JetBrains Exposed SQL injection9.8CNA v3.10.3%2026-10-09Fix
CVE-2026-108269Privasys ra-tls-clients RA-TLS challenge verifier origin validation error9.1CNA v4.00.1%2026-10-09Fix
CVE-2026-108268Privasys enclave-os-virtual RA-TLS certificate issuer origin validation error9.1CNA v4.00.1%2026-10-09
CVE-2026-108267Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session9.1CNA v4.00.1%2026-10-09
CVE-2026-108266Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session9.1CNA v4.00.1%2026-10-09
CVE-2026-108265Privasys enclave-os-mini RA-TLS challenge certificate path origin validation error9.1CNA v4.00.1%2026-10-09
CVE-2026-108264Wizarr wizard step rendering server-side template injection9.1CNA v3.10.4%2026-10-09Fix
CVE-2026-108263iflytek astron-agent Astron Agent: Unsandboxed code-node leads to cross-tenant RCE9.9CNA v3.10.4%2026-10-09Fix
CVE-2026-108261TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment9.3CNA v3.10.2%2026-10-09Fix
CVE-2026-108260tinacms web-components tina-markdown element stored cross-site scripting7.6CNA v3.10.2%2026-10-09Fix
CVE-2026-108259tinacms tina: Code injection via unescaped Git branch name in generated client source8.2CNA v3.10.3%2026-10-09Fix
CVE-2026-108258posit-dev py-shiny shiny for Python path traversal in bookmark restore6.9CNA v4.00.4%2026-10-09Fix
CVE-2026-108160iflytek astron-rpa AstronRPA Unsigned Update Installation via Plain-HTTP Feed7.7CNA v4.00.1%2026-10-09
CVE-2026-108159iflytek astron-rpa AstronRPA RCE via Smart-Component Chat XSS and IPC Bridge7.7CNA v4.00.3%2026-10-09
CVE-2026-108158mynaparrot plugNmeet-server plugNmeet server path traversal via /API/whiteboard/convert7.1CNA v4.00.3%2026-10-09
CVE-2026-108157smp46 pingvin-share-x Pingvin Share X account takeover via OAuth Email Linking9.2CNA v4.00.5%2026-10-09Fix
CVE-2026-108156LobsterAI arbitrary Directory Deletion via Skill _meta.json6.9CNA v4.00.1%2026-10-09
CVE-2026-108125WordPress Post Author Authenticated SQLi7.1CNA v4.00.2%2026-10-09Fix
CVE-2026-108124WordPress Post Author Authenticated SQLi4.9CNA v3.10.2%2026-10-09Fix
CVE-2026-108119BusyBox tar applet privilege escalation6.3CNA v3.10.1%2026-10-09Fix
CVE-2026-108113ILIAS,, and unrestricted file upload via QTI Import8.7CNA v4.00.6%2026-10-09Fix
CVE-2026-108112ruoyi-ai missing authorization via Workflow Delete endpoint5.3CNA v4.00.2%2026-10-09
CVE-2026-108111ruoyi-ai missing authorization via /workflow/search5.3CNA v4.00.2%2026-10-09
CVE-2026-108110MOVO authorization bypass via Document endpoints7.6CNA v4.00.2%2026-10-09
CVE-2026-108109PHPNuxBill account takeover via Brute-Forceable Password Reset Code9.3CNA v4.00.4%2026-10-09
CVE-2026-108108PHPNuxBill CHAP authentication bypass via Password::chap_verify7.1CNA v4.00.2%2026-10-09
CVE-2026-108107PHPNuxBill unauthenticated SQL injection via radius.php9.3CNA v4.00.4%2026-10-09
CVE-2026-108106Xerial snappy-java Unbounded Memory Allocation denial of service8.7CNA v4.00.4%2026-10-09Fix
CVE-2026-108105Open5GS MME reachable assertion via GTPv1 SGSN Context request8.2CNA v4.00.5%2026-10-09
CVE-2026-108104Xerial snappy-java Double Release of Pooled Buffers in SnappyFramedInputStream6.3CNA v4.00.2%2026-10-09Fix
CVE-2026-108103Open5GS heap out-of-bounds read via PFCP Dropped DL Traffic Threshold IE6.9CNA v4.00.4%2026-10-09
CVE-2026-108102Open5GS heap out-of-bounds read via PFCP Volume Measurement IE6.9CNA v4.00.4%2026-10-09Fix
CVE-2026-108101danielbrendel hortusfox-web HortusFox unrestricted file upload via Plant Attachments7.7CNA v4.00.4%2026-10-09Fix
CVE-2026-108100danielbrendel hortusfox-web HortusFox SQL injection via /API/locations/list include_info parameter7.1CNA v4.00.3%2026-10-09Fix
CVE-2026-108096Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category7.1CNA v4.00.3%2026-10-09Fix
