[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105874 | 14 Oct 2026 | CVSS 7.1 | Brainstorm Force SureCartImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows… | |
| CVE-2026-106599 | 14 Oct 2026 | CVSS 8.8 | Brainstorm Force SureCartDeserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a… | |
| CVE-2026-76655 | 14 Oct 2026 | CVSS 7.5 | Hewlett Packard Enterprise HPE NonStop SNMP Trap MultiplexerA security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution | |
| CVE-2026-85298 | 14 Oct 2026 | CVSS 7.3 | Google Cloud Application IntegrationAn Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration… | |
| CVE-2026-73797 | 14 Oct 2026 | CVSS 5.3 | Hewlett Packard Enterprise HPE NonStop TSQLFILA security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called. | |
| CVE-2026-73798 | 14 Oct 2026 | CVSS 8.2 | Hewlett Packard Enterprise HPE NonStop DNS 9.2.3 Non Secure VersionA security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service. | |
| CVE-2026-97315 | 14 Oct 2026 | CVSS 5.4 | Unknown Responsive BlocksThe Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them… | |
| CVE-2026-88998 | 14 Oct 2026 | CVSS 5.3 | Unknown TickeraThe Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature… | |
| CVE-2026-88842 | 14 Oct 2026 | CVSS 3.3 | Red Hat Hardened ImagesA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are… | |
| CVE-2026-82844 | 14 Oct 2026 | CVSS 5.3 | Unknown WPForms LiteThe WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms… | |
| CVE-2026-73795 | 14 Oct 2026 | CVSS 6.4 | Hewlett Packard Enterprise HPE NonStop TMF Auditread2A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service. | |
| CVE-2026-73796 | 14 Oct 2026 | CVSS 4.4 | Hewlett Packard Enterprise HPE NonStop TSQLEXEA security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query. | |
| CVE-2026-108071 | 14 Oct 2026 | CVSS 8.7 | TSplus Remote AccessIncorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with… | |
| CVE-2026-108072 | 14 Oct 2026 | CVSS 5.4 | TSplus Remote AccessVulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes… | |
| CVE-2026-107431 | 14 Oct 2026 | CVSS 7.5 | Crocoblock JetFormBuilderMissing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-108070 | 14 Oct 2026 | CVSS 8.7 | TSplus Remote AccessA vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access… | |
| CVE-2026-105067 | 14 Oct 2026 | CVSS 8.5 | Webnus Modern Events Calendar LiteImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite… | |
| CVE-2026-103905 | 14 Oct 2026 | CVSS 7.5 | JTL-Software GmbH JTL-ShopThe authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking… | |
| CVE-2026-104795 | 14 Oct 2026 | CVSS 8.8 | Red Hat OpenShift Container Platform 4.21The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When… | |
| CVE-2026-103904 | 14 Oct 2026 | CVSS 9.3 | JTL-Software GmbH JTL-ShopThe public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured… | |
| CVE-2026-101338 | 14 Oct 2026 | CVSS 8.7 | NLnet Labs NSDWhen a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit… | |
| CVE-2026-101339 | 14 Oct 2026 | CVSS 8.7 | NLnet Labs NSDA HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite the stack… | |
| CVE-2026-101341 | 14 Oct 2026 | CVSS 8.7 | NLnet Labs NSDTokens of text in RDATA (of for example TXT records) under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for… | |
| CVE-2026-103308 | 14 Oct 2026 | CVSS 6.5 | Unknown Visma Pay for WooCommerceThe Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a… | |
| CVE-2026-103358 | 14 Oct 2026 | CVSS 7.5 | VillaTheme Email Template Customizer for WooCommerceImproper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce… | |
| CVE-2026-100229 | 14 Oct 2026 | CVSS 6.5 | Red Hat Enterprise Linux 10A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing… | |
| CVE-2026-101301 | 14 Oct 2026 | CVSS 5.3 | Unknown WPCodeThe WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe… | |
| CVE-2026-101337 | 14 Oct 2026 | CVSS 8.7 | NLnet Labs NSDWhen base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to… | |
| CVE-2026-88829 | 14 Oct 2026 | CVSS 7.2 | Red Hat Hardened ImagesA flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend… | |
| CVE-2026-90954 | 14 Oct 2026 | CVSS 7.8 | Red Hat Hardened ImagesA flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the… | |
| CVE-2026-73792 | 14 Oct 2026 | CVSS 3.8 | Hewlett Packard Enterprise HPE NonStop Java JToolkitA security vulnerability in HPE NonStop Java JToolkit can allow command Injection and buffer overflow. | |
| CVE-2026-73793 | 14 Oct 2026 | CVSS 7.9 | Hewlett Packard Enterprise HPE NonStop MiddlewareHPE NonStop Middleware software has secret key handling and data deserialization vulnerability. | |
