Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-106036 | 6.9 Medium | Improper certificate validation in Szafir | Oct 29, 2026 |
| CVE-2026-93571 | 2.3 Low | Path Traversal in Szafir | Oct 29, 2026 |
| CVE-2026-93570 | 8.2 High | XML External Entity injection in Szafir and Szafir Weryfikująca | Oct 29, 2026 |
| CVE-2026-42694 | 4.3 Medium | WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability | Oct 29, 2026 |
| CVE-2026-48200 | 5.3 Medium | WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability | Oct 29, 2026 |
| CVE-2026-116848 | 6.5 Medium | WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-109891 | 6.4 Medium | WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-25448 | 4.3 Medium | WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-42691 | 5.4 Medium | WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-54852 | 5.3 Medium | WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-97073 | 5.3 Medium | WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-118097 | 6.5 Medium | WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-27062 | 4.3 Medium | WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability | Oct 29, 2026 |
| CVE-2026-54853 | 5.3 Medium | WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-114706 | 6.5 Medium | WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-27063 | 5.3 Medium | WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-115601 | 5.3 Medium | WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-115605 | 4.3 Medium | WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-118095 | 6.5 Medium | WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-54871 | 5.3 Medium | WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-25450 | 5.3 Medium | WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-116850 | 6.5 Medium | WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-114181 | 5.3 Medium | WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-118088 | 5.3 Medium | WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-116849 | 6.5 Medium | WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-110881 | 6.5 Medium | WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-116856 | 5.3 Medium | WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-39737 | 6.5 Medium | WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-118091 | 5.3 Medium | WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-116387 | 5.3 Medium | WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-39742 | 6.5 Medium | WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-115610 | 6.5 Medium | WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-118092 | 4.3 Medium | WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-116406 | 4.3 Medium | WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-52708 | 4.3 Medium | WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-116846 | 5.3 Medium | WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-48884 | 5.3 Medium | WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-80069 | 5.3 Medium | MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax | Oct 29, 2026 |
| CVE-2026-80067 | 5.3 Medium | MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter | Oct 29, 2026 |
| CVE-2026-115713 | 7.5 High | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification | Oct 29, 2026 |
| CVE-2026-115712 | 4.3 Medium | Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings | Oct 29, 2026 |
| CVE-2026-115711 | 6.4 Medium | Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure | Oct 29, 2026 |
| CVE-2026-115709 | 8.2 High | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss | Oct 29, 2026 |
| CVE-2026-115708 | 7.2 High | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass | Oct 29, 2026 |
| CVE-2026-115707 | 6.4 Medium | Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation | Oct 29, 2026 |
| CVE-2026-115706 | 6.8 Medium | Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation | Oct 29, 2026 |
| CVE-2026-39736 | 8.5 High | WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability | Oct 29, 2026 |
| CVE-2026-116402 | 5.3 Medium | WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability | Oct 29, 2026 |
| CVE-2026-118425 | 6.8 Medium | Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback | Oct 29, 2026 |
| CVE-2026-48202 | 5.3 Medium | WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability | Oct 29, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.