[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-39784 | 6 Oct 2026 | CVSS 7.1 | nicdark Hotel BookingUnauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions. | |
| CVE-2026-39769 | 6 Oct 2026 | CVSS 7.5 | Iqonic Design GraphinaUnauthenticated Broken Authentication in Graphina <= 3.1.12 versions. | |
| CVE-2026-39770 | 6 Oct 2026 | CVSS 10.0 | AmentoTech DoctreatUnauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions. | |
| CVE-2026-39771 | 6 Oct 2026 | CVSS 8.5 | MightyNetworks vs BuddyBoss Buddyboss PlatformSubscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions. | |
| CVE-2026-39772 | 6 Oct 2026 | CVSS 5.3 | bestwebsoft Captcha by BestWebSoftUnauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions. | |
| CVE-2026-39773 | 6 Oct 2026 | CVSS 10.0 | AmentoTech Doctreat CoreUnauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions. | |
| CVE-2026-39761 | 6 Oct 2026 | CVSS 9.8 | eLightUp Meta Box AIOUnauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions. | |
| CVE-2026-39762 | 6 Oct 2026 | CVSS 6.5 | Patterns In The Cloud Autoship Cloud for WooCommerce Subscription ProductsMissing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting… | |
| CVE-2026-39764 | 6 Oct 2026 | CVSS 9.3 | RadiusTheme Radius Booking — Booking Calendar for Appointments & ServicesUnauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions. | |
| CVE-2026-39765 | 6 Oct 2026 | CVSS 7.2 | WebAppick ChallanShop Manager Privilege Escalation in Challan <= 3.7.88 versions. | |
| CVE-2026-39766 | 6 Oct 2026 | CVSS 7.1 | reputeinfosystems ARFormsUnauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. | |
| CVE-2026-39767 | 6 Oct 2026 | CVSS 6.5 | baseapp WPBase CacheSubscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions. | |
| CVE-2026-39754 | 6 Oct 2026 | CVSS 6.5 | About Piotnet Piotnet Addons For ElementorContributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions. | |
| CVE-2026-39755 | 6 Oct 2026 | CVSS 9.9 | revmakx WP DuplicateSubscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions. | |
| CVE-2026-39756 | 6 Oct 2026 | CVSS 6.5 | Wappointment team WappointmentUnauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions. | |
| CVE-2026-39757 | 6 Oct 2026 | CVSS 9.9 | AmentoTech TaskbotSubscriber Arbitrary File Upload in Taskbot <= 6.6 versions. | |
| CVE-2026-39758 | 6 Oct 2026 | CVSS 7.1 | Midtrans-WooCommerceUnauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions. | |
| CVE-2026-39759 | 6 Oct 2026 | CVSS 9.9 | AmentoTech Workreap CoreEmployer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions. | |
| CVE-2026-39747 | 6 Oct 2026 | CVSS 8.5 | WofficeIO WofficeSubscriber SQL Injection in Woffice <= 5.4.35 versions. | |
| CVE-2026-39748 | 6 Oct 2026 | CVSS 7.1 | ThemeMove EduMallUnauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions. | |
| CVE-2026-39749 | 6 Oct 2026 | CVSS 6.5 | digitalpoint App for Cloudflare®Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions. | |
| CVE-2026-39750 | 6 Oct 2026 | CVSS 7.1 | weDevs StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side CartUnauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side… | |
| CVE-2026-39751 | 6 Oct 2026 | CVSS 7.5 | PayPlug for WooCommerce (Official)Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions. | |
| CVE-2026-39752 | 6 Oct 2026 | CVSS 7.7 | BlueGlass Interactive AG Jobs for WordPressContributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions. | |
| CVE-2026-39753 | 6 Oct 2026 | CVSS 9.8 | AmentoTech TaskbotUnauthenticated Privilege Escalation in Taskbot <= 6.6 versions. | |
| CVE-2026-39728 | 6 Oct 2026 | CVSS 7.2 | instapagedev Instapage PluginUnauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions. | |
| CVE-2026-39729 | 6 Oct 2026 | CVSS 7.2 | WisdmLabs Edwiser BridgeUnauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions. | |
| CVE-2026-39730 | 6 Oct 2026 | CVSS 7.1 | Marcin Wise ChatMissing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-39731 | 6 Oct 2026 | CVSS 7.1 | code4life Database for CF7Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions. | |
| CVE-2026-39745 | 6 Oct 2026 | CVSS 7.1 | bestweblayout Contact Form to DB by BestWebSoftUnauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions. | |
| CVE-2026-39746 | 6 Oct 2026 | CVSS 9.3 | fs-code BookneticUnauthenticated SQL Injection in Booknetic <= 4.8.5 versions. | |
| CVE-2026-39719 | 6 Oct 2026 | CVSS 7.2 | DeKnows PDF Smart Viewer for ElementorUnauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions. | |
| CVE-2026-39720 | 6 Oct 2026 | CVSS 7.1 | Mapster WP MapsUnauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions. | |
