[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104715 | 16 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a… | |
| CVE-2026-104730 | 16 Oct 2026 | CVSS 9.8 | sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for PhotographersThe Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all… | |
| CVE-2026-104755 | 16 Oct 2026 | CVSS 4.8 | aresit WP Compress – Instant Performance & Speed OptimizationThe WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and… | |
| CVE-2026-105973 | 16 Oct 2026 | CVSS 4.3 | Unknown Visual Form BuilderThe Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any… | |
| CVE-2026-105974 | 16 Oct 2026 | CVSS 4.3 | Unknown Visual Form BuilderThe Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a… | |
| CVE-2026-107646 | 16 Oct 2026 | CVSS 5.3 | realmag777 HUSKY – Products Filter for WooCommerce ProfessionalThe HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to… | |
| CVE-2026-103696 | 16 Oct 2026 | CVSS 6.8 | Unknown Mobile builderThe Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing… | |
| CVE-2026-95809 | 16 Oct 2026 | CVSS 7.2 | optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart InsightsThe Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored… | |
| CVE-2026-96570 | 16 Oct 2026 | CVSS 7.2 | magazine3 Schema & Structured Data for WP & AMPThe Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in… | |
| CVE-2026-89051 | 16 Oct 2026 | CVSS 7.2 | johndarrel Hide My WP Ghost – Security & FirewallThe WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-89079 | 16 Oct 2026 | CVSS 9.8 | jfarthing84 Theme My LoginThe Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is… | |
| CVE-2026-93767 | 16 Oct 2026 | CVSS 6.5 | TainacanThe Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter… | |
| CVE-2026-95686 | 16 Oct 2026 | CVSS 7.2 | optiuser Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart InsightsThe Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored… | |
| CVE-2026-85659 | 16 Oct 2026 | CVSS 8.8 | ontraport PilotPressThe PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The… | |
| CVE-2026-88963 | 16 Oct 2026 | CVSS 6.1 | themeum Tutor LMS – eLearning and online course solutionThe Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url'… | |
| CVE-2026-111122 | 16 Oct 2026 | CVSS 7.2 | gpriday SiteOrigin CSSThe SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and… | |
| CVE-2026-111458 | 16 Oct 2026 | CVSS 6.8 | adulau ssldumpThe fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The… | |
| CVE-2026-12272 | 16 Oct 2026 | CVSS 5.3 | daext Lightweight Cookie Notice – Cookie Banner for Cookie ConsentThe Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… | |
| CVE-2026-109447 | 16 Oct 2026 | CVSS 8.1 | cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role EditorThe User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege… | |
| CVE-2026-109513 | 16 Oct 2026 | CVSS 7.2 | wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification BarThe NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar… | |
| CVE-2026-110017 | 16 Oct 2026 | CVSS 6.4 | fullworks Quick PayPal Payments: Payment Button & FormThe Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all… | |
| CVE-2026-109414 | 16 Oct 2026 | CVSS 6.5 | appsbd Vitepos – Point of Sale (POS) for WooCommerceThe Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start /… | |
| CVE-2026-107764 | 16 Oct 2026 | CVSS 7.2 | gpriday SiteOrigin CSSThe SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all… | |
| CVE-2026-109232 | 16 Oct 2026 | CVSS 7.2 | wordpresschef Salon Booking System – Appointment Booking for Salons, Barbershops & SpasThe Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | |
| CVE-2026-104001 | 16 Oct 2026 | CVSS 5.4 | rilwis Slim SEO – AI SEO Plugin, Lightweight, Fast & AutomatedThe The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… | |
| CVE-2026-104932 | 16 Oct 2026 | CVSS 8.0 | johnny5 Search RegexThe Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all… | |
| CVE-2026-107748 | 16 Oct 2026 | CVSS 6.4 | cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role EditorThe User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored… | |
| CVE-2026-104000 | 16 Oct 2026 | CVSS 7.2 | croixhaug Simply Schedule AppointmentsThe Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to… | |
| CVE-2026-103768 | 16 Oct 2026 | CVSS 9.8 | elextensions ELEX WordPress HelpDesk & Customer Ticketing SystemThe ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and… | |
| CVE-2026-103896 | 16 Oct 2026 | CVSS 7.5 | 10Web Booster – Website speed optimization, Cache & Page Speed optimizerThe 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path… | |
| CVE-2026-103999 | 16 Oct 2026 | CVSS 7.2 | themefic Ultra Addons for Contact Form 7The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and… | |
