Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-115821 | 7.2 High | NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters | Oct 29, 2026 |
| CVE-2026-110184 | 7.5 High | Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter | Oct 29, 2026 |
| CVE-2026-92086 | 5.3 Medium | MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter | Oct 29, 2026 |
| CVE-2026-109216 | 4.9 Medium | Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys | Oct 29, 2026 |
| CVE-2026-96767 | 7.2 High | NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header | Oct 29, 2026 |
| CVE-2026-119025 | 7.7 High | open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows | Oct 29, 2026 |
| CVE-2026-5702 | 4.8 Medium | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application | Oct 29, 2026 |
| CVE-2026-5700 | 4.8 Medium | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application | Oct 29, 2026 |
| CVE-2026-5699 | 4.8 Medium | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application | Oct 29, 2026 |
| CVE-2026-5698 | 4.8 Medium | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application | Oct 29, 2026 |
| CVE-2026-5697 | 4.8 Medium | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application | Oct 29, 2026 |
| CVE-2026-115611 | 7.1 High | WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-115964 | 9.3 Critical | WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability | Oct 29, 2026 |
| CVE-2026-115962 | 4.3 Medium | WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability | Oct 29, 2026 |
| CVE-2026-115592 | 7.1 High | WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-116409 | 7.1 High | WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability | Oct 29, 2026 |
| CVE-2026-112827 | 7.1 High | WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-114193 | 7.5 High | WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-115599 | 7.5 High | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-115965 | 8.5 High | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability | Oct 29, 2026 |
| CVE-2026-115967 | 8.8 High | WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability | Oct 29, 2026 |
| CVE-2026-115963 | 7.1 High | WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability | Oct 29, 2026 |
| CVE-2026-118989 | 5.1 Medium | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects | Oct 29, 2026 |
| CVE-2026-33924 | 7.5 High | Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 | Oct 29, 2026 |
| CVE-2026-33923 | 7.5 High | Update bundle signature bypass in Guardian/CMC before 26.4.0 | Oct 29, 2026 |
| CVE-2026-118984 | 7.0 High | OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login | Oct 29, 2026 |
| CVE-2026-71569 | 4.8 Medium | Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name | Oct 29, 2026 |
| CVE-2026-115942 | Not scored | Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read | Oct 29, 2026 |
| CVE-2026-114230 | Not scored | Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames | Oct 29, 2026 |
| CVE-2026-105042 | Not scored | Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash | Oct 29, 2026 |
| CVE-2026-105031 | Not scored | Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. | Oct 29, 2026 |
| CVE-2026-111417 | 7.5 High | Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service | Oct 29, 2026 |
| CVE-2026-111418 | 7.5 High | SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service | Oct 29, 2026 |
| CVE-2026-111419 | 8.6 High | Hardcoded API Token in Foxit Official Website | Oct 29, 2026 |
| CVE-2026-117611 | 7.1 High | Trust of compromised eMudhra root CA in bundled CA stores | Oct 29, 2026 |
| CVE-2026-111318 | 5.4 Medium | HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink | Oct 29, 2026 |
| CVE-2026-107743 | 7.2 High | Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter | Oct 29, 2026 |
| CVE-2026-91153 | 5.3 Medium | Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...}) | Oct 29, 2026 |
| CVE-2026-116763 | 5.4 Medium | LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) | Oct 29, 2026 |
| CVE-2026-104727 | 6.4 Medium | Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys | Oct 29, 2026 |
| CVE-2026-109215 | 6.4 Medium | LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization | Oct 29, 2026 |
| CVE-2026-91152 | 6.1 Medium | Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter | Oct 29, 2026 |
| CVE-2026-107627 | 5.4 Medium | Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block | Oct 29, 2026 |
| CVE-2026-107629 | 5.4 Medium | Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText | Oct 29, 2026 |
| CVE-2026-110707 | 4.7 Medium | RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element | Oct 29, 2026 |
| CVE-2026-103875 | 4.7 Medium | Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links | Oct 29, 2026 |
| CVE-2026-118192 | 6.5 Medium | JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute | Oct 29, 2026 |
| CVE-2026-103485 | 5.4 Medium | Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property | Oct 29, 2026 |
| CVE-2026-88941 | 6.2 Medium | Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of Kaspersky Security Center to malfunction. There are no evidence… | Oct 29, 2026 |
| CVE-2026-85498 | 3.5 Low | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow | Oct 29, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.