[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-97280 | 1 Oct 2026 | CVSS 6.5 | Mamunur Rashid Review SchemaMissing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-97281 | 1 Oct 2026 | CVSS 6.3 | weDevs WP Project ManagerSubscriber Broken Access Control in WP Project Manager <= 4.0.7 versions. | |
| CVE-2026-97284 | 1 Oct 2026 | CVSS 8.8 | IcegramContributor PHP Object Injection in Icegram <= 3.1.31 versions. | |
| CVE-2026-97297 | 1 Oct 2026 | CVSS 7.6 | Apps Mav GratisfactionSubscriber Broken Access Control in Gratisfaction <= 4.6.3 versions. | |
| CVE-2026-97251 | 1 Oct 2026 | CVSS 6.5 | magepeopleteam Bus Ticket Booking with Seat ReservationUnauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions. | |
| CVE-2026-97258 | 1 Oct 2026 | CVSS 6.5 | Aruba.it Aruba Migration ToolSubscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions. | |
| CVE-2026-97260 | 1 Oct 2026 | CVSS 7.1 | maxfoundry MaxGalleriaUnauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions. | |
| CVE-2026-97268 | 1 Oct 2026 | CVSS 7.1 | Premmerce Wishlist for WooCommerceUnauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. | |
| CVE-2026-94390 | 1 Oct 2026 | CVSS 7.2 | Dotstore Hide Shipping Method For WooCommerceEditor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions. | |
| CVE-2026-95588 | 1 Oct 2026 | CVSS 8.6 | AcyMailing Newsletter Team AcyMailing SMTP NewsletterUnauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions. | |
| CVE-2026-67104 | 1 Oct 2026 | CVSS 5.3 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze… | |
| CVE-2026-67105 | 1 Oct 2026 | CVSS 7.4 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to… | |
| CVE-2026-67106 | 1 Oct 2026 | CVSS 5.3 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This… | |
| CVE-2026-79898 | 1 Oct 2026 | CVSS 9.1 | Fortra BoKS ManagerFortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI… | |
| CVE-2026-79899 | 1 Oct 2026 | CVSS 7.9 | Fortra BoKS ManagerFortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without… | |
| CVE-2026-79900 | 1 Oct 2026 | CVSS 6.5 | Fortra BoKS Manager boks-serverboks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL… | |
| CVE-2026-56589 | 1 Oct 2026 | CVSS 7.2 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store… | |
| CVE-2026-56599 | 1 Oct 2026 | CVSS 2.2 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit… | |
| CVE-2026-62071 | 1 Oct 2026 | CVSS 9.3 | nickboss WordPress File UploadUnauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. | |
| CVE-2026-62073 | 1 Oct 2026 | CVSS 7.5 | Themeisle WP Full Stripe FreeUnauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions. | |
| CVE-2026-103687 | 1 Oct 2026 | CVSS 7.3 | rhukster dom-sanitizerA vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of… | |
| CVE-2026-103752 | 1 Oct 2026 | CVSS 9.8 | Paul Ryan AuthorizerUnauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. | |
| CVE-2026-103347 | 1 Oct 2026 | CVSS 5.3 | hCaptcha for WPUnauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions. | |
| CVE-2026-103068 | 1 Oct 2026 | CVSS 8.8 | ByteCore Stack ByteCoreStack – MCP Connector for AI ToolsSubscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions. | |
| CVE-2026-102378 | 1 Oct 2026 | CVSS 7.1 | bPlugins Parallax Section blockUnauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions. | |
| CVE-2026-103004 | 1 Oct 2026 | CVSS 5.3 | next.js cache leak across root param values in nested 'use cache' functionsNext.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different… | Fix |
| CVE-2024-58388 | 1 Oct 2026 | CVSS 7.5 | Sharp Corporation Multiple Multifunction PrintersSharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers… | |
| CVE-2026-100514 | 1 Oct 2026 | CVSS 7.5 | Pete Nelson REST API LogUnauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions. | |
| CVE-2026-100517 | 1 Oct 2026 | CVSS 7.5 | VillaTheme Photo Reviews for WooCommerceUnauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions. | |
| CVE-2026-66248 | 1 Oct 2026 | CVSS 3.1 | HCL Software iControliControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and… | |
| CVE-2026-66249 | 1 Oct 2026 | CVSS 3.1 | HCL Software iControliControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted… | |
| CVE-2026-66253 | 1 Oct 2026 | CVSS 3.1 | HCL Software iControliControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling… | |