| CVE-2026-100186 | 16 Oct 2026 | CVSS 7.2 | cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role EditorThe User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored… | |
| CVE-2026-103480 | 16 Oct 2026 | CVSS 6.4 | themefic Tourfic – AI Powered Travel Booking, Hotel Booking & Car RentalThe Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type'… | |
| CVE-2026-100158 | 16 Oct 2026 | CVSS 6.4 | elvinhaci SQL Chart BuilderThe SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from… | |
| CVE-2026-110721 | 16 Oct 2026 | CVSS 5.3 | wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification BarThe NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and… | |
| CVE-2026-111106 | 16 Oct 2026 | CVSS 6.5 | getwpfunnels Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI AssistanceThe Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint… | |
| CVE-2026-111114 | 16 Oct 2026 | CVSS 7.5 | posimyththemes Nexter Extension – Security, Performance, Code Snippets & Site ToolkitThe Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions… | |
| CVE-2026-96562 | 16 Oct 2026 | CVSS 6.5 | wpmudev Broken Link CheckerThe The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This… | |
| CVE-2026-109219 | 16 Oct 2026 | CVSS 9.8 | kitae-park Mang BoardThe Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload… | |
| CVE-2026-109221 | 16 Oct 2026 | CVSS 8.1 | trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing AutomationThe Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file… | |
| CVE-2026-109400 | 16 Oct 2026 | CVSS 7.5 | InstaWP Connect – 1-click WP Staging & MigrationThe InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including… | |
| CVE-2026-109512 | 16 Oct 2026 | CVSS 6.4 | kitae-park Mang BoardThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including… | |
| CVE-2026-109515 | 16 Oct 2026 | CVSS 9.8 | properfraction MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation… | |
| CVE-2026-109998 | 16 Oct 2026 | CVSS 7.2 | kitae-park Mang BoardThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including… | |
| CVE-2026-110019 | 16 Oct 2026 | CVSS 4.3 | niklaslindemann Bulk Page Generator – LPageryThe Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due… | |
| CVE-2026-110590 | 16 Oct 2026 | CVSS 7.5 | klarnaplugin Klarna for WooCommerceThe Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the… | |
| CVE-2026-103481 | 16 Oct 2026 | CVSS 6.1 | mpol Gwolle GuestbookThe Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and… | |
| CVE-2026-103525 | 16 Oct 2026 | CVSS 7.5 | wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and SimplerThe FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… | |
| CVE-2026-103895 | 16 Oct 2026 | CVSS 8.1 | cyberlord92 miniOrange OTP Login, Verification and SMS NotificationsThe miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and… | |
| CVE-2026-103911 | 16 Oct 2026 | CVSS 6.5 | wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form BuilderThe The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in… | |
| CVE-2026-104798 | 16 Oct 2026 | CVSS 9.8 | joedolson My Calendar – Accessible Event ManagerThe My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7… | |
| CVE-2026-107659 | 16 Oct 2026 | CVSS 7.5 | wpchill Modula Image Gallery – Photo Grid & Video GalleryThe Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… | |
| CVE-2026-107746 | 16 Oct 2026 | CVSS 7.5 | teamfunnelkit FunnelKit – Funnel Builder Plugin for WooCommerce CheckoutThe FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… | |
| CVE-2026-109191 | 16 Oct 2026 | CVSS 4.3 | extendthemes Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & GiphyThe Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in… | |
| CVE-2026-101335 | 16 Oct 2026 | CVSS 6.5 | wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form BuilderThe Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in… | |
| CVE-2026-97339 | 16 Oct 2026 | CVSS 7.2 | Complianz GDPR/CCPA Cookie Consent BannerThe Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp… | |
| CVE-2026-93953 | 16 Oct 2026 | CVSS 8.0 | softaculous Backuply – Backup, Restore, Migrate and CloneThe Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order… | |
| CVE-2026-89280 | 16 Oct 2026 | CVSS 4.3 | dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, EtsyThe Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure… | |
| CVE-2026-93535 | 16 Oct 2026 | CVSS 6.4 | wppool Dark Mode – Improve Accessibility with AI Powered Dark ThemeThe Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-77829 | 16 Oct 2026 | CVSS 6.4 | goratech Cooked – Recipe ManagementThe Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions… | |
| CVE-2026-111448 | 16 Oct 2026 | CVSS 3.7 | WheelsWheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip… | |
| CVE-2026-111449 | 16 Oct 2026 | CVSS 5.9 | WheelsWheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request… | |
