Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,116 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-112016 | 6.9 Medium | Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files | Oct 18, 2026 |
| CVE-2026-112015 | 7.7 High | Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwd | Oct 18, 2026 |
| CVE-2026-112014 | 6.8 Medium | LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export | Oct 18, 2026 |
| CVE-2026-112013 | 6.8 Medium | libtta through 2.3 Divide by Zero via tta_decoder_init_get_info | Oct 18, 2026 |
| CVE-2026-112012 | 4.8 Medium | libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel Count | Oct 18, 2026 |
| CVE-2026-112011 | 5.8 Medium | libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table | Oct 18, 2026 |
| CVE-2026-112010 | 6.8 Medium | smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cpp | Oct 18, 2026 |
| CVE-2026-112009 | 6.8 Medium | smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffer | Oct 18, 2026 |
| CVE-2026-112008 | 6.9 Medium | libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordr | Oct 18, 2026 |
| CVE-2026-112007 | 6.9 Medium | Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loader | Oct 18, 2026 |
| CVE-2026-112006 | 8.3 High | OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation | Oct 18, 2026 |
| CVE-2026-112005 | 9.2 Critical | WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor | Oct 18, 2026 |
| CVE-2026-112004 | 2.3 Low | Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint | Oct 18, 2026 |
| CVE-2026-112003 | 6.0 Medium | ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete | Oct 18, 2026 |
| CVE-2026-112002 | 7.6 High | ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password | Oct 18, 2026 |
| CVE-2026-112001 | 8.6 High | ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities | Oct 18, 2026 |
| CVE-2026-112000 | 7.2 High | Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs | Oct 18, 2026 |
| CVE-2026-111999 | 8.7 High | Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receiver | Oct 18, 2026 |
| CVE-2026-111998 | 9.3 Critical | Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway | Oct 18, 2026 |
| CVE-2026-78497 | 8.4 High | JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval | Oct 18, 2026 |
| CVE-2026-110895 | 8.5 High | WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability | Oct 18, 2026 |
| CVE-2026-107436 | 8.8 High | WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability | Oct 18, 2026 |
| CVE-2026-110373 | 8.1 High | WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability | Oct 18, 2026 |
| CVE-2026-110880 | 6.5 Medium | WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability | Oct 18, 2026 |
| CVE-2026-110886 | 9.8 Critical | WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability | Oct 18, 2026 |
| CVE-2026-109895 | 7.1 High | WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability | Oct 18, 2026 |
| CVE-2026-109894 | 9.3 Critical | WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability | Oct 18, 2026 |
| CVE-2026-110883 | 6.5 Medium | WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability | Oct 18, 2026 |
| CVE-2026-110383 | 7.5 High | WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability | Oct 18, 2026 |
| CVE-2026-110897 | 7.1 High | WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability | Oct 18, 2026 |
| CVE-2026-110372 | 9.8 Critical | WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability | Oct 18, 2026 |
| CVE-2026-110382 | 7.1 High | WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability | Oct 18, 2026 |
| CVE-2026-108485 | 7.1 High | WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability | Oct 18, 2026 |
| CVE-2026-110885 | 6.5 Medium | WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability | Oct 18, 2026 |
| CVE-2026-110365 | 6.5 Medium | WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability | Oct 18, 2026 |
| CVE-2026-111942 | 5.3 Medium | hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting | Oct 18, 2026 |
| CVE-2026-96534 | 7.7 High | Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export | Oct 18, 2026 |
| CVE-2026-111041 | 4.9 Medium | AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media | Oct 18, 2026 |
| CVE-2026-110981 | 7.1 High | WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter | Oct 18, 2026 |
| CVE-2026-110976 | 4.9 Medium | AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media | Oct 18, 2026 |
| CVE-2026-110070 | 6.5 Medium | Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR | Oct 18, 2026 |
| CVE-2026-110069 | 4.3 Medium | Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions | Oct 18, 2026 |
| CVE-2026-110035 | 4.3 Medium | Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route | Oct 18, 2026 |
| CVE-2026-110033 | 6.8 Medium | Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url' | Oct 18, 2026 |
| CVE-2026-110032 | 5.5 Medium | Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor | Oct 18, 2026 |
| CVE-2026-110031 | 7.2 High | Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key | Oct 18, 2026 |
| CVE-2026-110026 | 4.9 Medium | Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion | Oct 18, 2026 |
| CVE-2026-109937 | 5.4 Medium | Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block | Oct 18, 2026 |
| CVE-2026-87844 | 5.3 Medium | Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection | Oct 18, 2026 |
| CVE-2026-111877 | 5.3 Medium | dext34-morgan Books4Cash search.php cross site scripting | Oct 18, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.