Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,726 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2017-20289 | 7.7 High | Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter | Oct 22, 2026 |
| CVE-2017-20288 | 5.1 Medium | QCubed 3.1.1 Reflected XSS via installer step_2.php | Oct 22, 2026 |
| CVE-2017-20287 | 8.7 High | Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter | Oct 22, 2026 |
| CVE-2026-13411 | 4.3 Medium | Null condition in Playbooks import crashes the plugin | Oct 22, 2026 |
| CVE-2026-111079 | 7.4 High | Goose: goose: shell history and environment leak via terminal integration | Oct 22, 2026 |
| CVE-2026-115207 | 5.5 Medium | Patch: filename validation bypass in reversal fallback allows file creation outside the working directory | Oct 22, 2026 |
| CVE-2026-112313 | 7.1 High | WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-112820 | 8.1 High | WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability | Oct 22, 2026 |
| CVE-2026-114348 | 5.3 Medium | webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint | Oct 22, 2026 |
| CVE-2026-112085 | 8.2 High | webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades | Oct 22, 2026 |
| CVE-2026-106017 | 6.3 Medium | Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions. | Oct 22, 2026 |
| CVE-2026-21812 | 2.2 Low | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) | Oct 22, 2026 |
| CVE-2026-21811 | 3.8 Low | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) | Oct 22, 2026 |
| CVE-2026-114703 | 6.5 Medium | WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-114702 | 6.5 Medium | WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-114701 | 6.5 Medium | WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-114700 | 6.5 Medium | WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-114699 | 5.3 Medium | WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-110974 | 6.3 Medium | Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json | Oct 22, 2026 |
| CVE-2026-114195 | 5.3 Medium | WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability | Oct 22, 2026 |
| CVE-2026-112218 | 5.3 Medium | WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-114696 | 5.3 Medium | WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-111842 | 5.3 Medium | WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-115253 | 7.3 High | WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering | Oct 22, 2026 |
| CVE-2026-96293 | 6.9 Medium | Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File | Oct 22, 2026 |
| CVE-2026-112311 | 6.5 Medium | WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability | Oct 22, 2026 |
| CVE-2026-111851 | 7.6 High | WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability | Oct 22, 2026 |
| CVE-2026-112312 | 7.5 High | WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-111830 | 7.1 High | WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-112241 | 9.8 Critical | WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability | Oct 22, 2026 |
| CVE-2026-112242 | 8.8 High | WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability | Oct 22, 2026 |
| CVE-2026-112845 | 6.5 Medium | WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-110893 | 5.3 Medium | WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-110894 | 5.3 Medium | WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-114698 | 5.4 Medium | WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability | Oct 22, 2026 |
| CVE-2026-112327 | 9.3 Critical | WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability | Oct 22, 2026 |
| CVE-2026-112379 | 7.1 High | WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-93471 | 8.7 High | Unbounded SAML message decompression in esaml allows memory exhaustion | Oct 22, 2026 |
| CVE-2026-86696 | 8.2 High | Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion | Oct 22, 2026 |
| CVE-2026-105270 | 8.7 High | Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion | Oct 22, 2026 |
| CVE-2026-114182 | 4.3 Medium | WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-112843 | 4.3 Medium | WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-112826 | 5.3 Medium | WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-114180 | 5.3 Medium | WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-111847 | 5.4 Medium | WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability | Oct 22, 2026 |
| CVE-2026-114177 | 8.8 High | WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability | Oct 22, 2026 |
| CVE-2026-114175 | 5.4 Medium | WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability | Oct 22, 2026 |
| CVE-2026-112867 | 6.5 Medium | WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-114184 | 6.5 Medium | WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability | Oct 22, 2026 |
| CVE-2026-103634 | 5.3 Medium | Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch | Oct 22, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.