CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-90865 Command Injection via FTP Notification Variables in Progress WS_FTP Server 29.10.2026 9
CVE-2026-90866 Virtual Folder Path Confinement Bypass in Progress WS_FTP Server 29.10.2026 9.1
CVE-2026-90868 OS Command Injection in Progress WS_FTP Server 29.10.2026 9.9
CVE-2026-84295 Improper Authentication in Progress WS_FTP Server 29.10.2026 10
CVE-2026-90863 Privilege Escalation via Missing Authorization in WS_FTP Manager 29.10.2026 9.1
CVE-2026-90864 Host Administrator Path Containment Bypass in Progress WS_FTP Server 29.10.2026 9.1
CVE-2026-111732 Out-of-bounds write when parsing AR Vendor Block requests 29.10.2026 9.3
CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list) 29.10.2026 9.2
CVE-2026-104339 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.8
CVE-2026-107327 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.9
CVE-2026-107328 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.9
CVE-2026-107329 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.9
CVE-2026-54856 WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54857 WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54858 WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54859 WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54860 WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-61991 WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability 29.10.2026 10
CVE-2026-61992 WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-61997 WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-61998 WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62001 WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62002 WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62003 WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62004 WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62005 WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62006 WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62008 WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62009 WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62010 WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62011 WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62012 WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62013 WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62014 WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62015 WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62016 WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62017 WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62018 WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62131 WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.8
CVE-2026-110186 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.8
CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection 29.10.2026 9.2
CVE-2026-97854 29.10.2026 9.3
CVE-2026-115964 WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability 29.10.2026 9.3
CVE-2026-114358 SQL Injection Vulnerability in Radius Xenia M2M Platform 29.10.2026 9.3
CVE-2026-109516 Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token 29.10.2026 9.8
CVE-2026-42922 29.10.2026 9.8
CVE-2026-66088 Unrestricted Command Execution via system.execute 29.10.2026 9.4
CVE-2026-118579 D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor 28.10.2026 9.3
CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection 28.10.2026 10
CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust 28.10.2026 10
CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs 28.10.2026 9.3
CVE-2026-117574 Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization 28.10.2026 9.1
CVE-2026-63190 FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS 28.10.2026 9.4
CVE-2026-118264 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls 28.10.2026 9.1
CVE-2026-118633 28.10.2026 9.2
CVE-2026-103406 Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. 28.10.2026 9.8
CVE-2026-103409 Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed 28.10.2026 9.8
CVE-2026-44179 XWiki Pro Macros: excerpt-include title and content injection executes code 28.10.2026 9.9
CVE-2026-115968 WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability 28.10.2026 9.8
CVE-2026-105420 Path Traversal in Wing WFTP Server leading to Remote Code Execution 28.10.2026 9.4
CVE-2026-111411 WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability 28.10.2026 9.3
CVE-2026-115607 WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability 29.10.2026 9.3
CVE-2026-115904 Topluyo Desktop for Linux has an OS Command Injection issue 28.10.2026 9.6
CVE-2026-67074 HCL BigFix AEX is affected by multiple security vulnerabilities. 28.10.2026 9.1
CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec 28.10.2026 9.8
CVE-2026-103792 29.10.2026 9.6
CVE-2026-103799 28.10.2026 9.6
CVE-2026-112197 Missing Authentication for Critical Function in Tactis' NoviGest Desktop App 28.10.2026 9.4
CVE-2026-103780 29.10.2026 9.8
CVE-2026-86384 29.10.2026 9.8
CVE-2026-14571 SQL injection (SQLi) in the user authentication module of Futurum Software 28.10.2026 9.1
CVE-2026-86397 28.10.2026 9.8
CVE-2026-86400 28.10.2026 9.8
CVE-2026-90717 28.10.2026 9.1
CVE-2026-109218 Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass 29.10.2026 9.8
CVE-2026-104383 Code injection in EagleCloud Aquila on-premises version 28.10.2026 9.4
CVE-2026-84999 Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler 29.10.2026 9.8
CVE-2026-118375 llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() 28.10.2026 9.2
CVE-2026-106013 Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter 29.10.2026 9.8
CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) 28.10.2026 9.8
CVE-2026-58256 GRR vulnerable to Remote Code Execution Via PHP Code Injection 27.10.2026 9.1
CVE-2026-116692 MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules 27.10.2026 9.8
CVE-2026-112352 Sunhillo SureLine Authentication Bypass via Session Cookie 28.10.2026 9.1
CVE-2026-104350 Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79) 27.10.2026 9.3
CVE-2026-104351 Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) 27.10.2026 9.9
CVE-2026-104353 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) 27.10.2026 9.9
CVE-2026-104354 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 28.10.2026 9.1
CVE-2026-105489 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 28.10.2026 9.9
CVE-2026-105779 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 27.10.2026 9.1
CVE-2026-105780 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) 27.10.2026 9.9
CVE-2026-105781 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) 27.10.2026 10
CVE-2026-108015 eMudhra Compromised Certificate vulnerability impacts HCL Notes Client 27.10.2026 9.1
CVE-2026-114595 Integer overflow or wraparound in EPICS Base 27.10.2026 9.3
CVE-2026-108014 eMudhra Compromised Certificate vulnerability impacts HCL Domino Server 27.10.2026 9.1
CVE-2026-48360 Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94) 29.10.2026 9.6
CVE-2026-106076 27.10.2026 9
CVE-2026-108142 27.10.2026 9.1
CVE-2026-103593 Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution 29.10.2026 9.1
CVE-2026-103594 Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution 27.10.2026 9.5
CVE-2026-112709 Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution 27.10.2026 9.2
CVE-2026-112710 Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution 27.10.2026 9.2
CVE-2026-116863 WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability 29.10.2026 9.6
CVE-2026-93857 Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution 29.10.2026 9.2
CVE-2026-93865 Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection 29.10.2026 9.2
CVE-2026-93866 Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write 27.10.2026 9.2
CVE-2026-117564 nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret 28.10.2026 9.3
CVE-2026-117601 Electrum before 4.8.3 Missing Signature Verification of Mempool Transactions 28.10.2026 9.3
CVE-2026-117603 Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass 27.10.2026 9.3
CVE-2026-65145 27.10.2026 10
CVE-2026-115216 Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials 27.10.2026 9.1
CVE-2026-112362 @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets 27.10.2026 9.1
CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin 27.10.2026 9.3
CVE-2026-102788 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 27.10.2026 9.3
CVE-2026-76932 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76933 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76934 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-76935 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76936 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76937 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.4
CVE-2026-76938 Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-76939 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3 27.10.2026 9.8
CVE-2026-82116 Missing Authentication for Critical Function Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82117 Authentication Bypass by Spoofing Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82118 Stack-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82119 OS Command Injection Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82120 Heap-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.8
CVE-2026-82122 Stack-based Buffer Overflow Vulnerability in HiRDB 27.10.2026 9.4
CVE-2026-86574 Heap-based Buffer Overflow Vulnerability in JP1/Base 27.10.2026 9.8
CVE-2026-86575 Stack-based Buffer Overflow Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-86576 Heap-based Buffer Overflow Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-86577 Out-of-bounds Write Vulnerability in JP1 Products 27.10.2026 9.4
CVE-2026-102789 Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 27.10.2026 9.3
CVE-2026-92885 Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login 27.10.2026 9.8
CVE-2026-18450 Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability 27.10.2026 9.8
CVE-2026-116747 Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret 26.10.2026 9.2
CVE-2026-116508 TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow 26.10.2026 10
CVE-2026-116506 TOTOLINK A950RG firewall.so apmib_set command injection 26.10.2026 9.4
CVE-2026-116505 TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection 26.10.2026 9.4
CVE-2026-116504 TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection 27.10.2026 9.4
CVE-2026-110720 Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules 26.10.2026 9.9
CVE-2026-10757 BUG-000187511 - ArcGIS Server has a security vulnerability. 29.10.2026 9.8
CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset 26.10.2026 9.9
CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE 26.10.2026 10
CVE-2026-112346 OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE 26.10.2026 9.3
CVE-2026-65184 Avocent ACS8000 wsserver command injection 26.10.2026 9.8
CVE-2026-77055 Improper Privilege Assignment in boneIO 26.10.2026 9.3
CVE-2026-93328 Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write 26.10.2026 9.3
CVE-2026-107656 27.10.2026 9.6
CVE-2026-110475 Improper Authentication Vulnerability in CreditNirvana Collections Platform 26.10.2026 9.3
