Browse All CVEs
50,487 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-118983 |
medium | 6.8 | 0.0024 | 2026-11-04 | The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several b | |
CVE-2026-118783 |
medium | 6.8 | 0.0024 | 2026-11-04 | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape s | |
CVE-2026-118637 |
low | 2.7 | 0.0019 | 2026-11-04 | The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visi | |
CVE-2026-118523 |
medium | 5.3 | 0.0047 | 2026-11-04 | The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review | |
CVE-2026-118422 |
high | 7.1 | 0.0018 | 2026-11-04 | The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-pat | |
CVE-2026-118407 |
medium | 5.4 | 0.0014 | 2026-11-04 | The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a | |
CVE-2026-118404 |
medium | 5.3 | 0.0021 | 2026-11-04 | The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session b | |
CVE-2026-118403 |
low | 3.7 | 0.0016 | 2026-11-04 | The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester own | |
CVE-2026-115426 |
medium | 5.5 | 0.0028 | 2026-11-04 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properl | |
CVE-2026-115262 |
medium | 4.8 | 0.0018 | 2026-11-04 | The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1. | |
CVE-2026-115257 |
medium | 5.3 | 0.0022 | 2026-11-04 | The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks | |
CVE-2026-115250 |
medium | 6.8 | 0.0029 | 2026-11-04 | The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a blo | |
CVE-2026-115243 |
medium | 6.7 | 0.0031 | 2026-11-04 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validat | |
CVE-2026-115242 |
medium | 5.5 | 0.0028 | 2026-11-04 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitiz | |
CVE-2026-115241 |
medium | 6.5 | 0.0029 | 2026-11-04 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify | |
CVE-2026-114431 |
medium | 6.4 | 0.0024 | 2026-11-04 | The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file | |
CVE-2026-112244 |
medium | 5.3 | 0.0025 | 2026-11-04 | The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1. | |
CVE-2026-112243 |
medium | 5.8 | 0.0015 | 2026-11-04 | The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1. | |
CVE-2026-111962 |
low | 3.7 | 0.0026 | 2026-11-04 | The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access | |
CVE-2026-111740 |
low | 2.7 | 0.0023 | 2026-11-04 | The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting u | |
CVE-2026-110964 |
medium | 6.5 | 0.0021 | 2026-11-04 | The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attac | |
CVE-2026-110692 |
medium | 4.1 | 0.0022 | 2026-11-04 | The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin be | |
CVE-2026-108068 |
low | 3.8 | 0.0019 | 2026-11-04 | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper | |
CVE-2026-108067 |
low | 3.8 | 0.0019 | 2026-11-04 | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verif | |
CVE-2026-108041 |
high | 7.1 | 0.0029 | 2026-11-04 | The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analyt | |
CVE-2026-106649 |
medium | 6.8 | 0.0036 | 2026-11-04 | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does | |
CVE-2026-106000 |
medium | 5.3 | 0.0028 | 2026-11-04 | The Booking Package WordPress plugin before 1.7.34 does not require payment to be complete | |
CVE-2026-105413 |
high | 7.5 | 0.0027 | 2026-11-04 | The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user | |
CVE-2026-105191 |
medium | 4.3 | 0.0027 | 2026-11-04 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before | |
CVE-2026-104719 |
medium | 6.4 | 0.0031 | 2026-11-04 | The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its | |
CVE-2026-101166 |
low | 3.7 | 0.0024 | 2026-11-04 | The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a produc | |
CVE-2026-101165 |
low | 3.7 | 0.0019 | 2026-11-04 | The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order | |
CVE-2026-54099 |
high | 8.8 | 0.0013 | 2026-11-04 | A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Conta | |
CVE-2025-11229 |
high | 7.2 | 0.0036 | 2026-11-04 | The system fails to properly enforce scope authorization when the `authorize_all_scopes` c | |
CVE-2026-77779 |
high | 7.7 | 0.0052 | 2026-11-04 | ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access C | |
CVE-2026-77690 |
high | 8.8 | 0.1558 | 2026-11-04 | ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command I | |
CVE-2026-2625 |
medium | 5.5 | 0.0009 | 2026-11-04 | A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by provid | |
CVE-2026-12366 |
high | 8.8 | 0.0016 | 2026-11-04 | Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c | |
CVE-2026-12365 |
medium | 5.8 | 0.0013 | 2026-11-04 | A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the | |
CVE-2026-11753 |
medium | 5.1 | 0.0034 | 2026-11-04 | A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attack | |
CVE-2026-11749 |
high | 7.6 | 0.0027 | 2026-11-04 | A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertio | |
CVE-2026-77684 |
medium | 5.7 | 0.0029 | 2026-11-04 | The Bluetooth Classic Hands-Free Profile HF role in subsys/bluetooth/host/classic/hfp_hf.c | |
CVE-2026-19595 |
medium | 6.1 | 0.0014 | 2026-11-04 | The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_sy | |
CVE-2026-76788 |
high | 8.8 | 0.0025 | 2026-11-04 | The OSDP Control Panel reply parser cp_decode_response() in subsys/mgmt/osdp/src/osdp_cp.c | |
CVE-2026-76787 |
medium | 5.9 | 0.0036 | 2026-11-04 | The UpdateHub firmware-over-the-air client parses the CoAP probe response with Zephyr's JS | |
CVE-2026-75085 |
medium | 4.2 | 0.0021 | 2026-11-04 | The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c computed the | |
CVE-2026-75084 |
medium | 6.8 | 0.0029 | 2026-11-04 | The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the first byte of | |
CVE-2026-75083 |
medium | 5.9 | 0.0023 | 2026-11-04 | The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ieee802154/i | |
CVE-2026-19940 |
medium | 6.5 | 0.0019 | 2026-11-04 | The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/ | |
CVE-2026-19939 |
medium | 6.3 | 0.0018 | 2026-11-04 | The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_c |