| CVE-2026-39722 | 6 Oct 2026 | CVSS 7.1 | VibeThemes WPLMSUnauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions. | |
| CVE-2026-39724 | 6 Oct 2026 | CVSS 7.1 | veppa HTTP Requests ManagerUnauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions. | |
| CVE-2026-39726 | 6 Oct 2026 | CVSS 7.1 | Lumise NEO Lumise Product DesignerUnauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions. | |
| CVE-2026-39727 | 6 Oct 2026 | CVSS 6.5 | Saravana Kumar K WC Fields FactorySubscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions. | |
| CVE-2026-32574 | 6 Oct 2026 | CVSS 7.1 | EDGARROJAS Smart FormsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows… | |
| CVE-2026-32575 | 6 Oct 2026 | CVSS 7.1 | Fantastic Plugins SUMO Affiliates ProUnauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions. | |
| CVE-2026-32577 | 6 Oct 2026 | CVSS 7.1 | N-Media Frontend File ManagerUnauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions. | |
| CVE-2026-32578 | 6 Oct 2026 | CVSS 7.1 | techsupport ECPay Ecommerce for WooCommerceSubscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions. | |
| CVE-2026-32579 | 6 Oct 2026 | CVSS 10.0 | Kognetiks Chatbot for WordPressUnauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions. | |
| CVE-2026-32580 | 6 Oct 2026 | CVSS 7.5 | wpgenie WooCommerce LotteryUnauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions. | |
| CVE-2026-32581 | 6 Oct 2026 | CVSS 7.1 | mooberrydreams Mooberry Book ManagerSubscriber SQL Injection in Mooberry Book Manager 4.16.2 versions. | |
| CVE-2026-32557 | 6 Oct 2026 | CVSS 9.3 | Bot Verification bookingwp.com: Verifying that you are not a robot... WooCommerce AppointmentsUnauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions. | |
| CVE-2026-32568 | 6 Oct 2026 | CVSS 9.9 | JMAPlugins WooCommerce Designer ProSubscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions. | |
| CVE-2026-32569 | 6 Oct 2026 | CVSS 7.1 | Joomunited WP Media folderUnauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. | |
| CVE-2026-32570 | 6 Oct 2026 | CVSS 7.1 | DaftPlug Progressify - Progressive Web App (PWA)Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions. | |
| CVE-2026-32571 | 6 Oct 2026 | CVSS 6.5 | Colabrio Ohio ExtraSubscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions. | |
| CVE-2026-32572 | 6 Oct 2026 | CVSS 7.1 | weDevs WP User Frontend ProUnauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions. | |
| CVE-2026-105317 | 6 Oct 2026 | CVSS 8.5 | Cozmoslabs Paid Member SubscriptionsSubscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. | |
| CVE-2026-105808 | 6 Oct 2026 | CVSS 3.5 | SourceCodester Simple Student Information SystemA vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file… | |
| CVE-2026-105809 | 6 Oct 2026 | CVSS 4.3 | SourceCodester Simple Student Information SystemA vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file… | |
| CVE-2026-105879 | 6 Oct 2026 | CVSS 6.5 | Crocoblock JetElements For ElementorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor… | |
| CVE-2026-25433 | 6 Oct 2026 | CVSS 7.1 | Tobias @Saleswonder.biz WP2LEADSSubscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. | |
| CVE-2026-25434 | 6 Oct 2026 | CVSS 8.5 | Tobias @Saleswonder.biz WP2LEADSSubscriber SQL Injection in WP2LEADS <= 3.5.7 versions. | |
| CVE-2026-105057 | 6 Oct 2026 | CVSS 5.3 | Ben Marshall Zero SpamUnauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. | |
| CVE-2026-105058 | 6 Oct 2026 | CVSS 8.8 | John James Jacoby WP User ProfilesSubscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. | |
| CVE-2026-105059 | 6 Oct 2026 | CVSS 6.5 | royalnavneet Delete All Comments of wordpressMissing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly… | |
| CVE-2026-105061 | 6 Oct 2026 | CVSS 7.1 | Bởi brandtoss WP MailsterUnauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. | |
| CVE-2026-105070 | 6 Oct 2026 | CVSS 8.8 | Dimitri Grassi Salon booking systemUnauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. | |
| CVE-2026-105071 | 6 Oct 2026 | CVSS 7.5 | Royal Plugins SiteVault – Backup, Restore, Migration & CloningUnauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. | |
| CVE-2026-104405 | 6 Oct 2026 | CVSS 8.1 | Nexcess GiveWPUnauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. | |
| CVE-2026-104406 | 6 Oct 2026 | CVSS 7.3 | picuUnauthenticated Broken Access Control in picu <= 3.10.1 versions. | |
| CVE-2026-104670 | 6 Oct 2026 | CVSS 7.1 | ThimPress LearnPressUnauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. | |
| CVE-2026-104672 | 6 Oct 2026 | CVSS 7.1 | Nexcess GiveWPUnauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. | |
| CVE-2026-104747 | 6 Oct 2026 | CVSS 8.1 | Edge-Themes HaakenUnauthenticated PHP Object Injection in Haaken <= 1.5 versions. | |