| CVE-2026-73794 | 14 Oct 2026 | CVSS 4.6 | Hewlett Packard Enterprise HPE NonStop MODULAR NSJHPE NonStop MODULAR NSJ contains a predictable seed vulnerability in Random Number Generation (PRNG) | |
| CVE-2026-86476 | 14 Oct 2026 | CVSS 8.4 | Red Hat Enterprise Linux 10A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata… | |
| CVE-2026-73791 | 14 Oct 2026 | CVSS 2.0 | Hewlett Packard Enterprise HPE NonStop HpjmeterA security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow. | |
| CVE-2026-109971 | 14 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool… | |
| CVE-2026-109970 | 14 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting… | |
| CVE-2026-109969 | 14 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission… | |
| CVE-2026-100231 | 14 Oct 2026 | CVSS 6.1 | Red Hat Enterprise Linux 10A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters… | |
| CVE-2026-103671 | 14 Oct 2026 | CVSS 5.3 | EC-CUBE CO.,LTD. AmazonPay V2 Plugin (4.0/4.1 series)External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user… | |
| CVE-2026-107428 | 14 Oct 2026 | CVSS 7.1 | VideoWhisper.com Paid Videochat Turnkey SiteImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnkey Site… | |
| CVE-2026-14851 | 14 Oct 2026 | CVSS 9.2 | Copart’s online billing serviceA vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable… | |
| CVE-2026-73790 | 14 Oct 2026 | CVSS 8.2 | Hewlett Packard Enterprise HPE NonStop iTP WebServerA vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown. | |
| CVE-2026-107757 | 14 Oct 2026 | CVSS 4.9 | tigroumeow Gallery Custom LinksThe Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment… | |
| CVE-2026-109901 | 14 Oct 2026 | CVSS 8.5 | Codepeople CP Multi View Event CalendarImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar… | |
| CVE-2026-110227 | 14 Oct 2026 | CVSS 5.3 | 10up Restricted Site AccessMissing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-110284 | 14 Oct 2026 | CVSS 7.5 | LifterLMS – WP LMS for eLearning, Online Courses, & QuizzesThe LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and… | |
| CVE-2026-92392 | 14 Oct 2026 | CVSS 8.1 | curlDuring an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use… | |
| CVE-2026-107171 | 14 Oct 2026 | CVSS 6.9 | Trellix AgentAn Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users. | |
| CVE-2026-107631 | 14 Oct 2026 | CVSS 7.2 | davidevalerio Record of Consent Extension for ComplianzThe Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all… | |
| CVE-2026-107650 | 14 Oct 2026 | CVSS 6.4 | paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryThe GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting… | |
| CVE-2026-107751 | 14 Oct 2026 | CVSS 7.2 | kitae-park Mang BoardThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including… | |
| CVE-2026-107754 | 14 Oct 2026 | CVSS 6.4 | paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryThe GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting… | |
| CVE-2026-107756 | 14 Oct 2026 | CVSS 6.4 | tigroumeow Meow LightboxThe Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to… | |
| CVE-2026-104761 | 14 Oct 2026 | CVSS 6.4 | kitae-park Mang BoardThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including… | |
| CVE-2026-104764 | 14 Oct 2026 | CVSS 7.2 | wpazleen Post Export Import with MediaThe Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via… | |
| CVE-2026-104909 | 14 Oct 2026 | CVSS 8.1 | kitae-park Mang BoardThe Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g… | |
| CVE-2026-105106 | 14 Oct 2026 | CVSS 8.8 | Koha Community KohaKoha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter… | |
| CVE-2026-105107 | 14 Oct 2026 | CVSS 7.6 | Koha Community KohaKoha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the… | |
| CVE-2025-9373 | 14 Oct 2026 | CVSS 6.4 | PeproDev Branches Map (Mapify)The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to… | |
| CVE-2026-100163 | 14 Oct 2026 | CVSS 7.4 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in… | |
| CVE-2026-103366 | 14 Oct 2026 | CVSS 7.5 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object… | |
| CVE-2026-103367 | 14 Oct 2026 | CVSS 8.1 | wpdesk ShopMagic – email automation for WordPressThe ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0… | |
| CVE-2026-103380 | 14 Oct 2026 | CVSS 4.3 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure… | |
| CVE-2026-103907 | 14 Oct 2026 | CVSS 6.5 | jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPressThe JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the… | |
| CVE-2026-104748 | 14 Oct 2026 | CVSS 9.8 | wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead NotificationsThe SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in… | |
