[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-87091 | 3 Oct 2026 | CVSS 7.2 | uscnanbu Welcart e-CommerceThe Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up… | |
| CVE-2026-88782 | 3 Oct 2026 | CVSS 6.8 | Unknown Kubio AI Page BuilderThe Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link… | |
| CVE-2026-80518 | 3 Oct 2026 | CVSS 3.7 | Unknown WP Ultimate CSV ImporterThe WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it… | |
| CVE-2026-85015 | 3 Oct 2026 | CVSS 6.6 | Unknown Unlimited Elements for ElementorThe Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them… | |
| CVE-2026-85568 | 3 Oct 2026 | CVSS 6.8 | Unknown Unlimited Elements for ElementorThe Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL… | |
| CVE-2026-86832 | 3 Oct 2026 | CVSS 5.3 | Unknown MetFormThe MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view… | |
| CVE-2026-11399 | 3 Oct 2026 | CVSS 4.3 | wpcodefactory Helpdesk Support Ticket System for WooCommerceThe Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… | |
| CVE-2026-80517 | 3 Oct 2026 | CVSS 3.5 | Unknown WP Ultimate CSV ImporterThe WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise… | |
| CVE-2026-103888 | 3 Oct 2026 | CVSS 6.1 | wpclever WPC Smart Quick View for WooCommerceThe WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in… | |
| CVE-2026-103909 | 3 Oct 2026 | CVSS 6.1 | codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & MoreThe Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected… | |
| CVE-2026-103913 | 3 Oct 2026 | CVSS 7.5 | paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryThe GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to… | |
| CVE-2026-101928 | 3 Oct 2026 | CVSS 7.2 | magicplugins Magic Tooltips For Contact Form 7The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up… | |
| CVE-2026-103293 | 3 Oct 2026 | CVSS 6.8 | Unknown MPGThe MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it… | |
| CVE-2026-103514 | 3 Oct 2026 | CVSS 7.5 | Unknown WP 2FAThe WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an… | |
| CVE-2026-101357 | 3 Oct 2026 | CVSS 4.9 | rainbowgeek SEOPress – AI SEO Plugin & On-site SEOThe SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-101923 | 3 Oct 2026 | CVSS 8.1 | villatheme Photo Reviews for WooCommerceThe Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is… | |
| CVE-2026-101159 | 3 Oct 2026 | CVSS 7.5 | Unknown WP Ultimate ReviewThe WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is… | |
| CVE-2026-101160 | 3 Oct 2026 | CVSS 7.5 | Unknown WP Ultimate ReviewThe WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it… | |
| CVE-2026-101161 | 3 Oct 2026 | CVSS 7.5 | Unknown WP Ultimate ReviewThe WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the… | |
| CVE-2026-101162 | 3 Oct 2026 | CVSS 6.4 | Unknown WP Ultimate ReviewThe WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which… | |
| CVE-2026-100149 | 3 Oct 2026 | CVSS 5.3 | WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share ButtonsThe WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all… | |
| CVE-2026-100152 | 3 Oct 2026 | CVSS 6.5 | smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable… | |
| CVE-2026-100148 | 3 Oct 2026 | CVSS 6.4 | widgetpack Rich Showcase for Google ReviewsThe Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all… | |
| CVE-2025-12828 | 3 Oct 2026 | CVSS 6.4 | ultrapressorg Ultra Addons Lite for ElementorThe Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to… | |
| CVE-2026-92826 | 3 Oct 2026 | CVSS 6.1 | nosilver4u EWWW Image OptimizerThe EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to… | |
| CVE-2026-92977 | 3 Oct 2026 | CVSS 7.2 | devowl Real Cookie Banner: GDPR & ePrivacy Cookie ConsentThe Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions… | |
| CVE-2026-97644 | 3 Oct 2026 | CVSS 8.8 | trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing AutomationThe Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding… | |
| CVE-2026-92538 | 3 Oct 2026 | CVSS 6.1 | thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online CoursesThe LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site… | |
| CVE-2026-92551 | 3 Oct 2026 | CVSS 6.1 | properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePressThe Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is… | |
| CVE-2026-92727 | 3 Oct 2026 | CVSS 6.4 | wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documentsThe EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to… | |
| CVE-2026-92536 | 3 Oct 2026 | CVSS 8.8 | properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePressThe Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is… | |
