Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
405,519 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-97471 | 5.3 Medium | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token | Oct 14, 2026 |
| CVE-2026-97398 | 7.2 High | FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute | Oct 14, 2026 |
| CVE-2026-95808 | 7.5 High | Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter | Oct 14, 2026 |
| CVE-2026-100185 | 6.4 Medium | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field | Oct 14, 2026 |
| CVE-2026-83592 | 7.2 High | Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values | Oct 14, 2026 |
| CVE-2026-95816 | 7.2 High | Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter | Oct 14, 2026 |
| CVE-2026-78193 | 7.5 High | JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection | Oct 14, 2026 |
| CVE-2026-94377 | 7.2 High | Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire) | Oct 14, 2026 |
| CVE-2026-97020 | 6.4 Medium | PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter | Oct 14, 2026 |
| CVE-2026-93885 | 7.2 High | Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter | Oct 14, 2026 |
| CVE-2026-77114 | 7.2 High | Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting | Oct 14, 2026 |
| CVE-2026-16495 | 6.4 Medium | Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute | Oct 14, 2026 |
| CVE-2026-100193 | 4.7 Medium | Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter | Oct 14, 2026 |
| CVE-2026-95807 | 6.4 Medium | FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute | Oct 14, 2026 |
| CVE-2026-104800 | 9.8 Critical | AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php | Oct 14, 2026 |
| CVE-2026-96661 | 7.5 High | Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter | Oct 14, 2026 |
| CVE-2026-110445 | 8.6 High | TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection | Oct 14, 2026 |
| CVE-2026-110444 | 8.6 High | TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection | Oct 14, 2026 |
| CVE-2026-14765 | 7.7 High | Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL | Oct 14, 2026 |
| CVE-2026-110447 | 9.2 Critical | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS… | Oct 14, 2026 |
| CVE-2026-103422 | 7.2 High | AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter | Oct 14, 2026 |
| CVE-2026-97657 | 9.8 Critical | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter | Oct 14, 2026 |
| CVE-2026-102251 | 7.5 High | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter | Oct 14, 2026 |
| CVE-2026-97668 | 9.8 Critical | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value | Oct 14, 2026 |
| CVE-2026-110002 | 9.8 Critical | Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter | Oct 14, 2026 |
| CVE-2026-82715 | 7.9 High | Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server | Oct 14, 2026 |
| CVE-2026-86573 | 5.1 Medium | Out-of-bounds Write Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server | Oct 14, 2026 |
| CVE-2026-86607 | 4.3 Medium | Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator | Oct 14, 2026 |
| CVE-2026-110392 | 9.8 Critical | Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning | Oct 14, 2026 |
| CVE-2026-92097 | 9.1 Critical | Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder | Oct 14, 2026 |
| CVE-2026-17092 | 8.1 High | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter | Oct 14, 2026 |
| CVE-2026-104995 | 8.1 High | BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value | Oct 14, 2026 |
| CVE-2026-104767 | 7.5 High | Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache | Oct 14, 2026 |
| CVE-2026-107652 | 5.3 Medium | Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field | Oct 14, 2026 |
| CVE-2026-93388 | 9.8 Critical | Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url | Oct 14, 2026 |
| CVE-2026-104749 | 7.5 High | Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data | Oct 14, 2026 |
| CVE-2026-103425 | 6.4 Medium | Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute | Oct 14, 2026 |
| CVE-2026-103423 | 7.5 High | Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0' | Oct 14, 2026 |
| CVE-2026-110385 | 8.7 High | A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The… | Oct 14, 2026 |
| CVE-2026-110359 | 7.8 High | Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit… | Oct 14, 2026 |
| CVE-2026-108473 | 8.7 High | Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices | Oct 14, 2026 |
| CVE-2026-50218 | 8.5 High | Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary… | Oct 14, 2026 |
| CVE-2026-50217 | 4.7 Medium | A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an… | Oct 14, 2026 |
| CVE-2026-50216 | 5.3 Medium | An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a… | Oct 14, 2026 |
| CVE-2026-50215 | 4.4 Medium | A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single… | Oct 14, 2026 |
| CVE-2026-46449 | 6.7 Medium | The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses… | Oct 14, 2026 |
| CVE-2026-92817 | 8.7 High | Inductive Automation Ignition Software Incorrect Authorization | Oct 13, 2026 |
| CVE-2026-105390 | 6.9 Medium | Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become… | Oct 13, 2026 |
| CVE-2026-15468 | 6.9 Medium | Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3. | Oct 13, 2026 |
| CVE-2026-88964 | 7.1 High | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options | Oct 13, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.