Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,187 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-63353 | 9.4 Critical | Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read… | Oct 13, 2026 |
| CVE-2026-63352 | 5.3 Medium | Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function… | Oct 13, 2026 |
| CVE-2026-63351 | 5.3 Medium | Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized… | Oct 13, 2026 |
| CVE-2026-63350 | 9.4 Critical | Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a… | Oct 13, 2026 |
| CVE-2026-59241 | 8.7 High | A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the… | Oct 13, 2026 |
| CVE-2026-44415 | 8.9 High | Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to… | Oct 13, 2026 |
| CVE-2026-44414 | 6.9 Medium | A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64… | Oct 13, 2026 |
| CVE-2026-109854 | 2.5 Low | M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding | Oct 13, 2026 |
| CVE-2026-109144 | 6.9 Medium | wbond certvalidator Certificate Path Builder resource consumption | Oct 13, 2026 |
| CVE-2026-109143 | 5.3 Medium | calcom cal.com/cal.diy Credentials delete credentials.delete privileges management | Oct 13, 2026 |
| CVE-2026-109699 | 5.4 Medium | WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability | Oct 13, 2026 |
| CVE-2026-108487 | 6.5 Medium | WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability | Oct 13, 2026 |
| CVE-2026-106598 | 5.3 Medium | WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability | Oct 13, 2026 |
| CVE-2026-109687 | 7.6 High | WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability | Oct 13, 2026 |
| CVE-2026-105881 | 6.5 Medium | WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability | Oct 13, 2026 |
| CVE-2026-109116 | 6.9 Medium | AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization | Oct 13, 2026 |
| CVE-2026-108179 | 7.6 High | WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability | Oct 13, 2026 |
| CVE-2026-108489 | 5.3 Medium | WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability | Oct 13, 2026 |
| CVE-2026-103076 | 5.4 Medium | WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability | Oct 13, 2026 |
| CVE-2026-108174 | 5.3 Medium | WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability | Oct 13, 2026 |
| CVE-2026-106597 | 5.3 Medium | WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability | Oct 13, 2026 |
| CVE-2026-109697 | 6.5 Medium | WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability | Oct 13, 2026 |
| CVE-2026-96535 | 5.1 Medium | Cross-Site Scripting in the YouMind web application | Oct 13, 2026 |
| CVE-2026-101020 | 8.5 High | An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where… | Oct 13, 2026 |
| CVE-2026-109691 | 6.5 Medium | WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability | Oct 13, 2026 |
| CVE-2026-89309 | 10.0 Critical | Missing Authentication Vulnerability in JTL-WMS | Oct 13, 2026 |
| CVE-2026-108488 | 6.5 Medium | WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability | Oct 13, 2026 |
| CVE-2026-13138 | 8.6 High | Improper Authorization in Divasoft Software's Biletiva Ticketing Platform | Oct 13, 2026 |
| CVE-2026-109696 | 5.4 Medium | WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability | Oct 13, 2026 |
| CVE-2026-108490 | 6.5 Medium | WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability | Oct 13, 2026 |
| CVE-2026-109684 | 5.3 Medium | WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability | Oct 13, 2026 |
| CVE-2026-108496 | 5.3 Medium | WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability | Oct 13, 2026 |
| CVE-2026-108493 | 5.3 Medium | WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability | Oct 13, 2026 |
| CVE-2026-108495 | 6.5 Medium | WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability | Oct 13, 2026 |
| CVE-2026-109115 | 6.9 Medium | AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection | Oct 13, 2026 |
| CVE-2026-108492 | 5.3 Medium | WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability | Oct 13, 2026 |
| CVE-2026-109114 | 6.9 Medium | AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication | Oct 13, 2026 |
| CVE-2026-109110 | 10.0 Critical | Wavlink WL-WN592AX6 wmapd system os command injection | Oct 13, 2026 |
| CVE-2026-14308 | 4.9 Medium | Insufficient Signature Validation | Oct 13, 2026 |
| CVE-2026-15399 | 4.9 Medium | Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter | Oct 13, 2026 |
| CVE-2026-102007 | 7.2 High | Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback | Oct 13, 2026 |
| CVE-2026-102562 | 7.2 High | AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter | Oct 13, 2026 |
| CVE-2026-89097 | 4.3 Medium | Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters | Oct 13, 2026 |
| CVE-2026-109109 | 10.0 Critical | Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow | Oct 13, 2026 |
| CVE-2026-109703 | 5.3 Medium | WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability | Oct 13, 2026 |
| CVE-2026-109108 | 9.4 Critical | Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection | Oct 13, 2026 |
| CVE-2026-67165 | 5.4 Medium | HCL Connections is vulnerable to cross-site scripting (XSS) | Oct 13, 2026 |
| CVE-2026-103417 | 5.5 Medium | Saved credentials can be autofilled after cross-origin navigation | Oct 13, 2026 |
| CVE-2026-103418 | 8.8 High | Universal XSS via the HTML language attribute in Translation Services | Oct 13, 2026 |
| CVE-2026-109107 | 6.9 Medium | Wavlink WL-WN592AX6 upload.cgi main null pointer dereference | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.