CVE-2026-115188 26.10.2026 9.9
CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney 26.10.2026 9.1
CVE-2026-116214 MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code 26.10.2026 9.3
CVE-2026-116485 danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints 26.10.2026 9.3
CVE-2026-59106 Unauthenticated RCE Vulnerability in WolfProt interface implementation 26.10.2026 9.3
CVE-2026-59107 Shared SSH Authentication Key in vSolution Matrix File Sharing 26.10.2026 9.2
CVE-2026-116237 Oray Pugongying X5 Pro Dnsmasq crlf injection 26.10.2026 9.3
CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injection 26.10.2026 9.4
CVE-2026-116233 Oray Pugongying X5 Pro Dnsmasq crlf injection 26.10.2026 9.4
CVE-2026-116234 Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection 26.10.2026 9.4
CVE-2026-116231 Oray Pugongying X5 Pro Ser2net crlf injection 26.10.2026 9.4
CVE-2026-116232 Oray Pugongying X5 Pro SNMP snmp_set crlf injection 26.10.2026 9.4
CVE-2026-116116 Yoosee GM8135S Camera Secure Boot signature verification 26.10.2026 9.3
CVE-2026-116163 Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses 26.10.2026 9.1
CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback 26.10.2026 9.2
CVE-2026-115995 Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection 29.10.2026 9.4
CVE-2026-114820 25.10.2026 9.1
CVE-2026-115557 Distrust compromised intermediate certificates in ssl module 27.10.2026 9.4
CVE-2026-115933 Forged signed tokens let any registered user take over other users and organizations 24.10.2026 9.9
CVE-2026-115932 Path traversal in post media lets any registered user read server files 24.10.2026 9.6
CVE-2026-116014 open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType 24.10.2026 9.2
CVE-2026-111402 WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability 24.10.2026 9.3
CVE-2026-112866 WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability 24.10.2026 9.3
CVE-2026-114196 WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-94075 WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-115806 Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace 29.10.2026 9.8
CVE-2026-115931 Arbitrary file read and backend crash through unrestricted provider method calls 24.10.2026 9.9
CVE-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation 26.10.2026 9.9
CVE-2026-115893 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction 23.10.2026 9.9
CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 23.10.2026 9.3
CVE-2026-46651 Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer 23.10.2026 9.8
CVE-2026-46652 Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer 23.10.2026 9.8
CVE-2026-53942 Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN 23.10.2026 9.9
CVE-2026-55486 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS 23.10.2026 9.3
CVE-2026-114357 DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) 28.10.2026 9.3
CVE-2026-53921 odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) 29.10.2026 9.8
CVE-2026-112846 WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112847 WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112848 WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112851 WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112853 WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-112854 WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112855 WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112856 WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112857 WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-112858 WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-112859 WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability 24.10.2026 9.8
CVE-2026-99078 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry 24.10.2026 9.8
CVE-2026-99079 net/mlx5e: Prevent stale XSK buffer release on refill retry 24.10.2026 9.8
CVE-2026-57116 PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation 29.10.2026 9.8
CVE-2026-98959 btrfs: fix xattr replace when multiple xattrs are packed in the same item 24.10.2026 9.8
CVE-2026-115727 AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server 27.10.2026 9.2
CVE-2026-107685 WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers 23.10.2026 9.1
CVE-2026-25784 bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop 23.10.2026 9.3
CVE-2025-30046 Remote Code Execution in CGM CLININET 28.10.2026 9
CVE-2025-30047 Remote Code Execution via Java Deserialization in CGM CLININET 28.10.2026 9.4
CVE-2025-30050 Remote Code Execution in CGM CLININET 28.10.2026 9.4
CVE-2025-30054 Local Privilege Escalation in CGM CLININET 28.10.2026 9.3
CVE-2026-112860 WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability 23.10.2026 9.3
CVE-2026-112862 WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability 23.10.2026 9.8
CVE-2026-63244 Authentication Bypass Vulnerability 23.10.2026 9.8
CVE-2026-55981 Firmware verification vulnerability 23.10.2026 9.6
CVE-2026-54630 Part-DB: Authenticated RCE via .phar attachment upload served from public/media 29.10.2026 9.6
CVE-2026-115547 Command Execution via Admin Console Input in Okta Access Gateway 23.10.2026 9.1
CVE-2026-19677 Authentication Bypass Leading to Server-Side Command Execution 23.10.2026 9.3

Latest Updates

CVE Title Updated Score
CVE-2026-90865 Command Injection via FTP Notification Variables in Progress WS_FTP Server 29.10.2026 9
CVE-2026-90866 Virtual Folder Path Confinement Bypass in Progress WS_FTP Server 29.10.2026 9.1
CVE-2026-90867 Improper Access Control of Web Admin Console in Progress WS_FTP Server 29.10.2026 8.1
CVE-2026-90868 OS Command Injection in Progress WS_FTP Server 29.10.2026 9.9