CVE-2026-108093Red Hat Enterprise Linux 10 gimp: Gimp: Denial of service5.5CNA v3.10.1%2026-10-09
CVE-2026-108063Red Hat libhangul hanja_new null pointer dereference5.5CNA v3.10.1%2026-10-09
CVE-2026-108039Apache CXF StaxUtils denial of service7.5CISA ADP v3.10.5%2026-10-09Fix
CVE-2026-107938Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification9.1CISA ADP v3.10.2%2026-10-09Fix
CVE-2026-107937Apache CXF multipart/MTOM attachment parser denial of service7.5CISA ADP v3.10.6%2026-10-09Fix
CVE-2026-107935gvisor-tap-vsock gvproxy /expose endpoint path traversal9.3CNA v3.10.3%2026-10-09
CVE-2026-107914backdropcms Backdrop incomplete cleanup7.8CNA v3.10.1%2026-10-09Fix
CVE-2026-107911Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument7.7CNA v4.00.4%2026-10-09Fix
CVE-2026-107910Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling9.2CNA v4.00.5%2026-10-09Fix
CVE-2026-107909Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling8.8CNA v4.00.4%2026-10-09Fix
CVE-2026-107908Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message9.3CNA v4.00.6%2026-10-09Fix
CVE-2026-107890OpenPrinting cups null pointer dereference3.3CNA v3.10.1%2026-10-09Fix
CVE-2026-107889Red Hat Build of Keycloak keycloak-services: Keycloak-services: Stored XSS on login page5.5CNA v3.10.3%2026-10-09
CVE-2026-107888OpenPrinting cups null pointer dereference5.1CNA v3.10.1%2026-10-09Fix
CVE-2026-107886OpenPrinting cups double free2.3CNA v3.10.1%2026-10-09Fix
CVE-2026-107885OpenPrinting cups resource exhaustion3.3CNA v3.10.1%2026-10-09Fix
CVE-2026-107857Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile4.4CNA v3.10.1%2026-10-09Fix
CVE-2026-107856CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email4.5CNA v3.10.2%2026-10-09Fix
CVE-2026-107854Jexactyl billing order endpoint insecure direct object reference5.4CNA v3.10.2%2026-10-09Fix
CVE-2026-107852Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment7.1CNA v4.00.2%2026-10-09Fix
CVE-2026-107851Contao: Improper access control in the table access voter4.3CNA v3.10.2%2026-10-09Fix
CVE-2026-107850Contao: Improper access control in the preview links module4.3CNA v3.10.2%2026-10-09Fix
CVE-2026-107848Contao: Cross-site request forgery in custom backend actions3.5CNA v3.10.1%2026-10-09Fix
CVE-2026-107845Contao: Cross-site scripting in the comments bundle9.3CNA v3.10.3%2026-10-09Fix
CVE-2026-107844Contao: Path traversal in the images controller5.3CNA v3.10.3%2026-10-09Fix
CVE-2026-107843Contao: The registration module re-sends activation mails5.3CNA v3.10.3%2026-10-09Fix
CVE-2026-107842Contao ModuleSearch information disclosure5.3CNA v3.10.3%2026-10-09Fix
CVE-2026-107841john-broadway pacioli pacioli-guard document-layer consent gate incorrect authorization5.7CNA v3.10.2%2026-10-09Fix
CVE-2026-107840yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels7.5CNA v3.10.4%2026-10-09Fix
CVE-2026-107839luskaner ageLANServer AoE3 Cloud getFileURL endpoint denial of service7.5CNA v3.10.3%2026-10-09Fix
CVE-2026-107838RIOT: Nanocoap_fileserver ignores response initialization failure, leading to reachable assertion7.5CNA v3.10.3%2026-10-09
CVE-2026-107837RIOT: Out-of-bounds read in RIOT OS 6LoWPAN SFF Fragment Handling8.2CNA v3.10.4%2026-10-09
CVE-2026-107836RIOT: NanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size7.1CNA v4.00.3%2026-10-09
CVE-2026-107835OWASP Coraza WAF: Cookie Parser Confusion4.0CNA v3.10.3%2026-10-09Fix
CVE-2026-107834OWASP Coraza WAF: Resource exhaustion5.3CNA v3.10.3%2026-10-09Fix
CVE-2026-107833OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion5.9CNA v3.10.4%2026-10-09Fix
CVE-2026-107826OWASP Coraza WAF JSON body processor stack overflow7.5CNA v3.10.5%2026-10-09Fix
