Browse All CVEs
33,364 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-39580 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. | |
CVE-2026-39582 |
high | 8.1 | 0.0034 | 2026-10-29 | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. | |
CVE-2026-39589 |
critical | 9.9 | 0.0045 | 2026-10-29 | Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions. | |
CVE-2026-39595 |
medium | 4.7 | 0.0021 | 2026-10-29 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. | |
CVE-2026-39596 |
critical | 9.3 | 0.0037 | 2026-10-29 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | |
CVE-2026-39598 |
high | 8.0 | 0.0022 | 2026-10-29 | Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS P | |
CVE-2026-40721 |
high | 7.5 | 0.0040 | 2026-10-29 | Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. | |
CVE-2026-40722 |
medium | 5.5 | 0.0019 | 2026-10-29 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorr | |
CVE-2026-40723 |
medium | 4.3 | 0.0024 | 2026-10-29 | Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. | |
CVE-2026-40724 |
medium | 6.5 | 0.0041 | 2026-10-29 | CP Client Arbitrary File Download in Client Portal (Pro) <= 5.6.2 versions. | |
CVE-2026-40725 |
critical | 9.8 | 0.0037 | 2026-10-29 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. | |
CVE-2026-40726 |
high | 8.2 | 0.0024 | 2026-10-29 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. | |
CVE-2026-40731 |
high | 8.1 | 0.0042 | 2026-10-29 | Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions. | |
CVE-2026-40735 |
high | 8.1 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. | |
CVE-2026-40736 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. | |
CVE-2026-40739 |
high | 8.1 | 0.0032 | 2026-10-29 | Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. | |
CVE-2026-40746 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions. | |
CVE-2026-40747 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions. | |
CVE-2026-40748 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions. | |
CVE-2026-40749 |
critical | 9.9 | 0.0043 | 2026-10-29 | Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions. | |
CVE-2026-40751 |
high | 8.1 | 0.0032 | 2026-10-29 | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. | |
CVE-2026-40753 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. | |
CVE-2026-40754 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. | |
CVE-2026-40755 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. | |
CVE-2026-40758 |
high | 8.1 | 0.0032 | 2026-10-29 | Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. | |
CVE-2026-40759 |
high | 8.1 | 0.0032 | 2026-10-29 | Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. | |
CVE-2026-40760 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. | |
CVE-2026-40761 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. | |
CVE-2026-40768 |
high | 7.3 | 0.0029 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30. | |
CVE-2026-40783 |
critical | 9.9 | 0.0054 | 2026-10-29 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. | |
CVE-2026-41280 |
medium | 4.9 | 0.0044 | 2026-10-29 | Incorrect Authorization vulnerability allows users with system login privileges to delete | |
CVE-2026-41557 |
high | 7.1 | 0.0023 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions. | |
CVE-2026-42357 |
medium | 6.5 | 0.0031 | 2026-10-29 | Incorrect Authorization vulnerability allows users to access workflow instance information | |
CVE-2026-42380 |
critical | 9.8 | 0.0051 | 2026-10-29 | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. | |
CVE-2026-42385 |
high | 7.1 | 0.0023 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. | |
CVE-2026-42629 |
high | 8.8 | 0.0032 | 2026-10-29 | Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions. | |
CVE-2026-44587 |
medium | 6.1 | 0.0022 | 2026-10-29 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2. | |
CVE-2026-45436 |
medium | 6.5 | 0.0030 | 2026-10-29 | Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions. | |
CVE-2026-47340 |
medium | 6.5 | 0.0043 | 2026-10-29 | Allow authenticated users to access alert instances associated with alert groups they do n | |
CVE-2026-48055 |
critical | 10.0 | 0.0070 | 2026-10-29 | Streambert is a cross-platform Electron Desktop App to stream and download any video media | |
CVE-2026-48616 |
critical | 9.3 | 0.0033 | 2026-10-29 | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an acc | |
CVE-2026-48745 |
critical | 9.3 | 0.0032 | 2026-10-29 | Traccar Client is a GPS tracking mobile app for sending location updates to private server | |
CVE-2026-48779 |
— | — | 0.0143 | 2026-10-29 | ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up t | |
CVE-2026-48781 |
critical | 9.9 | 0.0021 | 2026-10-29 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integ | |
CVE-2026-48783 |
medium | 4.8 | 0.0017 | 2026-10-29 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauth | |
CVE-2026-48788 |
high | 8.2 | 0.0031 | 2026-10-29 | Remark42 is a self-hosted comment engine for blogs, articles, or any other place where rea | |
CVE-2026-48869 |
high | 7.1 | 0.0019 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Enfold <= 7.1.4 versions. | |
CVE-2026-48875 |
critical | 9.3 | 0.0042 | 2026-10-29 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. | |
CVE-2026-48929 |
high | 7.5 | 0.0072 | 2026-10-29 | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10 | |
CVE-2026-48967 |
high | 8.5 | 0.0033 | 2026-10-29 | Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. |