Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-111902 | 6.9 Medium | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API | Oct 17, 2026 |
| CVE-2026-111901 | 8.7 High | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination | Oct 17, 2026 |
| CVE-2026-111900 | 5.3 Medium | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php | Oct 17, 2026 |
| CVE-2026-111898 | 7.7 High | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking | Oct 17, 2026 |
| CVE-2026-111897 | 7.1 High | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints | Oct 17, 2026 |
| CVE-2026-111896 | 5.1 Medium | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass | Oct 17, 2026 |
| CVE-2026-111895 | 7.6 High | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username | Oct 17, 2026 |
| CVE-2026-111894 | 5.1 Medium | phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI | Oct 17, 2026 |
| CVE-2026-111893 | 8.5 High | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API | Oct 17, 2026 |
| CVE-2026-111892 | 6.9 Medium | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints | Oct 17, 2026 |
| CVE-2026-111891 | 7.0 High | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API | Oct 17, 2026 |
| CVE-2026-111890 | 7.0 High | phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights | Oct 17, 2026 |
| CVE-2026-111889 | 5.3 Medium | phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard | Oct 17, 2026 |
| CVE-2026-111888 | 5.1 Medium | phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API | Oct 17, 2026 |
| CVE-2026-111887 | 6.9 Medium | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint | Oct 17, 2026 |
| CVE-2026-111886 | 7.1 High | phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint | Oct 17, 2026 |
| CVE-2026-111885 | 7.0 High | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API | Oct 17, 2026 |
| CVE-2026-111884 | 8.7 High | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover | Oct 17, 2026 |
| CVE-2026-111882 | 8.6 High | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks | Oct 17, 2026 |
| CVE-2026-111881 | 7.2 High | FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard | Oct 17, 2026 |
| CVE-2026-111880 | 8.3 High | FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset | Oct 17, 2026 |
| CVE-2025-71435 | 2.3 Low | Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token | Oct 17, 2026 |
| CVE-2024-58398 | 5.3 Medium | Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter | Oct 17, 2026 |
| CVE-2026-109701 | 7.1 High | WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability | Oct 17, 2026 |
| CVE-2026-110889 | 7.5 High | WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability | Oct 17, 2026 |
| CVE-2026-110253 | 5.4 Medium | weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter | Oct 17, 2026 |
| CVE-2026-100316 | 7.2 High | European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header | Oct 17, 2026 |
| CVE-2026-109983 | 6.4 Medium | YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter | Oct 17, 2026 |
| CVE-2026-111110 | 7.2 High | Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter | Oct 17, 2026 |
| CVE-2026-110384 | 7.1 High | WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability | Oct 17, 2026 |
| CVE-2026-97314 | 6.5 Medium | ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection | Oct 17, 2026 |
| CVE-2026-81344 | 6.6 Medium | Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection | Oct 17, 2026 |
| CVE-2026-81343 | 5.3 Medium | Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission | Oct 17, 2026 |
| CVE-2026-110527 | 5.3 Medium | WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass | Oct 17, 2026 |
| CVE-2026-106470 | 5.0 Medium | WP Data Access < 5.5.88 - Subscriber+ SSRF | Oct 17, 2026 |
| CVE-2026-103376 | 5.3 Medium | PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check | Oct 17, 2026 |
| CVE-2026-104122 | 6.8 Medium | Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name | Oct 17, 2026 |
| CVE-2026-92432 | 4.3 Medium | Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter | Oct 17, 2026 |
| CVE-2026-92431 | 3.7 Low | Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration | Oct 17, 2026 |
| CVE-2026-92433 | 6.5 Medium | Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF | Oct 17, 2026 |
| CVE-2026-104246 | 5.9 Medium | Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments | Oct 17, 2026 |
| CVE-2026-91074 | 6.8 Medium | BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode Attribute | Oct 17, 2026 |
| CVE-2026-92798 | 8.1 High | User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag | Oct 17, 2026 |
| CVE-2026-103899 | 7.2 High | EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter | Oct 17, 2026 |
| CVE-2026-109989 | 6.4 Medium | Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter | Oct 17, 2026 |
| CVE-2026-107744 | 6.5 Medium | LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action | Oct 17, 2026 |
| CVE-2026-111726 | 6.4 Medium | Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute | Oct 17, 2026 |
| CVE-2026-108123 | 7.5 High | WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action | Oct 17, 2026 |
| CVE-2026-92978 | 4.3 Medium | User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() | Oct 17, 2026 |
| CVE-2026-109369 | 6.8 Medium | WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse | Oct 17, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.