| CVE-2026-104757 | 6 Oct 2026 | CVSS 7.2 | Javier Carazo Import and export users and customersEditor Privilege Escalation in Import and export users and customers <= 2.5.5 versions. | |
| CVE-2026-104814 | 6 Oct 2026 | CVSS 7.1 | epiphyt Form BlockUnauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. | |
| CVE-2026-104387 | 6 Oct 2026 | CVSS 7.2 | blubrry PowerPress PodcastingUnauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions. | |
| CVE-2026-104394 | 6 Oct 2026 | CVSS 7.1 | Syed Balkhi CharitableUnauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. | |
| CVE-2026-104395 | 6 Oct 2026 | CVSS 7.1 | picuUnauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. | |
| CVE-2026-104399 | 6 Oct 2026 | CVSS 6.9 | StylemixThemes MotorsInsertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects… | |
| CVE-2026-100518 | 6 Oct 2026 | CVSS 5.3 | WebFactory Advanced Google reCAPTCHAUnauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions. | |
| CVE-2026-102387 | 6 Oct 2026 | CVSS 7.5 | Xserver MigratorUnauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions. | |
| CVE-2026-102915 | 6 Oct 2026 | CVSS 8.5 | Marco van Wieren WPO365Subscriber Broken Access Control in WPO365 <= 44.1 versions. | |
| CVE-2026-103346 | 6 Oct 2026 | CVSS 7.1 | Tomlister Payflex Payment GatewayImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway… | |
| CVE-2026-104385 | 6 Oct 2026 | CVSS 7.5 | Adrian Tobey GroundhoggUnauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. | |
| CVE-2026-85153 | 6 Oct 2026 | CVSS 9.3 | Schmooze dating mobile ApplicationThis vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An… | |
| CVE-2026-105807 | 6 Oct 2026 | CVSS 7.3 | SourceCodester Simple Student Information SystemA vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php… | |
| CVE-2026-105305 | 6 Oct 2026 | CVSS 5.4 | Red Hat Build of KeycloakA flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with… | |
| CVE-2026-94278 | 6 Oct 2026 | CVSS 5.5 | Unknown File Media RenamerThe File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment… | |
| CVE-2026-94293 | 6 Oct 2026 | CVSS 9.8 | Murrelektronik Software AAS Edge Client all versionsAn unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET… | |
| CVE-2026-94299 | 6 Oct 2026 | CVSS 6.5 | Unknown elegro Crypto PaymentThe elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment… | |
| CVE-2026-57559 | 6 Oct 2026 | CVSS 7.8 | Qualcomm, Inc. SnapdragonMemory corruption while processing service requests. | |
| CVE-2026-59357 | 6 Oct 2026 | CVSS 6.5 | Cloud Foundry UAAInsufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive)… | |
| CVE-2026-59358 | 6 Oct 2026 | CVSS 7.6 | Cloud Foundry UAAImproper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user… | |
| CVE-2026-86786 | 6 Oct 2026 | CVSS 5.3 | Unknown Slider ProThe Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing… | |
| CVE-2026-89289 | 6 Oct 2026 | CVSS 5.3 | Unknown Fast CourierThe Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing… | |
| CVE-2026-94270 | 6 Oct 2026 | CVSS 5.3 | Unknown Deema Payment GatewayThe Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with… | |
| CVE-2026-94271 | 6 Oct 2026 | CVSS 5.3 | Unknown Deema Payment GatewayThe Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the… | |
| CVE-2026-25302 | 6 Oct 2026 | CVSS 7.1 | Qualcomm, Inc. SnapdragonCryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be… | |
| CVE-2026-57537 | 6 Oct 2026 | CVSS 7.8 | Qualcomm, Inc. SnapdragonMemory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization. | Fix |
| CVE-2026-57545 | 6 Oct 2026 | CVSS 7.8 | Qualcomm, Inc. SnapdragonMemory corruption when processing draw objects of incorrect type during graphics command list execution. | Fix |
| CVE-2026-57546 | 6 Oct 2026 | CVSS 7.5 | Qualcomm, Inc. SnapdragonTransient DOS when processing a continuous receive command with a zero-sized global configuration override. | |
| CVE-2026-57554 | 6 Oct 2026 | CVSS 7.8 | Qualcomm, Inc. SnapdragonMemory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations. | |
| CVE-2026-57555 | 6 Oct 2026 | CVSS 7.8 | Qualcomm, Inc. SnapdragonMemory Corruption when executing system service routines due to improper handling of user input buffers. | |
| CVE-2026-25269 | 6 Oct 2026 | CVSS 6.7 | Qualcomm, Inc. SnapdragonMemory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size. | Fix |
| CVE-2026-25270 | 6 Oct 2026 | CVSS 6.7 | Qualcomm, Inc. SnapdragonMemory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver. | Fix |
| CVE-2026-25272 | 6 Oct 2026 | CVSS 6.7 | Qualcomm, Inc. SnapdragonMemory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation. | Fix |
Page 116 of 168