CVE-2026-107825OWASP Coraza WAF ProcessURI improper input validation4.0CNA v3.10.3%2026-10-09Fix
CVE-2026-107824duty1g x64dbg-mcp-server missing authentication9.3CNA v4.00.4%2026-10-09Fix
CVE-2026-107823MariaDB: Privilege escalation via incorrect view frm parsing7.2CNA v3.10.7%2026-10-09Fix
CVE-2026-107822MariaDB: Database privilege escalation via user / role name collision in the acl cache6.4CNA v3.10.5%2026-10-09Fix
CVE-2026-107821MariaDB: Insufficient validation of binary frm data when opening a table8.0CNA v3.10.8%2026-10-09Exploit codeFix
CVE-2026-107820duty1g x64dbg-mcp-server x64dbg-MCP Server vulnerable to pre-authentication denial of service5.3CNA v3.10.4%2026-10-09Fix
CVE-2026-107819MariaDB Connector/C libmariadb information disclosure5.9CNA v3.10.2%2026-10-09Fix
CVE-2026-107818MariaDB: Environment injection via wsrep bootstrap in the MariaDB.service file8.4CNA v3.10.3%2026-10-09Fix
CVE-2026-107817MariaDB: Mysql_json plugin OOB reads4.4CNA v3.10.1%2026-10-09Fix
CVE-2026-107816MariaDB: `qc_info` plugin can do OOB reads if query contains \06.4CNA v3.10.3%2026-10-09Fix
CVE-2026-107815MariaDB: One byte OOB write in DOS tables of the CONNECT engine8.5CNA v3.10.9%2026-10-09Fix
CVE-2026-107814MariaDB: Insecure $HOME in MariaDB rpm packages8.4CNA v3.10.3%2026-10-09Fix
CVE-2026-1078130xJacky nginx-ui api/cluster router missing authorization8.8CNA v3.10.3%2026-10-09Fix
CVE-2026-1078120xJacky nginx-ui self-upgrade mechanism vulnerability7.5CNA v3.10.2%2026-10-09Fix
CVE-2026-1078110xJacky nginx-ui /api/nodes information disclosure8.8CNA v3.10.4%2026-10-09Fix
CVE-2026-1078100xJacky nginx-ui backup restore symlink following8.1CNA v3.10.4%2026-10-09Fix
CVE-2026-107809Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs8.8CNA v3.10.2%2026-10-09Fix
CVE-2026-1078080xJacky nginx-ui login API authentication bypass8.1CNA v3.10.4%2026-10-09Fix
CVE-2026-1078070xJacky nginx-ui nginx UI: Node Secret credential exposure via URL Query parameter8.8CNA v3.10.3%2026-10-09Fix
CVE-2026-1078060xJacky nginx-ui Nginx UI: Authenticated remote code execution9.4CNA v4.00.3%2026-10-09Exploit codeFix
CVE-2026-1078050xJacky nginx-ui nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage7.5CNA v3.10.4%2026-10-09Fix
CVE-2026-1078040xJacky nginx-ui bundled reverse proxy origin validation error5.3CNA v3.10.2%2026-10-09Fix
CVE-2026-107803ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter6.5CNA v3.10.2%2026-10-09Fix
CVE-2026-107785Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated6.3CNA v4.00.1%2026-10-09Fix
CVE-2026-107783Insertion of sensitive information into log file in AWS tools for PowerShell6.7CNA v4.00.1%2026-10-09Fix
CVE-2026-107655Red Hat Hardened Images cups: Null pointer dereference4.0CNA v3.10.1%2026-10-09Fix
CVE-2026-107419AI Translation for Polylang WordPress plugin broken access control5.4CNA v3.10.2%2026-10-09Fix
CVE-2026-106602Jetpack WordPress plugin broken authentication4.8CNA v3.10.2%2026-10-09Fix
CVE-2026-106601Jetpack WordPress plugin broken authentication5.4CNA v3.10.2%2026-10-09Fix
CVE-2026-106581Docker Desktop for Windows installer failed to verify external packages8.2CNA v4.00.1%2026-10-09Fix
CVE-2026-106155Stored cross-site scripting (XSS) in Telerik Report Server Web Report Viewers8.9CNA v3.10.2%2026-10-09Fix
CVE-2026-106145Privilege escalation in Telerik Report Server Service-Agent Hub7.1CNA v3.10.1%2026-10-09Fix
CVE-2026-106097Code Snippets migration import endpoints SQL injection6.8CISA ADP v3.10.2%2026-10-09Fix
CVE-2026-106095Code Snippets update_code_snippet vulnerability3.3CISA ADP v3.10.2%2026-10-09Fix
CVE-2026-105883Th Shop Mania WordPress theme broken access control7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-105877QA Analytics WordPress plugin sensitive data exposure6.9CNA v4.00.3%2026-10-09Fix