CVE-2026-90869 Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server 29.10.2026 7.5
CVE-2026-90870 Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server 29.10.2026 5.3
CVE-2026-90871 Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server 29.10.2026 5.3
CVE-2026-107040 29.10.2026
CVE-2026-107041 29.10.2026
CVE-2026-84295 Improper Authentication in Progress WS_FTP Server 29.10.2026 10
CVE-2026-84296 SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server 29.10.2026 6.8
CVE-2026-90861 Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server 29.10.2026 6.6
CVE-2026-90862 Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server 29.10.2026 4.3
CVE-2026-90863 Privilege Escalation via Missing Authorization in WS_FTP Manager 29.10.2026 9.1
CVE-2026-90864 Host Administrator Path Containment Bypass in Progress WS_FTP Server 29.10.2026 9.1
CVE-2026-107036 29.10.2026
CVE-2026-107037 29.10.2026
CVE-2026-107038 29.10.2026
CVE-2026-107039 29.10.2026
CVE-2026-111731 Infinite loop when reading PDPortDataCheck record of subslot 0 29.10.2026
CVE-2026-111732 Out-of-bounds write when parsing AR Vendor Block requests 29.10.2026
CVE-2026-111733 NULL pointer dereference on implicit read of AR specific record index 29.10.2026
CVE-2026-111734 Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv() 29.10.2026
CVE-2026-111735 Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind() 29.10.2026
CVE-2026-111736 NULL pointer dereference on implicit read of user specific record index 29.10.2026
CVE-2026-112200 Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness 29.10.2026
CVE-2026-115793 Resource exhaustion from RPC sessions kept for requests to unknown interface 29.10.2026
CVE-2026-115794 Alarm data length not validated against received frame length 29.10.2026
CVE-2026-115795 Out-of-bounds read of DCP block header in DCP Set and Identify request parsing 29.10.2026
CVE-2026-84294 Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server 29.10.2026 7.7
CVE-2026-107035 29.10.2026
CVE-2026-111730 Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length 29.10.2026
CVE-2026-112255 Endpoint credential minting (insecure default allow-list) 29.10.2026
CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list) 29.10.2026
CVE-2026-107032 29.10.2026
CVE-2026-107033 29.10.2026
CVE-2026-107034 29.10.2026
CVE-2026-118083 WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability 29.10.2026 7.5
CVE-2026-118084 WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability 29.10.2026 6.5
CVE-2026-101288 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.8
CVE-2026-102590 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 5
CVE-2026-103092 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.5
CVE-2026-104308 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 4.3
CVE-2026-104309 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-104310 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 4.3
CVE-2026-104312 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 3.5
CVE-2026-104314 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-104315 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 4.3
CVE-2026-104316 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-104317 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.1
CVE-2026-104324 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.8
CVE-2026-104328 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.8
CVE-2026-104331 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 5.4
CVE-2026-104339 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.8
CVE-2026-107029 29.10.2026
CVE-2026-107030 29.10.2026
CVE-2026-107326 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.8
CVE-2026-107327 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.9
CVE-2026-107328 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.9
CVE-2026-107329 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.9
CVE-2026-108494 WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-113576 Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 29.10.2026 6.3
CVE-2026-114148 ASP.NET Core Elevation of Privilege Vulnerability 29.10.2026 7.8
CVE-2026-116864 WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability 29.10.2026 7.2
CVE-2026-116865 WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability 29.10.2026 7.2
CVE-2026-116866 WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability 29.10.2026 8.8
CVE-2026-116867 WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability 29.10.2026 8.8
CVE-2026-116868 WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability 29.10.2026 8.8
CVE-2026-116869 WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability 29.10.2026 7.2
CVE-2026-118073 WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability 29.10.2026 8.8
CVE-2026-118074 WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability 29.10.2026 7.2
CVE-2026-118075 WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability 29.10.2026 8.8
CVE-2026-118076 WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability 29.10.2026 8.8
CVE-2026-118077 WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability 29.10.2026 7.2
CVE-2026-118078 WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability 29.10.2026 7.2
CVE-2026-118079 WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability 29.10.2026 7.2
CVE-2026-118080 WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability 29.10.2026 8.8
CVE-2026-118081 WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability 29.10.2026 8.8
CVE-2026-118082 WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability 29.10.2026 8.8
