Browse All CVEs
3,510 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-39502 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. | |
CVE-2026-39511 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. | |
CVE-2026-39512 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. | |
CVE-2026-39519 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. | |
CVE-2026-39530 |
critical | 9.3 | 0.0030 | 2026-10-29 | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. | |
CVE-2026-39583 |
critical | 9.8 | 0.0036 | 2026-10-29 | Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions. | |
CVE-2026-39591 |
critical | 9.9 | 0.0046 | 2026-10-29 | Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions. | |
CVE-2026-40771 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. | |
CVE-2026-40772 |
critical | 10.0 | 0.0036 | 2026-10-29 | Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions. | |
CVE-2026-40798 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. | |
CVE-2026-42381 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. | |
CVE-2026-42386 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. | |
CVE-2026-42639 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. | |
CVE-2026-42665 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. | |
CVE-2026-45439 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | |
CVE-2026-48836 |
critical | 10.0 | 0.0057 | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. | |
CVE-2026-48881 |
critical | 9.1 | 0.0028 | 2026-10-29 | Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. | |
CVE-2026-48886 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. | |
CVE-2026-49067 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. | |
CVE-2026-49085 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elemento | |
CVE-2026-49104 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form | |
CVE-2026-49105 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, | |
CVE-2026-49106 |
critical | 9.8 | 0.0038 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contac | |
CVE-2026-49109 |
critical | 9.8 | 0.0038 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPF | |
CVE-2026-49763 |
critical | 9.8 | 0.0038 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 ve | |
CVE-2026-49764 |
critical | 9.8 | 0.0040 | 2026-10-29 | Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions. | |
CVE-2026-49765 |
critical | 9.8 | 0.0038 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPFo | |
CVE-2026-49769 |
critical | 9.8 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | |
CVE-2026-49776 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: | |
CVE-2026-49781 |
critical | 9.8 | 0.0050 | 2026-10-29 | Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. | |
CVE-2026-52693 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. | |
CVE-2026-52703 |
critical | 9.6 | 0.0044 | 2026-10-29 | Unauthenticated Path Traversal in FastDup <= 2.7.2 versions. | |
CVE-2026-9691 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, | |
CVE-2026-11832 |
critical | 9.1 | 0.0033 | 2026-10-29 | Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. | |
CVE-2026-12087 |
critical | 9.1 | 0.0057 | 2026-10-29 | Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack | |
CVE-2026-48713 |
critical | 9.1 | 0.0051 | 2026-10-29 | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key stri | |
CVE-2026-48714 |
critical | 9.1 | 0.0051 | 2026-10-29 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like expres | |
CVE-2026-12205 |
critical | 9.1 | 0.0029 | 2026-10-29 | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to pr | |
CVE-2026-48853 |
critical | 9.2 | 0.0078 | 2026-10-29 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling | |
CVE-2026-39574 |
critical | 9.3 | 0.0023 | 2026-10-29 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
CVE-2026-49772 |
critical | 9.3 | 0.0194 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-49774 |
critical | 9.9 | 0.0028 | 2026-10-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD | |
CVE-2026-52715 |
critical | 9.3 | 0.0119 | 2026-10-29 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
CVE-2026-40750 |
critical | 9.9 | 0.0027 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Onlin | |
CVE-2026-12293 |
critical | 9.8 | 0.0030 | 2026-10-29 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox | |
CVE-2026-12304 |
critical | 9.1 | 0.0019 | 2026-10-29 | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fix | |
CVE-2026-12315 |
critical | 9.1 | 0.0025 | 2026-10-29 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox | |
CVE-2026-12316 |
critical | 9.1 | 0.0024 | 2026-10-29 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox | |
CVE-2026-53776 |
critical | 9.3 | 0.0036 | 2026-10-29 | Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers | |
CVE-2026-0126 |
critical | 9.8 | 0.0028 | 2026-10-29 | In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This c |