CVE-2026-105872Product Configurator for WooCommerce WordPress plugin PHP object injection7.2CNA v3.10.3%2026-10-09Fix
CVE-2026-105870WP Associate Post R2 WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09Fix
CVE-2026-105318AcyMailing SMTP Newsletter WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09Fix
CVE-2026-105281Grid Protection Alliance openPDC and openHistorian missing authentication for critical function8.7CNA v4.00.3%2026-10-09Fix
CVE-2026-105278Grid Protection Alliance openPDC (Docker image) use of hard-coded credentials9.3CNA v4.00.3%2026-10-09
CVE-2026-104635Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages8.2CNA v4.00.4%2026-10-09Fix
CVE-2026-104629Grid Protection Alliance openPDC and openHistorian component loading mechanism unsafe reflection7.7CNA v4.00.3%2026-10-09Fix
CVE-2026-104392Quiz And Survey Master WordPress plugin PHP object injection8.8CNA v3.10.3%2026-10-09Fix
CVE-2026-104117illumos-gate missing authorization1.9CNA v4.00.1%2026-10-09Fix
CVE-2026-104116illumos-gate missing authorization1.9CNA v4.00.1%2026-10-09Fix
CVE-2026-104115Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the daemon5.4CNA v4.00.1%2026-10-09Fix
CVE-2026-104114Null pointer dereference in illumos nwamd door handler allows local users to crash the daemon5.4CNA v4.00.1%2026-10-09Fix
CVE-2026-104113Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon5.4CNA v4.00.1%2026-10-09Fix
CVE-2026-104112illumos-gate name service cache daemon denial of service6.8CNA v4.00.1%2026-10-09Fix
CVE-2026-104084SmarterTools SmarterMail JWT role claim privilege escalation8.7CNA v4.00.3%2026-10-09Fix
CVE-2026-104083SmarterTools SmarterMail HTML sanitizer vulnerability5.3CNA v4.00.3%2026-10-09Fix
CVE-2026-104082SmarterTools SmarterMail Volume Mount remote code execution8.6CNA v4.00.6%2026-10-09Exploit codeFix
CVE-2026-104081KodExplorer path traversal via unzip_pre_name ZIP Extraction7.2CNA v4.00.8%2026-10-09Fix
CVE-2026-104079Envira Gallery Lite missing authorization via Gallery Conversion REST endpoint5.3CNA v4.00.2%2026-10-09Fix
CVE-2026-103413Apache Camel Karavan: Unvalidated Kubernetes resources applied from a project's kubernetes.yaml8.8CNA v3.10.4%2026-10-09Fix
CVE-2026-103412Apache Camel Karavan: Project file name path traversal when committing a project to Git8.8CNA v3.10.5%2026-10-09Fix
CVE-2026-103329Super Payments WordPress plugin unauthenticated Payment Confirmation forgery via Webhook Signature5.3CNA v3.10.1%2026-10-09Fix
CVE-2026-103220Canva Affinity improper array index validation4.5CNA v3.10.1%2026-10-09Fix
CVE-2026-102916Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host6.8CNA v4.00.1%2026-10-09Fix
CVE-2026-102554Google denial of service via Eager Array Allocation during deserialization in Guava8.2CNA v4.00.4%2026-10-09Fix
CVE-2026-101130Canva Affinity buffer over-read3.6CNA v3.10.1%2026-10-09Fix
CVE-2026-101094Canva Affinity buffer over-read3.6CNA v3.10.1%2026-10-09Fix
CVE-2026-101028ash-project ash incorrect authorization6.0CNA v4.00.3%2026-10-09Fix
CVE-2026-101022Grid Protection Alliance openPDC and openHistorian server-side request forgery (SSRF)5.3CNA v4.00.2%2026-10-09
CVE-2026-100730Grid Protection Alliance openPDC and openHistorian deserialization of untrusted data9.3CNA v4.00.6%2026-10-09Fix
CVE-2026-100227Apache CXF: XML Signature wrapping in JAX-RS XML Security7.5CISA ADP v3.10.3%2026-10-09Fix
CVE-2026-98384Linux kernel bpf out-of-bounds read–0.2%2026-10-09Fix
CVE-2026-98383In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may reallocate skb->head, leaving the per-CPU–0.2%2026-10-09Fix
CVE-2026-98382In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices __bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare eq–0.2%2026-10-09Fix