CVE-2026-118085 WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-18894 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-20942 Microsoft Edge (Chromium-based) Spoofing Vulnerability 29.10.2026 4.3
CVE-2026-27394 WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-42690 WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability 29.10.2026 5.4
CVE-2026-42692 WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-42701 WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability 29.10.2026 7.2
CVE-2026-54856 WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54857 WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54858 WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54859 WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54860 WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-54864 WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-54865 WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-54866 WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-61988 WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-61989 WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-61991 WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability 29.10.2026 10
CVE-2026-61992 WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-61993 WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-61995 WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-61996 WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability 29.10.2026 8.5
CVE-2026-61997 WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-61998 WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62001 WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62002 WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62003 WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62004 WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62005 WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62006 WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62008 WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62009 WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62010 WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62011 WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62012 WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62013 WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62014 WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62015 WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62016 WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62017 WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62018 WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-62131 WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability 29.10.2026 9.8
CVE-2026-66911 Stored Cross-Site Scripting in Zimbra 29.10.2026
CVE-2026-66912 Stored Cross-Site Scripting in Zimbra 29.10.2026
CVE-2026-77817 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-77819 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-85330 Microsoft Edge for Android Security Feature Bypass Vulnerability 29.10.2026 4.3
CVE-2026-85899 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 29.10.2026 8.1
CVE-2026-88077 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 29.10.2026 8.8
CVE-2026-88078 Microsoft Edge (Chromium-based) Spoofing Vulnerability 29.10.2026 4.3
CVE-2026-88090 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 29.10.2026 5.4
CVE-2026-90991 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-93680 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.8
CVE-2026-96187 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability 29.10.2026 7.4
CVE-2026-96192 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 29.10.2026 8.8
CVE-2026-96196 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability 29.10.2026 8.8
CVE-2026-96203 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 29.10.2026 8.8
CVE-2026-106036 Improper certificate validation in Szafir 29.10.2026
CVE-2026-107025 29.10.2026
CVE-2026-107026 29.10.2026
CVE-2026-107027 29.10.2026
CVE-2026-107028 29.10.2026
CVE-2026-109891 WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability 29.10.2026 6.4
CVE-2026-110186 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 9.8
CVE-2026-110190 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-110192 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-110193 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.8
CVE-2026-110196 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.8
CVE-2026-110200 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 6.5
CVE-2026-110244 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.8
CVE-2026-110245 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 7.5
CVE-2026-110309 Langflow OSS is affected by multiple vulnerabilities 29.10.2026 8.8
CVE-2026-116848 WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-42694 WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability 29.10.2026 4.3
CVE-2026-48200 WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability 29.10.2026 5.3
CVE-2026-85890 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 29.10.2026 8.8
CVE-2026-85897 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 29.10.2026 8.8
CVE-2026-93570 XML External Entity injection in Szafir and Szafir Weryfikująca 29.10.2026
CVE-2026-93571 Path Traversal in Szafir 29.10.2026
CVE-2026-96198 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 29.10.2026 8.8
CVE-2026-96199 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 29.10.2026 8.8
CVE-2026-107021 29.10.2026
CVE-2026-107023 29.10.2026
CVE-2026-107024 29.10.2026