| CVE-2026-79901 | 1 Oct 2026 | CVSS 9.9 | Fortra BoKS Manager boks-serverIn deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a… | |
| CVE-2026-66246 | 1 Oct 2026 | CVSS 8.8 | HCL Software iControliControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure… | |
| CVE-2026-66247 | 1 Oct 2026 | CVSS 4.3 | HCL Software iControliControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute… | |
| CVE-2026-103686 | 1 Oct 2026 | CVSS 3.5 | rhukster dom-sanitizerA flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php… | |
| CVE-2026-102504 | 1 Oct 2026 | CVSS 7.5 | Tonycoz imagerImager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing… | Fix |
| CVE-2026-102505 | 1 Oct 2026 | CVSS 6.3 | Tonycoz imagerImager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image… | Fix |
| CVE-2026-62059 | 1 Oct 2026 | CVSS 7.6 | Ultimate MemberImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member… | |
| CVE-2026-62060 | 1 Oct 2026 | CVSS 7.6 | captivateaudio Captivate SyncImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync… | |
| CVE-2026-62061 | 1 Oct 2026 | CVSS 5.3 | Metagauss ProfileGridAuthorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows… | |
| CVE-2026-62063 | 1 Oct 2026 | CVSS 5.4 | Magepeople inc. WpTravellyMissing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-103345 | 1 Oct 2026 | CVSS 5.3 | Shamim Rajani Pie RegisterInsertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive… | |
| CVE-2026-62058 | 1 Oct 2026 | CVSS 5.3 | WPExperts CF7 AppsInsertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive… | |
| CVE-2026-103064 | 1 Oct 2026 | CVSS 6.5 | Wpmet ElementsKit Elementor addons LiteImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite… | |
| CVE-2026-103067 | 1 Oct 2026 | CVSS 8.0 | Memberful - Membership PluginCross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue… | |
| CVE-2026-103338 | 1 Oct 2026 | CVSS 8.5 | Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For… | |
| CVE-2026-103339 | 1 Oct 2026 | CVSS 6.5 | Wpmet MetformImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This… | |
| CVE-2026-103340 | 1 Oct 2026 | CVSS 5.3 | Gemini Labs Site ReviewsMissing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-103341 | 1 Oct 2026 | CVSS 5.3 | Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)… | |
| CVE-2026-103343 | 1 Oct 2026 | CVSS 6.5 | WP ManageNinja LLC FluentFormImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentform allows… | |
| CVE-2026-102379 | 1 Oct 2026 | CVSS 8.5 | VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC BuilderImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for… | |
| CVE-2026-102381 | 1 Oct 2026 | CVSS 5.3 | Ahmad Majestic SupportMissing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-102382 | 1 Oct 2026 | CVSS 4.3 | Ahmad Majestic SupportAuthorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured… | |
| CVE-2026-102390 | 1 Oct 2026 | CVSS 5.3 | VillaTheme AFFI – Affiliate Marketing for WooCommerceMissing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting… | |
| CVE-2026-102394 | 1 Oct 2026 | CVSS 6.5 | WPDeveloper Essential Addons for ElementorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor… | |
| CVE-2026-103063 | 1 Oct 2026 | CVSS 6.5 | Wpmet ElementsKit Elementor addons LiteImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ElementsKit Elementor addons Lite… | |
| CVE-2026-94250 | 1 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache APISIXAllocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a… | |
| CVE-2026-94269 | 1 Oct 2026 | CVSS 6.3 | Apache Software Foundation Apache APISIXUse of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a… | |
| CVE-2026-94276 | 1 Oct 2026 | CVSS 5.1 | Apache Software Foundation Apache APISIXImproper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization… | |
| CVE-2026-103858 | 1 Oct 2026 | CVSS 5.3 | MISPMISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an… | |
| CVE-2026-94212 | 1 Oct 2026 | CVSS 6.4 | Apache Software Foundation Apache APISIXImproper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every… | |
| CVE-2026-94220 | 1 Oct 2026 | CVSS 2.1 | Apache Software Foundation Apache APISIXCross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a… | |
| CVE-2026-103678 | 1 Oct 2026 | CVSS 8.1 | Tnef Project tnefA flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format… | |
| CVE-2026-103679 | 1 Oct 2026 | CVSS 6.5 | Tnef Project tnefA flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format… | |