CVE-2026-98381In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or replaced, those queues keep the old poin–0.2%2026-10-09Fix
CVE-2026-98380Linux kernel net/sched null pointer dereference–0.2%2026-10-09Fix
CVE-2026-98379Linux kernel ip6t_rpfilter null pointer dereference–0.2%2026-10-09Fix
CVE-2026-98378Linux kernel bpf use-after-free–0.2%2026-10-09Fix
CVE-2026-98377In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in __vlan_insert_inner_tag() __vlan_insert_inner_tag() only guarantees head room via skb_cow_head(), never that mac_len bytes of MAC header are present. Its ETH_HLEN wrappers - __vlan_in–0.2%2026-10-09Fix
CVE-2026-98376In the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a percpu array serves as an inner map,–0.1%2026-10-09Fix
CVE-2026-98375In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and th–0.2%2026-10-09Fix
CVE-2026-97791Apache CXF race condition7.5CISA ADP v3.10.3%2026-10-09Fix
CVE-2026-97468Apache CXF: Authentication bypass via weak cache keys for validated STS tokens9.1CISA ADP v3.10.2%2026-10-09Fix
CVE-2026-97076WP Rocket WordPress plugin denial of service Attack7.5CNA v3.10.3%2026-10-09Fix
CVE-2026-97075WP Rocket WordPress plugin broken access control6.5CNA v3.10.2%2026-10-09Fix
CVE-2026-96809EduAdmin Booking WordPress plugin SQL injection9.3CNA v3.10.2%2026-10-09Fix
CVE-2026-96761Welcart e-Commerce WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09Fix
CVE-2026-96671Featured Image from URL WordPress plugin cross-site request forgery (CSRF)8.8CNA v3.10.1%2026-10-09Fix
CVE-2026-96607NEX-Forms WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09Fix
CVE-2026-96553FiboSearch WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09Fix
CVE-2026-96539Ultimate Member WordPress plugin privilege escalation5.6CNA v3.10.1%2026-10-09Fix
CVE-2026-96518ProfilePress WordPress plugin broken access control5.9CNA v3.10.2%2026-10-09Fix
CVE-2026-96461Amelia WordPress plugin broken access control7.5CNA v3.10.2%2026-10-09Fix
CVE-2026-96396Canva Affinity heap-based buffer overflow4.9CNA v3.10.1%2026-10-09Fix
CVE-2026-96395Canva Affinity out-of-bounds read3.6CNA v3.10.1%2026-10-09Fix
CVE-2026-96394Canva Affinity buffer over-read2.9CNA v3.10.1%2026-10-09Fix
CVE-2026-96393Canva Affinity untrusted pointer dereference3.6CNA v3.10.1%2026-10-09Fix
CVE-2026-96337ProfilePress WordPress plugin broken access control6.5CNA v3.10.2%2026-10-09Fix
CVE-2026-96336Forminator WordPress plugin Payment bypass vulnerability7.5CNA v3.10.3%2026-10-09Fix
CVE-2026-96334User Registration WordPress plugin broken access control5.6CNA v3.10.1%2026-10-09Fix
CVE-2026-96333GiveWP WordPress plugin Payment bypass vulnerability7.5CNA v3.10.3%2026-10-09Fix
CVE-2026-96332Simple Payment WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-09Fix
CVE-2026-96331Ajax Search Pro WordPress plugin SQL injection9.3CNA v3.10.2%2026-10-09Reported exploitedFix
CVE-2026-96330tagDiv Opt-In Builder WordPress plugin SQL injection9.3CNA v3.10.2%2026-10-09Fix
CVE-2026-96329tagDiv Opt-In Builder WordPress plugin SQL injection8.5CNA v3.10.2%2026-10-09Fix
CVE-2026-96328JNews - Pay Writer WordPress plugin SQL injection9.3CNA v3.10.2%2026-10-09Fix
CVE-2026-96327WPLMS WordPress plugin SQL injection9.3CNA v3.10.3%2026-10-09Fix
CVE-2026-95702Google code execution in Host Sentry Process via double free in gVisor VFS MemoryFile8.5CNA v4.00.1%2026-10-09Fix
CVE-2026-95610UpSolution Core WordPress plugin SQL injection8.5CNA v3.10.2%2026-10-09Fix
CVE-2026-95609Media LIbrary Assistant WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-95608HUSKY WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-09Fix
CVE-2026-95607WPLMS WordPress theme SQL injection8.5CNA v3.10.2%2026-10-09Fix