Browse All CVEs
33,493 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-49765 |
critical | 9.8 | 0.0038 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPFo | |
CVE-2026-49769 |
critical | 9.8 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | |
CVE-2026-49773 |
medium | 6.5 | 0.0017 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions | |
CVE-2026-49775 |
medium | 6.5 | 0.0019 | 2026-10-29 | Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions. | |
CVE-2026-49776 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: | |
CVE-2026-49780 |
high | 8.8 | 0.0028 | 2026-10-29 | Customer Privilege Escalation in Dokan <= 5.0.2 versions. | |
CVE-2026-49781 |
critical | 9.8 | 0.0050 | 2026-10-29 | Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. | |
CVE-2026-52692 |
high | 7.5 | 0.0024 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions. | |
CVE-2026-52693 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. | |
CVE-2026-52694 |
high | 7.5 | 0.0024 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 version | |
CVE-2026-52695 |
high | 7.5 | 0.0024 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions. | |
CVE-2026-52699 |
high | 7.5 | 0.0023 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions. | |
CVE-2026-52700 |
high | 8.5 | 0.0037 | 2026-10-29 | Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions. | |
CVE-2026-52702 |
high | 7.1 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions. | |
CVE-2026-52703 |
critical | 9.6 | 0.0044 | 2026-10-29 | Unauthenticated Path Traversal in FastDup <= 2.7.2 versions. | |
CVE-2026-9691 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, | |
CVE-2026-11832 |
critical | 9.1 | 0.0033 | 2026-10-29 | Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. | |
CVE-2026-12087 |
critical | 9.1 | 0.0057 | 2026-10-29 | Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack | |
CVE-2026-48157 |
medium | 6.1 | 0.0017 | 2026-10-29 | Slim is a PHP micro framework that enables users to write simple web applications and APIs | |
CVE-2026-48713 |
critical | 9.1 | 0.0049 | 2026-10-29 | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key stri | |
CVE-2026-48714 |
critical | 9.1 | 0.0049 | 2026-10-29 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like expres | |
CVE-2026-5064 |
high | 8.5 | 0.0011 | 2026-10-29 | Potential security vulnerabilities have been identified in the HP One Agent for certain H | |
CVE-2026-12205 |
critical | 9.1 | 0.0029 | 2026-10-29 | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to pr | |
CVE-2026-48599 |
high | 7.6 | 0.0034 | 2026-10-29 | Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows | |
CVE-2026-48853 |
critical | 9.2 | 0.0078 | 2026-10-29 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling | |
CVE-2026-48854 |
high | 8.7 | 0.0045 | 2026-10-29 | Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc all | |
CVE-2026-53430 |
high | 8.7 | 0.0043 | 2026-10-29 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-g | |
CVE-2026-12161 |
high | 8.8 | 0.0044 | 2026-10-29 | Improper input validation in the SSH Elevate Shell feature allows an authenticated user w | |
CVE-2026-12162 |
medium | 5.5 | 0.0015 | 2026-10-29 | Improper host validation in the social login autofill feature in Devolutions Remote Deskt | |
CVE-2026-7273 |
high | 8.8 | 0.0278 | 2026-10-29 | KEV | Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CG |
CVE-2026-10635 |
medium | 6.3 | 0.0016 | 2026-10-29 | On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/x | |
CVE-2026-50255 |
medium | 5.4 | 0.0009 | 2026-10-29 | Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5. | |
CVE-2026-8443 |
high | 8.8 | 0.0034 | 2026-10-29 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'styp | |
CVE-2026-8444 |
high | 8.8 | 0.0035 | 2026-10-29 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curs | |
CVE-2026-10825 |
high | 7.1 | 0.0024 | 2026-10-29 | A denial-of-service vulnerability exists in the WebSocket API due to insufficient validati | |
CVE-2026-39437 |
high | 7.1 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for Woo | |
CVE-2026-39490 |
high | 7.5 | 0.0031 | 2026-10-29 | Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. | |
CVE-2026-39574 |
critical | 9.3 | 0.0023 | 2026-10-29 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
CVE-2026-39581 |
high | 8.5 | 0.0028 | 2026-10-29 | Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions. | |
CVE-2026-40809 |
medium | 6.5 | 0.0020 | 2026-10-29 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorr | |
CVE-2026-49772 |
critical | 9.3 | 0.0194 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-49774 |
critical | 9.9 | 0.0028 | 2026-10-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD | |
CVE-2026-52711 |
high | 7.5 | 0.0022 | 2026-10-29 | Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions. | |
CVE-2026-52712 |
high | 7.6 | 0.0023 | 2026-10-29 | Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions. | |
CVE-2026-52715 |
critical | 9.3 | 0.0119 | 2026-10-29 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
CVE-2026-54190 |
medium | 6.5 | 0.0026 | 2026-10-29 | Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions. | |
CVE-2026-54197 |
medium | 6.5 | 0.0027 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions. | |
CVE-2026-54198 |
high | 7.1 | 0.0020 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions. | |
CVE-2026-8442 |
high | 8.1 | 0.0052 | 2026-10-29 | The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in | |
CVE-2026-40750 |
critical | 9.9 | 0.0027 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Onlin |