[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-98216 | 6 Oct 2026 | CVSS 7.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIO_CRED credit-return mmap hfi1_file_mmap()'s PIO_CRED case… | |
| CVE-2026-98217 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: IB/mlx4: Fix use-after-free on pkey sysfs registration failure… | |
| CVE-2026-98218 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2c_atr_add_adapter()… | |
| CVE-2026-98219 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: sched_ext: Close the pre-enable ops error claim window scx_alloc_and_add_sched()… | |
| CVE-2026-98220 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix NULL sched deref in kfunc sub-sched error paths When the root… | |
| CVE-2026-98208 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mmc: sdio_uart: fix xmit_fifo leak when the port table is full… | |
| CVE-2026-98209 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-aspeed: Remove children before releasing SDC resources Probe… | |
| CVE-2026-98210 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: cancel data work and watchdog on remove mxcmci_remove() frees the… | |
| CVE-2026-98211 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mmc: mmci: Fix use-after-free in busy-timeout work ux500_busy_complete() can… | |
| CVE-2026-98212 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmc_hsq_pump_requests() queues… | |
| CVE-2026-98213 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mmc: core: Cancel SDIO IRQ work before freeing host A host controller that uses… | |
| CVE-2026-98214 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: selinux: recheck intermediate backing files on mprotect() mprotect() can be used… | |
| CVE-2026-98202 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound Transport… | |
| CVE-2026-98203 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: Input: soc_button_array - check btns_desc->package.count Check that… | |
| CVE-2026-98204 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() When chunking… | |
| CVE-2026-98205 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS… | |
| CVE-2026-98206 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes… | |
| CVE-2026-98207 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mmc: spi: reset bytes_xfered before retrying CRC failures mmc_spi_data_do()… | |
| CVE-2026-98196 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcms_free_timer() brcms_free_timer() calls… | |
| CVE-2026-98197 | 6 Oct 2026 | CVSS 7.0 | LinuxIn the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5… | |
| CVE-2026-98198 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: hwmon: (pwm-fan) Stop RPM timer before freeing tach data sample_timer() rearms… | |
| CVE-2026-98199 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) increase number of phases and add new mask Increase the… | |
| CVE-2026-98200 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()… | |
| CVE-2026-98201 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: Input: zero ff_effect before compat copy in input_ff_effect_from_user In the… | |
| CVE-2026-98189 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()… | |
| CVE-2026-98190 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames… | |
| CVE-2026-98191 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure… | |
| CVE-2026-98192 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown… | |
| CVE-2026-98193 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipw_michael_mic_verify()… | |
| CVE-2026-98194 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: libertas_tf: fix UAF in lbtf_free_adapter() lbtf_free_adapter() calls… | |
| CVE-2026-98195 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of… | |
| CVE-2026-98183 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements… | |
| CVE-2026-98184 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation… | |
| CVE-2026-98185 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex_ret_802_11_scan() subtracts… | |
| CVE-2026-98186 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length… | |
| CVE-2026-98187 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST The… | |
| CVE-2026-98188 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters… | |