CVE-2026-25448 WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability 29.10.2026 4.3
CVE-2026-107018 29.10.2026
CVE-2026-107019 29.10.2026
CVE-2026-107020 29.10.2026
CVE-2026-107014 29.10.2026
CVE-2026-107015 29.10.2026
CVE-2026-107016 29.10.2026
CVE-2026-107017 29.10.2026
CVE-2026-118097 WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-27062 WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability 29.10.2026 4.3
CVE-2026-42691 WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability 29.10.2026 5.4
CVE-2026-54852 WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-97073 WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-114706 WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-115601 WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-27063 WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-54853 WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-110881 WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-114181 WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-115605 WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability 29.10.2026 4.3
CVE-2026-116387 WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-116849 WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-116850 WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-116856 WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-118088 WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-118091 WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-118095 WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-25450 WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-39737 WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-54871 WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-115610 WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-115706 Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation 29.10.2026 6.8
CVE-2026-115707 Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation 29.10.2026 6.4
CVE-2026-115708 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass 29.10.2026 7.2
CVE-2026-115709 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss 29.10.2026 8.2
CVE-2026-115711 Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure 29.10.2026 6.4
CVE-2026-115712 Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings 29.10.2026 4.3
CVE-2026-115713 Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification 29.10.2026 7.5
CVE-2026-116406 WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability 29.10.2026 4.3
CVE-2026-116846 WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-118092 WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability 29.10.2026 4.3
CVE-2026-39742 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-48884 WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-52708 WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability 29.10.2026 4.3
CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter 29.10.2026
CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax 29.10.2026
CVE-2026-116402 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability 29.10.2026 5.3
CVE-2026-118425 Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback 29.10.2026
CVE-2026-39736 WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability 29.10.2026 8.5
CVE-2026-79589 29.10.2026
CVE-2026-116399 WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability 29.10.2026 8.8
CVE-2026-116857 WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-25467 WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability 29.10.2026 5.3
CVE-2026-39782 WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-48202 WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability 29.10.2026 5.3
CVE-2026-113696 Improper Authorization in BMC ITSM SmartIT Change Approvals 29.10.2026
CVE-2026-113697 Reflected Cross-Site Scripting in BMC Helix Operations Management 29.10.2026
CVE-2019-25781 Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing 29.10.2026
CVE-2026-113691 Stored Cross-Site Scripting in BMC ITSM Knowledge Articles 29.10.2026
CVE-2026-113692 Path Traversal in BMC ITSM 29.10.2026
CVE-2026-113693 System Account Credential Disclosure in BMC ITSM 29.10.2026
CVE-2026-113694 Improper Authorization in BMC ITSM SmartIT Attachments 29.10.2026
CVE-2026-113695 Reflected Cross-Site Scripting in BMC ITSM SmartIT 29.10.2026
CVE-2026-119048 JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module 29.10.2026
CVE-2026-119049 FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming 29.10.2026
CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection 29.10.2026
CVE-2026-119051 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys 29.10.2026
CVE-2026-119052 llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length 29.10.2026
CVE-2026-119053 lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto() 29.10.2026
CVE-2026-119054 Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url 29.10.2026
CVE-2026-42707 WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability 29.10.2026 4.3
CVE-2026-48195 WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-54862 WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-93009 Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder 29.10.2026
CVE-2026-93010 Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check 29.10.2026
CVE-2026-113688 Server-Side Request Forgery in BMC ITSM SmartIT 29.10.2026
CVE-2026-113689 Stored Cross-Site Scripting in BMC ITSM Work Notes 29.10.2026
CVE-2026-113690 Stored Cross-Site Scripting in BMC ITSM Attachments 29.10.2026
