Browse All CVEs
10,441 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-56026 |
medium | 6.4 | 0.0023 | 2026-10-29 | Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions. | |
CVE-2026-56046 |
medium | 6.5 | 0.0022 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions. | |
CVE-2026-56048 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and | |
CVE-2026-56066 |
medium | 5.8 | 0.0047 | 2026-10-29 | Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions. | |
CVE-2026-57316 |
medium | 6.5 | 0.0037 | 2026-10-29 | Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions. | |
CVE-2026-57318 |
medium | 6.5 | 0.0037 | 2026-10-29 | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. | |
CVE-2026-57323 |
medium | 5.8 | 0.0031 | 2026-10-29 | Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions. | |
CVE-2026-57324 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions. | |
CVE-2026-57430 |
medium | 4.3 | 0.0025 | 2026-10-29 | Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions. | |
CVE-2026-57431 |
medium | 6.5 | 0.0022 | 2026-10-29 | Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions. | |
CVE-2026-57617 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions. | |
CVE-2026-57618 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions. | |
CVE-2026-57622 |
medium | 4.3 | 0.0027 | 2026-10-29 | Subscriber Broken Access Control in WPCafe <= 3.0.14 versions. | |
CVE-2026-57627 |
medium | 4.9 | 0.0019 | 2026-10-29 | Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions. | |
CVE-2026-57630 |
medium | 5.3 | 0.0031 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.4 | |
CVE-2026-57632 |
medium | 5.4 | 0.0029 | 2026-10-29 | Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 | |
CVE-2026-57633 |
medium | 5.3 | 0.0033 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare <= 1.1.0 versi | |
CVE-2026-57634 |
medium | 4.3 | 0.0025 | 2026-10-29 | Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions. | |
CVE-2026-57635 |
medium | 6.5 | 0.0017 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe | |
CVE-2026-57637 |
medium | 4.3 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce < | |
CVE-2026-57638 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions. | |
CVE-2026-57640 |
medium | 4.3 | 0.0025 | 2026-10-29 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions. | |
CVE-2026-57641 |
medium | 6.5 | 0.0017 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions. | |
CVE-2026-57646 |
medium | 5.4 | 0.0023 | 2026-10-29 | Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions. | |
CVE-2026-57648 |
medium | 4.3 | 0.0025 | 2026-10-29 | Contributor Broken Access Control in Nelio Content <= 4.3.4 versions. | |
CVE-2026-57649 |
medium | 4.3 | 0.0027 | 2026-10-29 | Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions. | |
CVE-2026-57650 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions. | |
CVE-2026-57651 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions. | |
CVE-2026-57652 |
medium | 5.3 | 0.0031 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions | |
CVE-2026-57654 |
medium | 6.5 | 0.0030 | 2026-10-29 | Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions. | |
CVE-2026-57656 |
medium | 5.9 | 0.0024 | 2026-10-29 | Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions. | |
CVE-2026-57657 |
medium | 4.3 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions. | |
CVE-2026-57660 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions. | |
CVE-2026-57661 |
medium | 5.4 | 0.0029 | 2026-10-29 | Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions. | |
CVE-2026-57664 |
medium | 4.3 | 0.0029 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1. | |
CVE-2026-57665 |
medium | 5.3 | 0.0031 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions. | |
CVE-2026-9639 |
medium | 6.5 | 0.0055 | 2026-10-29 | Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 | |
CVE-2026-13434 |
medium | 4.9 | 0.0024 | 2026-10-29 | A flaw was found in KubeVirt's network annotation generator. When a tenant creates a Virtu | |
CVE-2026-28385 |
medium | 5.0 | 0.0028 | 2026-10-29 | In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerabi | |
CVE-2026-48529 |
medium | 6.0 | 0.0017 | 2026-10-29 | GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running i | |
CVE-2026-42890 |
medium | 4.8 | 0.0013 | 2026-10-29 | Actual is an open-source personal finance application. In the macOS desktop application ve | |
CVE-2026-43872 |
medium | 5.3 | 0.0030 | 2026-10-29 | Actual is an open-source personal finance application. Prior to version 26.5.0, several en | |
CVE-2026-54055 |
medium | 5.0 | 0.0007 | 2026-10-29 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privile | |
CVE-2026-24618 |
medium | 4.3 | 0.0018 | 2026-10-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability i | |
CVE-2026-42853 |
medium | 6.5 | 0.0054 | 2026-10-29 | ApostropheCMS is an open-source Node.js content management system. Versions of the @apostr | |
CVE-2026-45014 |
medium | 5.3 | 0.0029 | 2026-10-29 | ApostropheCMS is an open-source Node.js content management system. Versions up to and incl | |
CVE-2026-53606 |
medium | 5.4 | 0.0021 | 2026-10-29 | ApostropheCMS is an open-source Node.js content management system, and sanitize-html provi | |
CVE-2026-41155 |
medium | 5.5 | 0.0011 | 2026-10-29 | An attacker could cooperatively pass data from one secure GPU process to another secure GP | |
CVE-2026-47124 |
medium | 6.5 | 0.0034 | 2026-10-29 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M | |
CVE-2026-47268 |
medium | 6.4 | 0.0022 | 2026-10-29 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M |