| CVE-2026-98181 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gud_plane_atomic_check() The plane property… | |
| CVE-2026-98182 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: refuse to make a monitor active when it has no queue A monitor… | |
| CVE-2026-98180 | 6 Oct 2026 | CVSS 7.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct… | |
| CVE-2026-98179 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix rmmio iounmap skipped on device removal amdgpu_pci_remove() calls… | |
| CVE-2026-98173 | 6 Oct 2026 | CVSS 7.5 | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifs_try_adding_channels()… | |
| CVE-2026-98174 | 6 Oct 2026 | CVSS 7.5 | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is… | |
| CVE-2026-98175 | 6 Oct 2026 | CVSS 7.5 | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in clean_demultiplex_info()… | |
| CVE-2026-98176 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits… | |
| CVE-2026-98177 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits… | |
| CVE-2026-98178 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization… | |
| CVE-2026-98166 | 6 Oct 2026 | CVSS 7.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulk_move range… | |
| CVE-2026-98167 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix server->total_read for compound encrypted PDUs In… | |
| CVE-2026-98168 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In… | |
| CVE-2026-98169 | 6 Oct 2026 | CVSS 7.1 | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If… | |
| CVE-2026-98170 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In… | |
| CVE-2026-98171 | 6 Oct 2026 | CVSS 8.8 | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix… | |
| CVE-2026-98172 | 6 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbd_connection leak on cifs_get_tcp_session() error When an… | |
| CVE-2026-94675 | 6 Oct 2026 | CVSS 7.1 | Fluent Forms Free vs Pro Fluent Forms Pro Add On PackUnauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions. | |
| CVE-2026-95105 | 6 Oct 2026 | CVSS 8.2 | danielberkompas cloakReliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an… | |
| CVE-2026-95526 | 6 Oct 2026 | CVSS 7.3 | RealMag777 BEARUnauthenticated Broken Access Control in BEAR <= 1.2.2 versions. | |
| CVE-2026-95594 | 6 Oct 2026 | CVSS 8.1 | Cozy Vision Technologies Pvt. Ltd. SMS Alert Order NotificationsIncorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege… | |
| CVE-2026-97308 | 6 Oct 2026 | CVSS 4.8 | WebFactory Login LockdownUnauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions. | |
| CVE-2026-4889 | 6 Oct 2026 | CVSS 7.8 | RDL Technologies eLoanApp PlatformSQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint… | |
| CVE-2026-62072 | 6 Oct 2026 | CVSS 8.8 | Progress PlannerSubscriber Broken Access Control in Progress Planner <= 1.10.0 versions. | |
| CVE-2026-94206 | 6 Oct 2026 | CVSS 6.3 | danielberkompas cloak_ectoUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker… | |
| CVE-2026-42634 | 6 Oct 2026 | CVSS 7.1 | bPlugins Video Background Block – Use video as background in the section.Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions. | |
| CVE-2026-42635 | 6 Oct 2026 | CVSS 7.1 | wpgenie WooCommerce Simple AuctionsUnauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions. | |
| CVE-2026-42636 | 6 Oct 2026 | CVSS 7.1 | WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy ConsentUnauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions. | |
| CVE-2026-42637 | 6 Oct 2026 | CVSS 6.5 | PayPlug for WooCommerce (Official)Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions. | |
| CVE-2026-42638 | 6 Oct 2026 | CVSS 7.5 | Awesomemotive Easy Digital DownloadsMissing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-48197 | 6 Oct 2026 | CVSS 7.2 | PublishPress CapabilitiesIncorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This… | |
| CVE-2026-48199 | 6 Oct 2026 | CVSS 7.5 | Beplusthemes Sermon'eUnauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions. | |
| CVE-2026-41562 | 6 Oct 2026 | CVSS 7.5 | norvisgabriel Norvis BackupUnauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. | |
| CVE-2026-42413 | 6 Oct 2026 | CVSS 7.5 | DaftPlug Snapshotify – All-in-One Backup & Restore & MigrateUnauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions. | |