CVE-2026-118087 WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-118093 WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-118094 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-22386 WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability 29.10.2026 4.3
CVE-2026-24533 WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-39735 WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability 29.10.2026 6.5
CVE-2026-39741 WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-42703 WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability 29.10.2026 6.5
CVE-2026-48196 WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-52709 WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-56056 WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability 29.10.2026 6.5
CVE-2026-93006 Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content 29.10.2026
CVE-2026-93007 Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation 29.10.2026
CVE-2026-93011 Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms 29.10.2026
CVE-2026-49142 OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[] 29.10.2026
CVE-2026-93008 Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations 29.10.2026
CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension 29.10.2026
CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values 29.10.2026
CVE-2026-103665 29.10.2026
CVE-2026-109822 29.10.2026 6.5
CVE-2026-97854 29.10.2026 9.8
CVE-2026-97860 29.10.2026
CVE-2026-109216 Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys 29.10.2026 4.9
CVE-2026-110184 Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter 29.10.2026 7.5
CVE-2026-115821 NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters 29.10.2026 7.2
CVE-2026-119025 open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows 29.10.2026
CVE-2026-27401 WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability 29.10.2026 5.3
CVE-2026-92086 MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter 29.10.2026 5.3
CVE-2026-96767 NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header 29.10.2026 7.2
CVE-2026-5697 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application 29.10.2026
CVE-2026-5698 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application 29.10.2026
CVE-2026-5699 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application 29.10.2026
CVE-2026-5700 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application 29.10.2026
CVE-2026-5702 Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application 29.10.2026
CVE-2026-112827 WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability 29.10.2026 7.1
CVE-2026-114193 WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability 29.10.2026 7.5
CVE-2026-115592 WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-115599 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability 29.10.2026 7.5
CVE-2026-115611 WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-115962 WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability 29.10.2026 4.3
CVE-2026-115963 WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability 29.10.2026 7.1
CVE-2026-115964 WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability 29.10.2026 9.3
CVE-2026-115965 WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability 29.10.2026 8.5
CVE-2026-115967 WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability 29.10.2026 8.8
CVE-2026-116409 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability 29.10.2026 7.1
CVE-2026-118989 WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects 29.10.2026
CVE-2026-33923 Update bundle signature bypass in Guardian/CMC before 26.4.0 29.10.2026
CVE-2026-33924 Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 29.10.2026
CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login 29.10.2026
CVE-2026-71569 Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name 29.10.2026 4.8
CVE-2026-105031 Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. 29.10.2026
CVE-2026-105042 Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash 29.10.2026
CVE-2026-114230 Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames 29.10.2026
CVE-2026-115942 Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read 29.10.2026
CVE-2026-111417 Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service 29.10.2026 7.5
CVE-2026-111418 SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service 29.10.2026 7.5
CVE-2026-111419 Hardcoded API Token in Foxit Official Website 29.10.2026 8.6
CVE-2026-117611 Trust of compromised eMudhra root CA in bundled CA stores 29.10.2026
CVE-2026-103485 Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property 29.10.2026 5.4
CVE-2026-103875 Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links 29.10.2026 4.7
CVE-2026-104727 Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys 29.10.2026 6.4
CVE-2026-107627 Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block 29.10.2026 5.4
CVE-2026-107629 Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText 29.10.2026 5.4
CVE-2026-107743 Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter 29.10.2026 7.2
CVE-2026-109215 LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization 29.10.2026 6.4
CVE-2026-110707 RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element 29.10.2026 4.7
CVE-2026-111318 HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink 29.10.2026 5.4
CVE-2026-116763 LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) 29.10.2026 5.4
CVE-2026-118192 JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute 29.10.2026 6.5
CVE-2026-91152 Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter 29.10.2026 6.1
CVE-2026-91153 Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...}) 29.10.2026 5.3
