Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
405,519 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-87974 | 5.3 Medium | Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook | Oct 14, 2026 |
| CVE-2026-87968 | 5.3 Medium | Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration | Oct 14, 2026 |
| CVE-2026-87843 | 6.5 Medium | Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page | Oct 14, 2026 |
| CVE-2026-86799 | 8.8 High | Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission | Oct 14, 2026 |
| CVE-2026-86797 | 6.8 Medium | Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link | Oct 14, 2026 |
| CVE-2026-86787 | 7.2 High | Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive | Oct 14, 2026 |
| CVE-2026-85345 | 4.1 Medium | FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data | Oct 14, 2026 |
| CVE-2026-85000 | 5.3 Medium | EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating | Oct 14, 2026 |
| CVE-2026-108069 | 5.3 Medium | Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment() | Oct 14, 2026 |
| CVE-2026-108066 | 2.7 Low | WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR | Oct 14, 2026 |
| CVE-2026-108064 | 6.5 Medium | WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler | Oct 14, 2026 |
| CVE-2026-107594 | 10.0 Critical | File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion | Oct 14, 2026 |
| CVE-2026-107508 | 8.6 High | Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter | Oct 14, 2026 |
| CVE-2026-107320 | 5.3 Medium | GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure | Oct 14, 2026 |
| CVE-2026-107319 | 4.3 Medium | GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure | Oct 14, 2026 |
| CVE-2026-107178 | 6.8 Medium | Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter | Oct 14, 2026 |
| CVE-2026-107160 | 5.3 Medium | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message | Oct 14, 2026 |
| CVE-2026-107158 | 5.3 Medium | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route | Oct 14, 2026 |
| CVE-2026-107126 | 8.8 High | WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header | Oct 14, 2026 |
| CVE-2026-106646 | 5.9 Medium | Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers | Oct 14, 2026 |
| CVE-2026-106469 | 6.8 Medium | Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon | Oct 14, 2026 |
| CVE-2026-106166 | 5.3 Medium | NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter | Oct 14, 2026 |
| CVE-2026-106099 | 5.3 Medium | WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export | Oct 14, 2026 |
| CVE-2026-106098 | 5.3 Medium | WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update | Oct 14, 2026 |
| CVE-2026-105975 | 5.3 Medium | CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference | Oct 14, 2026 |
| CVE-2026-105969 | 5.3 Medium | CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure | Oct 14, 2026 |
| CVE-2026-105261 | 6.8 Medium | PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes | Oct 14, 2026 |
| CVE-2026-104751 | 5.3 Medium | Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion | Oct 14, 2026 |
| CVE-2026-104644 | 6.8 Medium | Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update | Oct 14, 2026 |
| CVE-2026-103307 | 8.6 High | Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook | Oct 14, 2026 |
| CVE-2026-94370 | 6.5 Medium | Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs | Oct 14, 2026 |
| CVE-2026-110459 | 8.6 High | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device. | Oct 14, 2026 |
| CVE-2026-110458 | 3.7 Low | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device. | Oct 14, 2026 |
| CVE-2026-107153 | 7.0 High | Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed. | Oct 14, 2026 |
| CVE-2026-110457 | 3.7 Low | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device. | Oct 14, 2026 |
| CVE-2026-110456 | 5.3 Medium | A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device. | Oct 14, 2026 |
| CVE-2026-110455 | 8.1 High | A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device. | Oct 14, 2026 |
| CVE-2026-110454 | 5.3 Medium | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device. | Oct 14, 2026 |
| CVE-2026-106931 | 8.5 High | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. | Oct 14, 2026 |
| CVE-2026-105429 | 8.9 High | NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution | Oct 14, 2026 |
| CVE-2026-101926 | 6.5 Medium | Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter | Oct 14, 2026 |
| CVE-2026-103369 | 6.4 Medium | Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX | Oct 14, 2026 |
| CVE-2026-101924 | 7.2 High | NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String | Oct 14, 2026 |
| CVE-2026-110453 | 4.3 Medium | Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. | Oct 14, 2026 |
| CVE-2026-110452 | 4.0 Medium | The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership. | Oct 14, 2026 |
| CVE-2026-110451 | 4.3 Medium | Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled. | Oct 14, 2026 |
| CVE-2026-110450 | 8.0 High | Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification. | Oct 14, 2026 |
| CVE-2026-110449 | 7.5 High | Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. | Oct 14, 2026 |
| CVE-2026-100153 | 7.2 High | NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field) | Oct 14, 2026 |
| CVE-2026-87855 | 9.8 Critical | JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method | Oct 14, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.