Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
405,519 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-88829 | 7.2 High | Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy | Oct 14, 2026 |
| CVE-2026-90954 | 7.8 High | Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush | Oct 14, 2026 |
| CVE-2026-86476 | 8.4 High | Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize | Oct 14, 2026 |
| CVE-2026-73794 | 4.6 Medium | HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation | Oct 14, 2026 |
| CVE-2026-73793 | 7.9 High | HPE NonStop Middleware - Secret key handling vulnerability | Oct 14, 2026 |
| CVE-2026-73792 | 3.8 Low | HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability | Oct 14, 2026 |
| CVE-2026-73791 | 2.0 Low | HPE NonStop Hpjmeter - Buffer overflow vulnerability | Oct 14, 2026 |
| CVE-2026-73790 | 8.2 High | HPE NonStop iTP WebServer - Memory corruption vulnerability | Oct 14, 2026 |
| CVE-2026-14851 | 9.2 Critical | Unauthorised disclosure of information on Copart’s online billing service | Oct 14, 2026 |
| CVE-2026-103671 | 5.3 Medium | External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's… | Oct 14, 2026 |
| CVE-2026-107428 | 7.1 High | WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability | Oct 14, 2026 |
| CVE-2026-92392 | 8.1 High | HTTP/2 upload Use-After-Free | Oct 14, 2026 |
| CVE-2026-107757 | 4.9 Medium | Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body | Oct 14, 2026 |
| CVE-2026-104909 | 8.1 High | Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter | Oct 14, 2026 |
| CVE-2026-104764 | 7.2 High | Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter | Oct 14, 2026 |
| CVE-2026-104748 | 9.8 Critical | SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register | Oct 14, 2026 |
| CVE-2026-107650 | 6.4 Medium | GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title | Oct 14, 2026 |
| CVE-2026-103907 | 6.5 Medium | Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action | Oct 14, 2026 |
| CVE-2026-107631 | 7.2 High | Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter | Oct 14, 2026 |
| CVE-2026-107751 | 7.2 High | Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter | Oct 14, 2026 |
| CVE-2026-107756 | 6.4 Medium | Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name | Oct 14, 2026 |
| CVE-2026-104761 | 6.4 Medium | Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter | Oct 14, 2026 |
| CVE-2026-110284 | 7.5 High | LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes | Oct 14, 2026 |
| CVE-2026-103367 | 8.1 High | ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter | Oct 14, 2026 |
| CVE-2025-9373 | 6.4 Medium | PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | Oct 14, 2026 |
| CVE-2026-103380 | 4.3 Medium | Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion | Oct 14, 2026 |
| CVE-2026-103366 | 7.5 High | Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters | Oct 14, 2026 |
| CVE-2026-100163 | 7.4 High | Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback | Oct 14, 2026 |
| CVE-2026-107754 | 6.4 Medium | GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title | Oct 14, 2026 |
| CVE-2026-105107 | 7.2 High | Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters | Oct 14, 2026 |
| CVE-2026-105106 | 8.8 High | Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task | Oct 14, 2026 |
| CVE-2026-110227 | 5.3 Medium | WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability | Oct 14, 2026 |
| CVE-2026-109901 | 8.5 High | WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability | Oct 14, 2026 |
| CVE-2026-107171 | 6.9 Medium | An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users. | Oct 14, 2026 |
| CVE-2026-89310 | 9.4 Critical | SQL Command Injection Vulnerability in JTL-WMS | Oct 14, 2026 |
| CVE-2026-110467 | 5.3 Medium | WisdomGarden｜Tronclass - Insecure Direct Object Reference | Oct 14, 2026 |
| CVE-2026-110466 | 5.3 Medium | WisdomGarden｜Tronclass - Sensitive Data Exposure | Oct 14, 2026 |
| CVE-2026-110465 | 5.3 Medium | WisdomGarden｜Tronclass - Insecure Direct Object Reference | Oct 14, 2026 |
| CVE-2026-96904 | 5.3 Medium | AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page | Oct 14, 2026 |
| CVE-2026-96900 | 5.3 Medium | Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR | Oct 14, 2026 |
| CVE-2026-94360 | 5.3 Medium | Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks | Oct 14, 2026 |
| CVE-2026-94261 | 5.3 Medium | Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id | Oct 14, 2026 |
| CVE-2026-94260 | 5.3 Medium | Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure | Oct 14, 2026 |
| CVE-2026-94254 | 5.3 Medium | SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter | Oct 14, 2026 |
| CVE-2026-92426 | 4.9 Medium | YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion | Oct 14, 2026 |
| CVE-2026-92409 | 6.8 Medium | Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode | Oct 14, 2026 |
| CVE-2026-91076 | 5.3 Medium | Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed | Oct 14, 2026 |
| CVE-2026-90989 | 4.3 Medium | Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints | Oct 14, 2026 |
| CVE-2026-89288 | 8.6 High | Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter | Oct 14, 2026 |
| CVE-2026-88927 | 4.3 Medium | rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR | Oct 14, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.