| CVE-2026-93428 | 3 Oct 2026 | CVSS 7.5 | ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership PluginThe Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable… | |
| CVE-2026-94378 | 3 Oct 2026 | CVSS 6.4 | psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot AgentThe SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-94539 | 3 Oct 2026 | CVSS 6.5 | psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot AgentThe SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the… | |
| CVE-2026-95865 | 3 Oct 2026 | CVSS 6.5 | beaverbuilder Beaver Builder Page Builder – Drag and Drop Website BuilderThe Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]'… | |
| CVE-2026-96270 | 3 Oct 2026 | CVSS 7.2 | ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership PluginThe Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable… | |
| CVE-2026-100180 | 3 Oct 2026 | CVSS 5.4 | jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPressThe Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site… | |
| CVE-2026-92243 | 3 Oct 2026 | CVSS 6.1 | vinod-dalvi Ivory Search – WordPress Search PluginThe Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions… | |
| CVE-2026-105083 | 3 Oct 2026 | CVSS 4.2 | ImageMagickImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when… | Fix |
| CVE-2026-105090 | 3 Oct 2026 | CVSS 5.1 | FormbricksFormbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Manage… | |
| CVE-2026-79113 | 3 Oct 2026 | CVSS 5.1 | aswf OpenAPVOpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow. | |
| CVE-2026-105080 | 3 Oct 2026 | CVSS 9.9 | C4illin ConvertXIn ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This… | |
| CVE-2026-104478 | 3 Oct 2026 | CVSS 7.1 | getformwork formworkFormwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary… | |
| CVE-2026-104479 | 3 Oct 2026 | CVSS 5.4 | mindstellar shopclassShopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item… | |
| CVE-2026-105029 | 3 Oct 2026 | CVSS 4.3 | uvdesk support-center-bundleUVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of… | |
| CVE-2026-105030 | 3 Oct 2026 | CVSS 5.3 | rajnandan1 kenerKener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive… | |
| CVE-2026-104433 | 3 Oct 2026 | CVSS 7.5 | kvcache-ai MooncakeMooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows… | |
| CVE-2026-104474 | 3 Oct 2026 | CVSS 6.7 | litespeedtech openlitespeedOpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a… | |
| CVE-2026-104475 | 3 Oct 2026 | CVSS 5.4 | idurar-erp-crmIDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading… | |
| CVE-2026-104476 | 3 Oct 2026 | CVSS 5.9 | backdropBackdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export… | |
| CVE-2026-104477 | 3 Oct 2026 | CVSS 6.1 | showdownjs showdownShowdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in… | |
| CVE-2026-105050 | 2 Oct 2026 | CVSS 7.1 | PeaZipPeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character… | |
| CVE-2026-105051 | 2 Oct 2026 | CVSS 1.9 | Irdeto Denuvo Anti-TamperDenuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and… | |
| CVE-2026-84411 | 2 Oct 2026 | CVSS 9.8 | MikroTik RouterOSThe web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before… | |
| CVE-2026-105048 | 2 Oct 2026 | CVSS 4.0 | Zilliz AttuThe Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses). | |
| CVE-2026-105049 | 2 Oct 2026 | CVSS 5.8 | Zilliz AttuZilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the… | |
| CVE-2026-94591 | 2 Oct 2026 | CVSS 8.4 | Armatura LLC Armatura OneArmatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection… | |
| CVE-2026-94592 | 2 Oct 2026 | CVSS 8.4 | Armatura LLC Armatura OneArmatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather… | |
| CVE-2026-94593 | 2 Oct 2026 | CVSS 7.8 | Armatura LLC Armatura OneArmatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file… | |
| CVE-2026-94594 | 2 Oct 2026 | CVSS 4.0 | Armatura LLC Armatura OneArmatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with… | |
| CVE-2026-95102 | 2 Oct 2026 | CVSS 9.4 | monta.appWebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit… | |
| CVE-2026-97212 | 2 Oct 2026 | CVSS 7.3 | monta.appThe WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same… | |
| CVE-2026-97363 | 2 Oct 2026 | CVSS 7.5 | monta.appThe WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow… | |
| CVE-2026-93474 | 2 Oct 2026 | CVSS 6.5 | monta.appCharging station authentication identifiers are publicly accessible via web-based mapping platforms. | |
| CVE-2026-105043 | 2 Oct 2026 | CVSS 3.6 | MathWorks SimulinkMathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code… | |
| CVE-2026-105046 | 2 Oct 2026 | CVSS 4.3 | Kentico XperienceKentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints. | |
