Browse All CVEs
50,489 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-91049 |
medium | 6.4 | 0.0021 | 2026-11-05 | The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and rest | |
CVE-2026-90967 |
medium | 4.3 | 0.0016 | 2026-11-05 | The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an in | |
CVE-2026-90966 |
medium | 4.3 | 0.0015 | 2026-11-05 | The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJA | |
CVE-2026-90965 |
medium | 5.3 | 0.0019 | 2026-11-05 | The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-sta | |
CVE-2026-90964 |
medium | 5.3 | 0.0018 | 2026-11-05 | The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of | |
CVE-2026-90963 |
medium | 5.3 | 0.0021 | 2026-11-05 | The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization | |
CVE-2026-88814 |
low | 3.7 | 0.0013 | 2026-11-05 | The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically | |
CVE-2026-87856 |
medium | 5.3 | 0.0019 | 2026-11-05 | The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membersh | |
CVE-2026-86795 |
medium | 5.3 | 0.0019 | 2026-11-05 | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce ch | |
CVE-2026-86442 |
high | 8.2 | 0.0019 | 2026-11-05 | The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the p | |
CVE-2026-85570 |
medium | 4.3 | 0.0018 | 2026-11-05 | The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz | |
CVE-2026-85351 |
medium | 5.0 | 0.0016 | 2026-11-05 | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a use | |
CVE-2026-85347 |
medium | 6.8 | 0.0024 | 2026-11-05 | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and e | |
CVE-2026-85346 |
medium | 4.3 | 0.0011 | 2026-11-05 | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform author | |
CVE-2026-19256 |
critical | 9.8 | 0.0028 | 2026-11-05 | The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number | |
CVE-2026-16304 |
high | 8.1 | 0.0020 | 2026-11-05 | The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership o | |
CVE-2026-109150 |
high | 7.1 | 0.0009 | 2026-11-05 | The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of it | |
CVE-2026-107787 |
low | 3.1 | 0.0013 | 2026-11-05 | The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a fold | |
CVE-2026-107786 |
medium | 6.8 | 0.0023 | 2026-11-05 | The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user | |
CVE-2026-107775 |
low | 2.7 | 0.0017 | 2026-11-05 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin befor | |
CVE-2026-107774 |
medium | 5.3 | 0.0018 | 2026-11-05 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin befor | |
CVE-2026-107773 |
medium | 6.5 | 0.0016 | 2026-11-05 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin befor | |
CVE-2026-105971 |
medium | 5.3 | 0.0021 | 2026-11-05 | The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restr | |
CVE-2026-105259 |
medium | 6.8 | 0.0024 | 2026-11-05 | The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it | |
CVE-2026-100144 |
critical | 9.3 | 0.0026 | 2026-11-05 | The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payme | |
CVE-2025-15702 |
high | 8.8 | 0.0028 | 2026-11-05 | The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sani | |
CVE-2025-15701 |
low | 3.5 | 0.0014 | 2026-11-05 | The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of i | |
CVE-2026-123014 |
high | 8.7 | 0.0047 | 2026-11-05 | 1 PoC | iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL ha |
CVE-2026-93389 |
high | 8.2 | 0.0023 | 2026-11-05 | The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of se | |
CVE-2026-120553 |
medium | 6.4 | 0.0025 | 2026-11-05 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Si | |
CVE-2026-120533 |
medium | 6.4 | 0.0029 | 2026-11-05 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-118193 |
high | 8.8 | 0.0040 | 2026-11-05 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable t | |
CVE-2026-116617 |
high | 8.1 | 0.0049 | 2026-11-05 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerabl | |
CVE-2026-104812 |
medium | 6.4 | 0.0024 | 2026-11-05 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via | |
CVE-2026-123012 |
high | 7.1 | 0.0034 | 2026-11-05 | In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allo | |
CVE-2026-123010 |
high | 7.2 | 0.0022 | 2026-11-05 | @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affec | |
CVE-2026-123011 |
medium | 4.2 | 0.0018 | 2026-11-05 | STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether | |
CVE-2026-122191 |
low | 2.1 | 0.0020 | 2026-11-05 | A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affect | |
CVE-2026-122236 |
low | 2.1 | 0.0036 | 2026-11-05 | A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function | |
CVE-2026-122190 |
low | 1.9 | 0.0021 | 2026-11-05 | A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted | |
CVE-2026-122189 |
low | 2.1 | 0.0024 | 2026-11-05 | A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1 | |
CVE-2026-122323 |
high | 8.7 | 0.0034 | 2026-11-05 | Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in Fet | |
CVE-2026-122322 |
high | 8.7 | 0.0040 | 2026-11-05 | Kyverno from 1.11.0 before 1.19.2 contains an unbounded decompression vulnerability in ext | |
CVE-2026-122321 |
high | 8.5 | 0.0022 | 2026-11-05 | Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages beca | |
CVE-2026-122320 |
high | 8.3 | 0.0022 | 2026-11-05 | Kyverno before 1.19.2 contains a missing authorization vulnerability that allows namespace | |
CVE-2026-122319 |
high | 8.7 | 0.0029 | 2026-11-05 | Kyverno before 1.19.2 contains a denial-of-service vulnerability in the In and NotIn opera | |
CVE-2026-122318 |
high | 7.2 | 0.0017 | 2026-11-05 | Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips | |
CVE-2026-122316 |
high | 8.4 | 0.0017 | 2026-11-05 | Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mu | |
CVE-2026-122315 |
high | 8.7 | 0.0039 | 2026-11-05 | Kyverno before 1.19.2 contains an unchecked type assertion in buildStatementMap that allow | |
CVE-2026-122314 |
high | 8.7 | 0.0030 | 2026-11-05 | Kyverno before 1.19.2 contains an unchecked type assertion in its variable-substitution en |