Browse All CVEs
33,349 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-49778 |
high | 7.1 | 0.0019 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. | |
CVE-2026-50203 |
critical | 9.1 | 0.0063 | 2026-10-29 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(opera | |
CVE-2026-52696 |
high | 7.5 | 0.0024 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. | |
CVE-2026-52698 |
high | 7.4 | 0.0021 | 2026-10-29 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Autom | |
CVE-2026-52705 |
critical | 9.0 | 0.0029 | 2026-10-29 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 vers | |
CVE-2026-52706 |
critical | 9.8 | 0.0047 | 2026-10-29 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | |
CVE-2026-53876 |
high | 8.6 | 0.0179 | 2026-10-29 | RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, | |
CVE-2026-54184 |
high | 8.2 | 0.0025 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. | |
CVE-2026-54185 |
high | 8.5 | 0.0033 | 2026-10-29 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. | |
CVE-2026-54186 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. | |
CVE-2026-54187 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. | |
CVE-2026-54188 |
high | 7.1 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | |
CVE-2026-54189 |
high | 7.1 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | |
CVE-2026-54192 |
high | 7.1 | 0.0022 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. | |
CVE-2026-54194 |
critical | 9.8 | 0.0037 | 2026-10-29 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | |
CVE-2026-54195 |
high | 7.1 | 0.0020 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. | |
CVE-2026-54196 |
medium | 6.8 | 0.0024 | 2026-10-29 | Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privileg | |
CVE-2026-54802 |
high | 7.5 | 0.0037 | 2026-10-29 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. | |
CVE-2026-54803 |
critical | 9.8 | 0.0045 | 2026-10-29 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. | |
CVE-2026-54804 |
high | 7.6 | 0.0027 | 2026-10-29 | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. | |
CVE-2026-54805 |
high | 8.8 | 0.0038 | 2026-10-29 | Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. | |
CVE-2026-54806 |
critical | 9.8 | 0.0070 | 2026-10-29 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | |
CVE-2026-54807 |
critical | 9.8 | 0.0034 | 2026-10-29 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 version | |
CVE-2026-54811 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. | |
CVE-2026-9690 |
high | 7.5 | 0.0033 | 2026-10-29 | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions. | |
CVE-2026-10641 |
high | 7.1 | 0.0028 | 2026-10-29 | Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetoo | |
CVE-2026-39442 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions. | |
CVE-2026-39445 |
high | 8.1 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions. | |
CVE-2026-39523 |
high | 8.1 | 0.0034 | 2026-10-29 | Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions. | |
CVE-2026-39556 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in Konsept <= 1.9 versions. | |
CVE-2026-39559 |
high | 8.1 | 0.0034 | 2026-10-29 | Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions. | |
CVE-2026-39560 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. | |
CVE-2026-39576 |
high | 8.1 | 0.0040 | 2026-10-29 | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. | |
CVE-2026-39590 |
high | 8.1 | 0.0034 | 2026-10-29 | Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions. | |
CVE-2026-40720 |
high | 7.1 | 0.0018 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Royal Elementor Addons Pro < 1.7.1041 versio | |
CVE-2026-40733 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions. | |
CVE-2026-40738 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions. | |
CVE-2026-40752 |
high | 8.1 | 0.0031 | 2026-10-29 | Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions. | |
CVE-2026-40756 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. | |
CVE-2026-40757 |
high | 8.1 | 0.0025 | 2026-10-29 | Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. | |
CVE-2026-49108 |
critical | 9.8 | 0.0030 | 2026-10-29 | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. | |
CVE-2026-49268 |
high | 8.8 | 0.0051 | 2026-10-29 | A remote attacker can inject LDAP special characters into the Distinguished Name (DN) cons | |
CVE-2026-52707 |
high | 8.1 | 0.0049 | 2026-10-29 | Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. | |
CVE-2026-52716 |
medium | 6.5 | 0.0034 | 2026-10-29 | Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions. | |
CVE-2026-54193 |
high | 7.7 | 0.0033 | 2026-10-29 | Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions. | |
CVE-2026-54417 |
high | 8.7 | 0.0042 | 2026-10-29 | An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allo | |
CVE-2026-54808 |
critical | 9.3 | 0.0031 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-54809 |
critical | 9.3 | 0.0023 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-54813 |
high | 8.5 | 0.0021 | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-54814 |
high | 8.1 | 0.0033 | 2026-10-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote Fil |