| CVE-2026-42414 | 6 Oct 2026 | CVSS 8.5 | CridioStudio ListingProSubscriber SQL Injection in ListingPro <= 2.9.12 versions. | |
| CVE-2026-42415 | 6 Oct 2026 | CVSS 9.3 | p-themes Porto Theme - FunctionalityUnauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions. | |
| CVE-2026-42416 | 6 Oct 2026 | CVSS 8.5 | AndonDesign UDesign CoreSubscriber SQL Injection in UDesign Core <= 4.15.0 versions. | |
| CVE-2026-42417 | 6 Oct 2026 | CVSS 9.3 | reputeinfosystems ARMember PremiumUnauthenticated SQL Injection in ARMember Premium <= 7.8 versions. | |
| CVE-2026-42418 | 6 Oct 2026 | CVSS 7.1 | Socialrocket Social RocketImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows… | |
| CVE-2026-40806 | 6 Oct 2026 | CVSS 7.1 | Plugin Devs Blog, Posts and Category Filter for ElementorUnauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions. | |
| CVE-2026-40807 | 6 Oct 2026 | CVSS 7.1 | Aman CF7 Views – Complete Entry Management for Contact Form 7Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions. | |
| CVE-2026-41555 | 6 Oct 2026 | CVSS 9.3 | Weblizar – WordPress Themes & Plugin Newsletter Subscription Form – User Subscriptions Form, Capture EmailUnauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions. | |
| CVE-2026-41559 | 6 Oct 2026 | CVSS 7.5 | Pluginjoy SafeSnap – Verified WordPress Backup & RestoreUnauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions. | |
| CVE-2026-41560 | 6 Oct 2026 | CVSS 7.5 | wxdlabs WXD Backup LiteUnauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions. | |
| CVE-2026-41561 | 6 Oct 2026 | CVSS 7.5 | Adrian Lin Museder RestoreOneUnauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions. | |
| CVE-2026-39792 | 6 Oct 2026 | CVSS 8.6 | Mitchell Bennis Simple File ListUnauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions. | |
| CVE-2026-39793 | 6 Oct 2026 | CVSS 8.8 | Nicu Micle Simple JWT LoginSubscriber Broken Authentication in Simple JWT Login 4.0.0 versions. | |
| CVE-2026-39794 | 6 Oct 2026 | CVSS 7.5 | WC Lovers WooCommerce Multivendor Marketplace – REST APIUnauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions. | |
| CVE-2026-39795 | 6 Oct 2026 | CVSS 9.3 | brewlabs SendPress NewslettersUnauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions. | |
| CVE-2026-39796 | 6 Oct 2026 | CVSS 7.5 | Flipper Code – WordPress Development Company Advanced Posts Listing – Show Post List EasilyUnauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions. | |
| CVE-2026-39797 | 6 Oct 2026 | CVSS 9.8 | Data443 Risk Mitigation, Inc. GDPR Framework By Data443Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions. | |
| CVE-2026-39798 | 6 Oct 2026 | CVSS 6.5 | ThemetechMount TrueBookerUnauthenticated Settings Change in TrueBooker <= 1.2.9 versions. | |
| CVE-2026-39785 | 6 Oct 2026 | CVSS 9.3 | Serhii Pasyuk Gmedia Photo GalleryImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media… | |
| CVE-2026-39787 | 6 Oct 2026 | CVSS 6.5 | 10Web Social Photo FeedUnauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions. | |
| CVE-2026-39788 | 6 Oct 2026 | CVSS 6.5 | Shamim Hasan Front End PMSubscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions. | |
| CVE-2026-39790 | 6 Oct 2026 | CVSS 7.1 | e4jvikwp VikRentCarImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected… | |
| CVE-2026-39791 | 6 Oct 2026 | CVSS 5.3 | Mailjet Email MarketingUnauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions. | |
| CVE-2026-39774 | 6 Oct 2026 | CVSS 8.8 | Tourfic AI Studio Tourfic ProUnauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions. | |
| CVE-2026-39775 | 6 Oct 2026 | CVSS 8.8 | DexignZone JobZilla - Job Board WordPress ThemeSubscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions. | |
| CVE-2026-39776 | 6 Oct 2026 | CVSS 8.0 | wpshopmart TabsEditor Remote Code Execution (RCE) in Tabs <= 2.5 versions. | |
| CVE-2026-39778 | 6 Oct 2026 | CVSS 7.1 | themeansar Ansar Import – One Click Starter Sites – for Elementor & ThemesUnauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions. | |
| CVE-2026-39780 | 6 Oct 2026 | CVSS 7.1 | YouzifyUnauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions. | |
| CVE-2026-39781 | 6 Oct 2026 | CVSS 7.1 | Dan Rossiter Document GalleryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery… |
Page 115 of 168