Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-7190 | 5.1 Medium | Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration | Oct 29, 2026 |
| CVE-2026-114358 | 9.3 Critical | SQL Injection Vulnerability in Radius Xenia M2M Platform | Oct 29, 2026 |
| CVE-2026-115303 | 3.7 Low | Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping | Oct 29, 2026 |
| CVE-2025-62841 | 8.7 High | Hard-coded Cryptographic Key #2 | Oct 29, 2026 |
| CVE-2025-62839 | 8.7 High | Hard-coded Cryptographic Key #1 | Oct 29, 2026 |
| CVE-2026-118030 | 4.2 Medium | Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins | Oct 29, 2026 |
| CVE-2026-117859 | 5.4 Medium | Keycloak-services: keycloak-services: par single-use bypass via flow restart | Oct 29, 2026 |
| CVE-2026-117688 | 5.3 Medium | Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration | Oct 29, 2026 |
| CVE-2026-117548 | 6.5 Medium | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service | Oct 29, 2026 |
| CVE-2026-117627 | 5.4 Medium | Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions | Oct 29, 2026 |
| CVE-2026-114488 | 7.4 High | Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding | Oct 29, 2026 |
| CVE-2026-19610 | 6.5 Medium | Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean | Oct 29, 2026 |
| CVE-2026-15564 | 7.4 High | Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization | Oct 29, 2026 |
| CVE-2026-86794 | 8.8 High | Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form | Oct 29, 2026 |
| CVE-2026-85007 | 3.8 Low | YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax | Oct 29, 2026 |
| CVE-2026-115259 | 4.9 Medium | Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR | Oct 29, 2026 |
| CVE-2026-115245 | 9.8 Critical | Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload | Oct 29, 2026 |
| CVE-2026-114270 | 5.3 Medium | GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure | Oct 29, 2026 |
| CVE-2026-113617 | 9.9 Critical | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal | Oct 29, 2026 |
| CVE-2026-113616 | 9.8 Critical | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset | Oct 29, 2026 |
| CVE-2026-111739 | 7.5 High | Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter | Oct 29, 2026 |
| CVE-2026-110983 | 4.3 Medium | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF | Oct 29, 2026 |
| CVE-2026-110505 | 6.8 Medium | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass | Oct 29, 2026 |
| CVE-2026-110504 | 6.8 Medium | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass | Oct 29, 2026 |
| CVE-2026-110030 | 5.3 Medium | Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration | Oct 29, 2026 |
| CVE-2026-108763 | 4.3 Medium | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR | Oct 29, 2026 |
| CVE-2026-108686 | 3.7 Low | WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure | Oct 29, 2026 |
| CVE-2026-108685 | 3.7 Low | WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields | Oct 29, 2026 |
| CVE-2026-105258 | 3.5 Low | LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings | Oct 29, 2026 |
| CVE-2026-103693 | 9.0 Critical | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection | Oct 29, 2026 |
| CVE-2024-3586 | 3.5 Low | LetterPress < 2.4.0 - Admin+ Stored XSS | Oct 29, 2026 |
| CVE-2026-89216 | 8.6 High | vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter | Oct 29, 2026 |
| CVE-2026-88928 | 6.5 Medium | PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass | Oct 29, 2026 |
| CVE-2026-78396 | 5.3 Medium | Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure | Oct 29, 2026 |
| CVE-2026-78395 | 5.3 Medium | Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass | Oct 29, 2026 |
| CVE-2026-115302 | 5.3 Medium | Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion | Oct 29, 2026 |
| CVE-2026-115301 | 7.2 High | Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block | Oct 29, 2026 |
| CVE-2026-115300 | 4.3 Medium | Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF | Oct 29, 2026 |
| CVE-2026-115299 | 5.4 Medium | Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF | Oct 29, 2026 |
| CVE-2026-115282 | 5.3 Medium | Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure | Oct 29, 2026 |
| CVE-2026-93293 | 6.4 Medium | Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler | Oct 29, 2026 |
| CVE-2026-118905 | 7.1 High | nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed | Oct 29, 2026 |
| CVE-2026-93757 | 7.5 High | Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite | Oct 29, 2026 |
| CVE-2026-96228 | 8.1 High | SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover | Oct 29, 2026 |
| CVE-2026-96666 | 7.2 High | Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter | Oct 29, 2026 |
| CVE-2026-93904 | 7.5 High | Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter | Oct 29, 2026 |
| CVE-2026-93855 | 7.5 High | SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter | Oct 29, 2026 |
| CVE-2026-96669 | 7.2 High | Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie | Oct 29, 2026 |
| CVE-2026-96741 | 7.2 High | DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption | Oct 29, 2026 |
| CVE-2026-109516 | 9.8 Critical | Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token | Oct 29, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.