| CVE-2026-103680 | 1 Oct 2026 | CVSS 6.5 | Tnef Project tnefA flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for… | |
| CVE-2026-103754 | 1 Oct 2026 | CVSS 5.9 | Red Hat Ansible Automation Platform 2A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the… | |
| CVE-2026-103336 | 1 Oct 2026 | CVSS 5.3 | Smackcoders Inc. WP Ultimate CSV ImporterInsertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve… | |
| CVE-2026-82806 | 1 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache APISIXExposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a… | |
| CVE-2026-88789 | 1 Oct 2026 | CVSS 8.6 | Apache Software Foundation Apache Camel QuarkusImproper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0… | |
| CVE-2026-78242 | 1 Oct 2026 | CVSS 5.7 | Apache Software Foundation Apache APISIXInsertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written… | |
| CVE-2026-103353 | 1 Oct 2026 | CVSS 5.3 | WP ManageNinja LLC FluentFormIncorrect Behavior Order vulnerability in WP ManageNinja LLC FluentForm fluentform allows Removing Important Client Functionality.This issue affects… | |
| CVE-2026-103757 | 1 Oct 2026 | CVSS 7.7 | budibaseBudibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in… | |
| CVE-2026-103758 | 1 Oct 2026 | CVSS 8.1 | obot-platform obotObot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI… | |
| CVE-2026-103287 | 1 Oct 2026 | CVSS 2.7 | TryGhost GhostGhost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe… | |
| CVE-2026-103288 | 1 Oct 2026 | CVSS 6.5 | TryGhost GhostGhost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An… | |
| CVE-2026-103289 | 1 Oct 2026 | CVSS 6.5 | TryGhost GhostGhost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they… | |
| CVE-2026-103290 | 1 Oct 2026 | CVSS 3.8 | TryGhost GhostGhost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation… | |
| CVE-2026-103291 | 1 Oct 2026 | CVSS 6.4 | TryGhost GhostGhost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated… | |
| CVE-2026-103292 | 1 Oct 2026 | CVSS 8.0 | TryGhost GhostGhost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}}… | |
| CVE-2026-103281 | 1 Oct 2026 | CVSS 5.4 | TryGhost GhostGhost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An… | |
| CVE-2026-103282 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to be… | |
| CVE-2026-103283 | 1 Oct 2026 | CVSS 8.1 | TryGhost GhostGhost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user… | |
| CVE-2026-103284 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unauthorized… | |
| CVE-2026-103285 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers… | |
| CVE-2026-103286 | 1 Oct 2026 | CVSS 7.3 | TryGhost GhostGhost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff… | |
| CVE-2026-103275 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which… | |
| CVE-2026-103276 | 1 Oct 2026 | CVSS 5.3 | TryGhost GhostGhost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates… | |
| CVE-2026-103277 | 1 Oct 2026 | CVSS 8.1 | TryGhost GhostGhost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox… | |
| CVE-2026-103278 | 1 Oct 2026 | CVSS 7.3 | TryGhost GhostGhost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user… | |
| CVE-2026-103279 | 1 Oct 2026 | CVSS 6.8 | TryGhost GhostGhost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can… | |
| CVE-2026-103280 | 1 Oct 2026 | CVSS 5.3 | TryGhost GhostGhost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to… | |
| CVE-2026-103268 | 1 Oct 2026 | CVSS 8.8 | TryGhost GhostGhost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through… | |
| CVE-2026-103269 | 1 Oct 2026 | CVSS 5.3 | TryGhost GhostGhost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of… | |
| CVE-2026-103271 | 1 Oct 2026 | CVSS 7.5 | TryGhost GhostGhost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content… | |
| CVE-2026-103272 | 1 Oct 2026 | CVSS 7.5 | TryGhost GhostGhost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak… | |
| CVE-2026-103273 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass… | |
| CVE-2026-103274 | 1 Oct 2026 | CVSS 5.3 | TryGhost GhostGhost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments… | |
| CVE-2026-103262 | 1 Oct 2026 | CVSS 7.5 | tornadoweb tornadoTornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause… | |
| CVE-2026-103263 | 1 Oct 2026 | CVSS 5.9 | tornadoweb tornadoTornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without… |
Page 129 of 168