| CVE-2026-111450 | 16 Oct 2026 | CVSS 5.9 | WheelsWheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no… | |
| CVE-2026-111451 | 16 Oct 2026 | CVSS 7.8 | Wheels CLIWheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback… | |
| CVE-2026-111443 | 16 Oct 2026 | CVSS 6.5 | WheelsWheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by… | |
| CVE-2026-111444 | 16 Oct 2026 | CVSS 9.8 | WheelsWheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies… | |
| CVE-2026-111445 | 16 Oct 2026 | CVSS 8.1 | WheelsWheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For… | |
| CVE-2026-111446 | 16 Oct 2026 | CVSS 8.6 | WheelsWheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by… | |
| CVE-2026-111447 | 16 Oct 2026 | CVSS 8.1 | WheelsWheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A… | |
| CVE-2026-111442 | 16 Oct 2026 | CVSS 5.3 | BackdropCMS BackdropBackdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially… | |
| CVE-2026-109207 | 16 Oct 2026 | CVSS 7.2 | themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds AggregatorThe RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored… | |
| CVE-2026-109990 | 16 Oct 2026 | CVSS 7.2 | gijo Flying Scripts: Delay JavaScript to Improve Site Speed & PerformanceThe Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-107758 | 16 Oct 2026 | CVSS 7.2 | extendthemes Colibri Page BuilderThe Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and… | |
| CVE-2026-104769 | 16 Oct 2026 | CVSS 5.9 | asadkn Debloat – Remove Unused CSS, Optimize JSThe Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0… | |
| CVE-2026-103518 | 16 Oct 2026 | CVSS 4.9 | wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and SimplerThe FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the… | |
| CVE-2026-104745 | 16 Oct 2026 | CVSS 8.1 | wpcodefactory Customer Email Verification for WooCommerceThe Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter… | |
| CVE-2026-111386 | 16 Oct 2026 | CVSS 4.3 | nezhahq nezhaNezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server… | |
| CVE-2026-111387 | 16 Oct 2026 | CVSS 6.5 | nezhahq nezhaNezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials… | |
| CVE-2026-111388 | 16 Oct 2026 | CVSS 5.4 | frappeFrappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods… | |
| CVE-2026-111389 | 16 Oct 2026 | CVSS 7.7 | frappe hrmsFrappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by… | |
| CVE-2026-111380 | 16 Oct 2026 | CVSS 8.8 | FreeRDPFreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue… | |
| CVE-2026-111381 | 16 Oct 2026 | CVSS 7.3 | FreeRDPFreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap… | |
| CVE-2026-111382 | 16 Oct 2026 | CVSS 8.8 | FreeRDPFreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows… | |
| CVE-2026-111383 | 16 Oct 2026 | CVSS 6.5 | nezhahq nezhaNezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections… | |
| CVE-2026-111384 | 16 Oct 2026 | CVSS 6.5 | nezhahq nezhaNezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls… | |
| CVE-2026-111385 | 16 Oct 2026 | CVSS 4.8 | nezhahq nezhaNezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url… | |
| CVE-2026-111373 | 16 Oct 2026 | CVSS 7.5 | FreeRDPFreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients… | |
| CVE-2026-111374 | 16 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request… | |
| CVE-2026-111375 | 16 Oct 2026 | CVSS 9.1 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger… | |
| CVE-2026-111376 | 16 Oct 2026 | CVSS 5.0 | FreeRDPFreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious… | |
| CVE-2026-111377 | 16 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment… | |
| CVE-2026-111378 | 16 Oct 2026 | CVSS 7.5 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated… | |
| CVE-2026-111379 | 16 Oct 2026 | CVSS 7.3 | FreeRDPFreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory… | |
| CVE-2026-111212 | 16 Oct 2026 | CVSS 4.8 | ImprintLab Medical-SAM-AdapterA security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function… | |
| CVE-2026-111237 | 16 Oct 2026 | CVSS 5.3 | Ultralytics FastSAMA weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function… | |
| CVE-2026-109812 | 16 Oct 2026 | CVSS 6.9 | Moxa AIG-302 SeriesA missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged… | Fix |
| CVE-2026-109813 | 16 Oct 2026 | CVSS 8.6 | Moxa AIG-302 SeriesA hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated… | Fix |
| CVE-2026-100159 | 16 Oct 2026 | CVSS 4.8 | ays-pro Popup Box – Create Countdown, Coupon, Video, Contact Form PopupsThe Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the… | |
| CVE-2026-105227 | 16 Oct 2026 | CVSS 7.0 | Deltaww ISPSoftThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft. | |
| CVE-2026-105228 | 16 Oct 2026 | CVSS 7.0 | Deltaww ISPSoftThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft. |
Page 45 of 168