CVE-2026-88941 29.10.2026 5.2
CVE-2026-7190 Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration 29.10.2026
CVE-2026-85498 Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow 29.10.2026
CVE-2026-114358 SQL Injection Vulnerability in Radius Xenia M2M Platform 29.10.2026
CVE-2026-115303 Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping 29.10.2026 3.7
CVE-2026-117174 29.10.2026
CVE-2025-62839 Hard-coded Cryptographic Key #1 29.10.2026
CVE-2025-62841 Hard-coded Cryptographic Key #2 29.10.2026
CVE-2026-117548 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service 29.10.2026
CVE-2026-117627 Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions 29.10.2026
CVE-2026-117688 Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration 29.10.2026
CVE-2026-117859 Keycloak-services: keycloak-services: par single-use bypass via flow restart 29.10.2026
CVE-2026-118030 Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins 29.10.2026
CVE-2024-3586 LetterPress < 2.4.0 - Admin+ Stored XSS 29.10.2026
CVE-2026-103693 Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection 29.10.2026
CVE-2026-105258 LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings 29.10.2026
CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields 29.10.2026
CVE-2026-108686 WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure 29.10.2026
CVE-2026-108763 Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR 29.10.2026
CVE-2026-110030 Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration 29.10.2026
CVE-2026-110504 Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass 29.10.2026
CVE-2026-110505 Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass 29.10.2026
CVE-2026-110983 WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF 29.10.2026
CVE-2026-111739 Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter 29.10.2026
CVE-2026-113616 LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset 29.10.2026
CVE-2026-113617 Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal 29.10.2026
CVE-2026-114270 GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure 29.10.2026
CVE-2026-114488 Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding 29.10.2026
CVE-2026-115245 Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload 29.10.2026
CVE-2026-115259 Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR 29.10.2026
CVE-2026-115282 Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure 29.10.2026
CVE-2026-115299 Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF 29.10.2026
CVE-2026-115300 Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF 29.10.2026
CVE-2026-115301 Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block 29.10.2026
CVE-2026-115302 Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion 29.10.2026
CVE-2026-15564 Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization 29.10.2026
CVE-2026-19610 Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean 29.10.2026
CVE-2026-78395 Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass 29.10.2026
CVE-2026-78396 Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure 29.10.2026
CVE-2026-85007 YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax 29.10.2026
CVE-2026-86794 Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form 29.10.2026
CVE-2026-88928 PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass 29.10.2026
CVE-2026-89216 vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter 29.10.2026
CVE-2026-93293 Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler 29.10.2026 6.4
CVE-2026-118905 nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed 29.10.2026
CVE-2026-109516 Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token 29.10.2026 9.8
CVE-2026-93757 Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite 29.10.2026 7.5
CVE-2026-93855 SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter 29.10.2026 7.5
CVE-2026-93904 Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter 29.10.2026 7.5
CVE-2026-96228 SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover 29.10.2026 8.1
CVE-2026-96666 Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter 29.10.2026 7.2
CVE-2026-96669 Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie 29.10.2026 7.2
CVE-2026-96741 DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption 29.10.2026 7.2
CVE-2026-40063 29.10.2026 5.3
CVE-2026-42922 29.10.2026 9.8
CVE-2026-42949 29.10.2026 5.6
CVE-2026-118426 29.10.2026
CVE-2026-113387 29.10.2026 8.6
CVE-2026-113409 29.10.2026 4.8
CVE-2026-114173 29.10.2026 5.3
CVE-2026-16889 Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin 29.10.2026
CVE-2026-66088 Unrestricted Command Execution via system.execute 29.10.2026
CVE-2026-66089 XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion 29.10.2026
CVE-2026-66090 XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read 29.10.2026
CVE-2026-66091 Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details 29.10.2026
CVE-2026-66092 Stored XSS in pre-login notice via reachable legacy logon route 29.10.2026
CVE-2026-21157 29.10.2026
CVE-2026-113957 29.10.2026
CVE-2026-118590 nipy nibabel Header volumeutils.py array_from_file memory allocation 29.10.2026
CVE-2026-118589 nschloe meshio VTK Reader _vtk_42.py memory allocation 28.10.2026
CVE-2026-118586 dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery 28.10.2026
CVE-2026-118585 configuroweb inventariobasico Add Product addlist.php cross site scripting 28.10.2026
CVE-2026-118579 D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor 28.10.2026
CVE-2026-86983 28.10.2026
CVE-2026-118578 maotoumao MusicFreeDesktop Request Forwarder information disclosure 29.10.2026