| CVE-2026-82045 | 2 Oct 2026 | CVSS 6.5 | UTMStackUTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting… | |
| CVE-2026-75937 | 2 Oct 2026 | CVSS 9.4 | Digi International IX FamilyA specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system… | |
| CVE-2026-82041 | 2 Oct 2026 | CVSS 9.9 | UTMStackUTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the… | |
| CVE-2026-82042 | 2 Oct 2026 | CVSS 9.8 | UTMStackUTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by… | |
| CVE-2026-82043 | 2 Oct 2026 | CVSS 5.3 | UTMStackUTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses… | |
| CVE-2026-82044 | 2 Oct 2026 | CVSS 7.7 | UTMStackUTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary… | |
| CVE-2026-104055 | 2 Oct 2026 | CVSS 5.3 | Canonical postgresql-operatorThe postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On… | |
| CVE-2026-104874 | 2 Oct 2026 | CVSS 5.3 | Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionMultidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand… | Fix |
| CVE-2026-82039 | 2 Oct 2026 | CVSS 8.8 | UTMStackUTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to… | |
| CVE-2026-82040 | 2 Oct 2026 | CVSS 5.0 | UTMStackUTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows… | |
| CVE-2026-39718 | 2 Oct 2026 | CVSS 8.8 | Webriti WallstreetCross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet… | |
| CVE-2026-104872 | 2 Oct 2026 | CVSS 5.8 | Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributeOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0… | Fix |
| CVE-2026-104873 | 2 Oct 2026 | CVSS 7.6 | LangGraph SDK custom auth silently ignores actions= on resource decoratorsLangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From… | Fix |
| CVE-2026-104988 | 2 Oct 2026 | CVSS 8.1 | Red Hat Certificate System 10A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via… | |
| CVE-2026-104991 | 2 Oct 2026 | CVSS 7.1 | Alanaktion phprojectPhproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments… | |
| CVE-2026-104994 | 2 Oct 2026 | CVSS 2.5 | aquasec TrivyTrivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk… | |
| CVE-2026-12392 | 2 Oct 2026 | CVSS 5.3 | Canonical MAASAn information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker… | |
| CVE-2026-103918 | 2 Oct 2026 | CVSS 6.5 | @orpc/zod: Prototype injection in smart coercionoRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod… | Fix |
| CVE-2026-104019 | 2 Oct 2026 | CVSS 9.0 | AWS sagemaker-distributionOS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x… | |
| CVE-2026-104871 | 2 Oct 2026 | CVSS 6.3 | Angular SSR: Path Traversal to Sibling Directories in CommonEngine on WindowsThe Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine… | Fix |
| CVE-2026-103036 | 2 Oct 2026 | CVSS 6.5 | middleapi orpcoRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema… | |
| CVE-2026-96940 | 2 Oct 2026 | CVSS 8.8 | Microsoft Exchange Server 2016 Cumulative Update 23Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-19856 | 2 Oct 2026 | CVSS 6.5 | Unknown All in One SEOThe All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input… | |
| CVE-2026-103958 | 2 Oct 2026 | CVSS 7.6 | AWS loomServer-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote… | |
| CVE-2026-103956 | 2 Oct 2026 | CVSS 10.0 | AWS loomMissing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain… | |
| CVE-2026-103957 | 2 Oct 2026 | CVSS 6.2 | AWS loomServer-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the… | |
| CVE-2020-37278 | 2 Oct 2026 | CVSS 7.5 | Weaver e-BridgeWeaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host… | |
| CVE-2023-54405 | 2 Oct 2026 | CVSS 9.8 | H3C CVMH3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability… | |
| CVE-2014-125130 | 2 Oct 2026 | CVSS 7.5 | Damjan CodeArt Google MP3 Audio PlayerCodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read… | |
| CVE-2026-59265 | 2 Oct 2026 | CVSS 8.8 | Apache Software Foundation Apache OpenOfficeA code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing… | Fix |
| CVE-2026-104855 | 2 Oct 2026 | CVSS 2.0 | Wasmtime: Preemption and traps during bulk operations enable breaking internal VM stateWasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including… | Fix |
| CVE-2026-104859 | 2 Oct 2026 | CVSS 7.3 | @nx/docker: OS command injection in the @nx/docker release pipelineNx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release… | Fix |
| CVE-2026-104861 | 2 Oct 2026 | CVSS 7.5 | probe-image-size: Quadratic-time Denial of Service in the SVG Parserprobe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the… | Fix |
| CVE-2026-102626 | 2 Oct 2026 | CVSS 7.2 | LimeSurveyAn authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the… |
Page 123 of 168