| CVE-2026-92409 | 14 Oct 2026 | CVSS 6.8 | Unknown Donation ThermometerThe Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an… | |
| CVE-2026-92426 | 14 Oct 2026 | CVSS 4.9 | Unknown YITH WooCommerce PopupThe YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing… | |
| CVE-2026-94254 | 14 Oct 2026 | CVSS 5.3 | Unknown SellKitThe SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing… | |
| CVE-2026-94260 | 14 Oct 2026 | CVSS 5.3 | Unknown Sifalo PayThe Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment… | |
| CVE-2026-94261 | 14 Oct 2026 | CVSS 5.3 | Unknown Sifalo PayThe Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that… | |
| CVE-2026-94360 | 14 Oct 2026 | CVSS 5.3 | Unknown Paymentfor Gateway for WooCommerceThe Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before… | |
| CVE-2026-96900 | 14 Oct 2026 | CVSS 5.3 | Unknown Cart Abandonment Recovery for WooCommerceThe Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an… | |
| CVE-2026-96904 | 14 Oct 2026 | CVSS 5.3 | Unknown AWP ClassifiedsThe AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is… | |
| CVE-2026-87968 | 14 Oct 2026 | CVSS 5.3 | Unknown Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce MerchantThe Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform… | |
| CVE-2026-87974 | 14 Oct 2026 | CVSS 5.3 | Unknown Asaas Gateway for WooCommerceThe Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token… | |
| CVE-2026-88927 | 14 Oct 2026 | CVSS 4.3 | Unknown rtMedia for WordPress, BuddyPress and bbPressThe rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload… | |
| CVE-2026-89288 | 14 Oct 2026 | CVSS 8.6 | Unknown Fast CourierThe Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route… | |
| CVE-2026-89310 | 14 Oct 2026 | CVSS 9.9 | JTL SW GmbH JTL-WMSA parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to… | |
| CVE-2026-90989 | 14 Oct 2026 | CVSS 4.3 | Unknown TainacanThe Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any… | |
| CVE-2026-91076 | 14 Oct 2026 | CVSS 5.3 | Unknown Robokassa payment gateway for WoocommerceThe Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification… | |
| CVE-2026-85000 | 14 Oct 2026 | CVSS 5.3 | Unknown EmbedPressThe EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a… | |
| CVE-2026-85345 | 14 Oct 2026 | CVSS 4.1 | Unknown FV Flowplayer Video PlayerThe FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side… | |
| CVE-2026-86787 | 14 Oct 2026 | CVSS 7.2 | Unknown affiliate-toolkitThe affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating… | |
| CVE-2026-86797 | 14 Oct 2026 | CVSS 6.8 | Unknown Pricing TableThe Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it… | |
| CVE-2026-86799 | 14 Oct 2026 | CVSS 8.8 | Unknown FormsThe Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form… | |
| CVE-2026-87843 | 14 Oct 2026 | CVSS 6.5 | Unknown Trust Payments Gateway for WooCommerceThe Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a… | |
| CVE-2026-107594 | 14 Oct 2026 | CVSS 10.0 | Unknown File Upload to OrderThe File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before… | |
| CVE-2026-108064 | 14 Oct 2026 | CVSS 6.5 | Unknown WP EncryptionThe WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL… | |
| CVE-2026-108066 | 14 Oct 2026 | CVSS 2.7 | Unknown WP 2FAThe WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication… | |
| CVE-2026-108069 | 14 Oct 2026 | CVSS 5.3 | Unknown Sunshine Photo CartThe Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting… | |
| CVE-2026-110465 | 14 Oct 2026 | CVSS 4.3 | WisdomGarden TronclassTronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific… | |
| CVE-2026-110466 | 14 Oct 2026 | CVSS 4.3 | WisdomGarden TronclassTronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading… | |
| CVE-2026-110467 | 14 Oct 2026 | CVSS 4.3 | WisdomGarden TronclassTronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific… | |
| CVE-2026-106166 | 14 Oct 2026 | CVSS 5.3 | Unknown NEX-FormsThe NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form… | |
| CVE-2026-106469 | 14 Oct 2026 | CVSS 6.8 | Unknown Gutenverse FormThe Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into… | |
| CVE-2026-106646 | 14 Oct 2026 | CVSS 5.9 | Unknown Classified ListingThe Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request… | |
| CVE-2026-107126 | 14 Oct 2026 | CVSS 8.8 | Unknown WP Booking SystemThe WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later… | |
| CVE-2026-107158 | 14 Oct 2026 | CVSS 5.3 | Unknown LTL Freight QuotesThe LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to… | |
| CVE-2026-107160 | 14 Oct 2026 | CVSS 5.3 | Unknown LTL Freight QuotesThe LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values… |
Page 58 of 168