Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,251 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-108817 | 5.1 Medium | agno-agi agno CodingTools coding.py agno.CodingTools.run_shell os command injection | Oct 12, 2026 |
| CVE-2026-1907 | 7.5 High | SQL Injection in Clustering Communication (Hybrid Mode) | Oct 12, 2026 |
| CVE-2026-108816 | 5.3 Medium | agno-agi agno PythonTools python.py run_python_code code injection | Oct 12, 2026 |
| CVE-2026-107423 | 4.3 Medium | WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-107869 | 4.3 Medium | WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-107863 | 5.3 Medium | WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-108168 | 6.5 Medium | WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability | Oct 12, 2026 |
| CVE-2023-25996 | 6.5 Medium | WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability | Oct 12, 2026 |
| CVE-2026-108815 | 5.1 Medium | idcCMS member_deal.php cross site scripting | Oct 12, 2026 |
| CVE-2026-108814 | 5.3 Medium | SEMCMS SEMCMS_Banner.php sql injection | Oct 12, 2026 |
| CVE-2026-107432 | 5.4 Medium | WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-103356 | 5.4 Medium | WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-107430 | 5.4 Medium | WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability | Oct 12, 2026 |
| CVE-2026-108813 | 5.3 Medium | SEMCMS SEMCMS_Download.php sql injection | Oct 12, 2026 |
| CVE-2026-107429 | 4.3 Medium | WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability | Oct 12, 2026 |
| CVE-2026-107427 | 6.5 Medium | WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability | Oct 12, 2026 |
| CVE-2026-106605 | 5.3 Medium | WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability | Oct 12, 2026 |
| CVE-2026-108812 | 6.9 Medium | SEMCMS SEMCMS_User.php user improper authorization | Oct 12, 2026 |
| CVE-2026-108811 | 5.3 Medium | WMCMS index.php information disclosure | Oct 12, 2026 |
| CVE-2026-108810 | 6.9 Medium | tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure | Oct 12, 2026 |
| CVE-2026-93582 | 9.4 Critical | Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication | Oct 12, 2026 |
| CVE-2026-93581 | 6.1 Medium | Insufficient Neutralization of Formula Elements in CSV Exports | Oct 12, 2026 |
| CVE-2026-78359 | 5.4 Medium | Duplicate Identity / Identity Shadowing across CustomerUser backends | Oct 12, 2026 |
| CVE-2026-78358 | 4.3 Medium | Cross-Site Request Forgery in Administrative Actions | Oct 12, 2026 |
| CVE-2026-78357 | 9.1 Critical | Insufficient Session Revocation for JWT Authentication | Oct 12, 2026 |
| CVE-2026-78356 | 5.3 Medium | Unauthenticated Disclosure of Agent Frontend Configuration | Oct 12, 2026 |
| CVE-2026-78355 | 8.7 High | Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory | Oct 12, 2026 |
| CVE-2026-48212 | 4.8 Medium | Stored XSS in external pages | Oct 12, 2026 |
| CVE-2026-48211 | 5.4 Medium | Cross-Site Request Forgery in Import/Export Admin console | Oct 12, 2026 |
| CVE-2026-108809 | 5.1 Medium | Eleveo Call Recording Software logout session expiration | Oct 12, 2026 |
| CVE-2026-108808 | 2.1 Low | Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings | Oct 12, 2026 |
| CVE-2026-109082 | 6.8 Medium | Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients | Oct 12, 2026 |
| CVE-2026-108807 | 6.9 Medium | krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection | Oct 12, 2026 |
| CVE-2026-108806 | 6.9 Medium | krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection | Oct 12, 2026 |
| CVE-2026-107791 | 6.5 Medium | WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment | Oct 12, 2026 |
| CVE-2025-15703 | 3.5 Low | WP Job Openings < 4.0.0 - Admin+ Stored XSS | Oct 12, 2026 |
| CVE-2026-84166 | 4.3 Medium | Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF | Oct 12, 2026 |
| CVE-2026-84167 | 4.3 Medium | Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR | Oct 12, 2026 |
| CVE-2026-98385 | 7.8 High | sched/cache: Decouple sched_cache_group from mm to fix UAF | Oct 12, 2026 |
| CVE-2026-108805 | 6.9 Medium | krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection | Oct 12, 2026 |
| CVE-2026-109080 | 7.1 High | SQL injection in Night Shift bulk license plate search allows cross-organization data access | Oct 12, 2026 |
| CVE-2026-108804 | 10.0 Critical | TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection | Oct 12, 2026 |
| CVE-2026-108803 | 5.3 Medium | y_project RuoYi Disable API add changeStatus session expiration | Oct 12, 2026 |
| CVE-2026-107203 | 5.4 Medium | Foreman: domain and subnet interface api skips host search filters | Oct 12, 2026 |
| CVE-2026-107193 | 6.5 Medium | Foreman: api filter lookup ignores a search-limited filter permission | Oct 12, 2026 |
| CVE-2026-108802 | 5.1 Medium | y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting | Oct 12, 2026 |
| CVE-2026-21139 | 7.3 High | Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device. | Oct 12, 2026 |
| CVE-2026-21138 | 6.9 Medium | Insufficient verification of data authenticity in Smart Switch prior to version 3.7.73 allows physical attackers to install arbitrary applications. | Oct 12, 2026 |
| CVE-2026-21137 | 5.1 Medium | Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege. | Oct 12, 2026 |
| CVE-2026-21136 | 6.8 Medium | Improper authorization in Smart Switch prior to version 3.7.73 allows physical attackers to invoke application restore process. | Oct 12, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.