Browse All CVEs
34,152 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57274 |
high | 8.3 | 0.0040 | 2026-10-29 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS | |
CVE-2026-57275 |
high | 8.3 | 0.0040 | 2026-10-29 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS | |
CVE-2026-57276 |
high | 8.3 | 0.0040 | 2026-10-29 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS | |
CVE-2026-57277 |
high | 8.3 | 0.0040 | 2026-10-29 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS | |
CVE-2026-57278 |
high | 8.3 | 0.0040 | 2026-10-29 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS | |
CVE-2026-11592 |
medium | 4.3 | 0.0049 | 2026-10-29 | The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plu | |
CVE-2026-5821 |
high | 8.1 | 0.0076 | 2026-10-29 | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versi | |
CVE-2026-33592 |
high | 7.5 | 0.0052 | 2026-10-29 | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery | |
CVE-2026-8147 |
high | 8.1 | 0.0055 | 2026-10-29 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace AP | |
CVE-2026-9563 |
high | 7.5 | 0.0035 | 2026-10-29 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser | |
CVE-2026-13369 |
high | 7.5 | 0.0060 | 2026-10-29 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read v | |
CVE-2026-14336 |
high | 8.2 | 0.0032 | 2026-10-29 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.sta | |
CVE-2026-8441 |
high | 7.5 | 0.0046 | 2026-10-29 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'noti | |
CVE-2026-8482 |
medium | 4.3 | 0.0023 | 2026-10-29 | A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), | |
CVE-2026-54430 |
medium | 5.1 | 0.0017 | 2026-10-29 | liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve | |
CVE-2026-54431 |
medium | 5.1 | 0.0018 | 2026-10-29 | In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose J | |
CVE-2026-11946 |
high | 7.5 | 0.0052 | 2026-10-29 | An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discover | |
CVE-2026-27060 |
high | 8.8 | 0.0052 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium all | |
CVE-2026-27402 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 | |
CVE-2026-27404 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions. | |
CVE-2026-27408 |
high | 7.1 | 0.0025 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-27412 |
high | 8.1 | 0.0047 | 2026-10-29 | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. | |
CVE-2026-27414 |
high | 8.8 | 0.0052 | 2026-10-29 | Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions. | |
CVE-2026-27419 |
critical | 9.9 | 0.0048 | 2026-10-29 | Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions. | |
CVE-2026-27425 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions. | |
CVE-2026-27426 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 | |
CVE-2026-27430 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions. | |
CVE-2026-27433 |
medium | 6.5 | 0.0033 | 2026-10-29 | Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Inco | |
CVE-2026-27436 |
critical | 9.1 | 0.0066 | 2026-10-29 | Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 version | |
CVE-2026-39448 |
high | 7.5 | 0.0035 | 2026-10-29 | Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions. | |
CVE-2026-42382 |
high | 8.1 | 0.0047 | 2026-10-29 | Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. | |
CVE-2026-49779 |
medium | 6.5 | 0.0044 | 2026-10-29 | Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path | |
CVE-2026-56037 |
high | 8.8 | 0.0052 | 2026-10-29 | Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Inj | |
CVE-2026-57342 |
medium | 6.5 | 0.0022 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions. | |
CVE-2026-57343 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. | |
CVE-2026-57344 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions. | |
CVE-2026-57345 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions. | |
CVE-2026-57347 |
medium | 6.5 | 0.0037 | 2026-10-29 | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. | |
CVE-2026-57348 |
high | 7.2 | 0.0027 | 2026-10-29 | Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 v | |
CVE-2026-57349 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 version | |
CVE-2026-57350 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions. | |
CVE-2026-57351 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions. | |
CVE-2026-57352 |
medium | 4.8 | 0.0026 | 2026-10-29 | Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress | |
CVE-2026-57353 |
medium | 6.5 | 0.0030 | 2026-10-29 | Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. | |
CVE-2026-57354 |
medium | 6.5 | 0.0022 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions. | |
CVE-2026-57355 |
medium | 6.5 | 0.0030 | 2026-10-29 | Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions. | |
CVE-2026-57356 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions. | |
CVE-2026-57357 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions. | |
CVE-2026-57358 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3. | |
CVE-2026-57360 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions. |