[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-94235 | 11 Oct 2026 | CVSS 4.3 | Unknown MemberHeroThe MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated… | |
| CVE-2026-96227 | 11 Oct 2026 | CVSS 8.8 | Unknown Piotnet FormsThe Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits… | |
| CVE-2026-97183 | 11 Oct 2026 | CVSS 4.3 | Unknown WP-InvoiceThe WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user… | |
| CVE-2026-89232 | 11 Oct 2026 | CVSS 8.6 | Unknown RecordbrowserThe Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated… | |
| CVE-2026-89234 | 11 Oct 2026 | CVSS 8.6 | Unknown WP-PartnerThe WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated… | |
| CVE-2026-89283 | 11 Oct 2026 | CVSS 8.6 | Unknown WP Posts Password Batch ManagerThe WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that… | |
| CVE-2026-89285 | 11 Oct 2026 | CVSS 8.6 | Unknown Datalist itThe Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query… | |
| CVE-2026-89287 | 11 Oct 2026 | CVSS 8.6 | Unknown ASPL Product QuotationThe ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing… | |
| CVE-2026-89297 | 11 Oct 2026 | CVSS 8.6 | Unknown Loja AutomáticaThe Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing… | |
| CVE-2026-89299 | 11 Oct 2026 | CVSS 8.6 | Unknown WP Verify APIThe WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing… | |
| CVE-2026-89302 | 11 Oct 2026 | CVSS 8.6 | Unknown Post Voting SystemThe Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing… | |
| CVE-2026-89304 | 11 Oct 2026 | CVSS 6.5 | Unknown paymendoThe paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated… | |
| CVE-2026-88785 | 11 Oct 2026 | CVSS 4.7 | Unknown Simple MembershipThe Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string… | |
| CVE-2026-88826 | 11 Oct 2026 | CVSS 8.8 | Unknown SmugMug EmbedThe SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not… | |
| CVE-2026-88827 | 11 Oct 2026 | CVSS 8.8 | Unknown Disable UsersThe Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of… | |
| CVE-2026-88903 | 11 Oct 2026 | CVSS 8.8 | Unknown TopcontentThe Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing… | |
| CVE-2026-88905 | 11 Oct 2026 | CVSS 8.8 | Unknown KeyWord CollectorThe KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them… | |
| CVE-2026-88930 | 11 Oct 2026 | CVSS 8.6 | Unknown Social Web SuiteThe Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and… | |
| CVE-2026-89195 | 11 Oct 2026 | CVSS 8.6 | Unknown Site Setup WizardThe Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which… | |
| CVE-2026-89213 | 11 Oct 2026 | CVSS 8.6 | Unknown Llavero.ioThe Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows… | |
| CVE-2026-89214 | 11 Oct 2026 | CVSS 8.6 | Unknown WpCues Basic QuizThe WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows… | |
| CVE-2026-85121 | 11 Oct 2026 | CVSS 9.1 | Unknown InsurifyThe Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to… | |
| CVE-2026-85126 | 11 Oct 2026 | CVSS 7.2 | Unknown CrowdfundlyThe Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low… | |
| CVE-2026-86706 | 11 Oct 2026 | CVSS 9.1 | Unknown Quick quotesThe Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose… | |
| CVE-2026-86717 | 11 Oct 2026 | CVSS 9.1 | Unknown InsurifyThe Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to… | |
| CVE-2026-86798 | 11 Oct 2026 | CVSS 8.8 | Unknown HootBoardThe HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values… | |
| CVE-2026-87760 | 11 Oct 2026 | CVSS 8.8 | Unknown Web Vitals TrackingThe Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors… | |
| CVE-2026-87761 | 11 Oct 2026 | CVSS 8.0 | Unknown Adwised Web Push NotificationThe Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user… | |
| CVE-2026-87762 | 11 Oct 2026 | CVSS 8.8 | Unknown Adwised Web Push NotificationThe Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the… | |
| CVE-2026-87764 | 11 Oct 2026 | CVSS 8.8 | Unknown BuddyPress Instant ChatThe BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being… | |
| CVE-2026-84253 | 11 Oct 2026 | CVSS 9.8 | Unknown click5 CRM add-on to Gravity FormsThe click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST… | |
| CVE-2026-84254 | 11 Oct 2026 | CVSS 9.8 | Unknown click5 CRM add-on to Contact Form 7The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST… | |
| CVE-2026-84258 | 11 Oct 2026 | CVSS 8.8 | Unknown click5 CRM add-on to Ninja FormsThe click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated… | |
| CVE-2026-84259 | 11 Oct 2026 | CVSS 8.8 | Unknown click5 CRM add-on to WPFormsThe click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint… | |
| CVE-2026-84260 | 11 Oct 2026 | CVSS 8.8 | Unknown click5 CRM add-on to Gravity FormsThe click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated… | |
| CVE-2026-84261 | 11 Oct 2026 | CVSS 8.8 | Unknown click5 CRM add-on to Contact Form 7The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated… | |
| CVE-2026-84734 | 11 Oct 2026 | CVSS 9.8 | Unknown Mindstien Quick LoginThe Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session… | |
| CVE-2026-84737 | 11 Oct 2026 | CVSS 9.8 | Unknown Freeton WPThe Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated… | |
| CVE-2026-85118 | 11 Oct 2026 | CVSS 9.8 | Unknown AI Content Generator MarketingThe AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing… | |
| CVE-2026-14854 | 11 Oct 2026 | CVSS 7.5 | Unknown WooCommerce BookingsThe WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its… | |
| CVE-2026-81153 | 11 Oct 2026 | CVSS 6.8 | Unknown Robo GalleryThe Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page… | |
| CVE-2026-81154 | 11 Oct 2026 | CVSS 6.8 | Unknown Robo GalleryThe Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts… | |
| CVE-2026-81155 | 11 Oct 2026 | CVSS 6.8 | Unknown Robo GalleryThe Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users… | |
| CVE-2026-81156 | 11 Oct 2026 | CVSS 6.8 | Unknown Robo GalleryThe Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit… | |
| CVE-2026-81420 | 11 Oct 2026 | CVSS 8.6 | Unknown Tcard WPThe Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated… | |
| CVE-2026-81649 | 11 Oct 2026 | CVSS 9.1 | Unknown Fundiin cho WooCommerceThe Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a… | |
| CVE-2026-84251 | 11 Oct 2026 | CVSS 9.8 | Unknown click5 CRM add-on to Ninja FormsThe click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST… | |
| CVE-2026-84252 | 11 Oct 2026 | CVSS 9.8 | Unknown click5 CRM add-on to WPFormsThe click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST… | |
| CVE-2026-107507 | 11 Oct 2026 | CVSS 2.7 | Unknown SquadenoThe Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier… | |
| CVE-2026-107694 | 11 Oct 2026 | CVSS 2.7 | Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace SolutionThe Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission… | |
| CVE-2026-108540 | 11 Oct 2026 | CVSS 9.9 | OpenSpug SpugA flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer… | |
| CVE-2026-108541 | 11 Oct 2026 | CVSS 6.3 | highwarden Super Store FinderA vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file… | |
| CVE-2026-12980 | 11 Oct 2026 | CVSS 6.8 | Unknown Post SnippetsThe Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing… | |
| CVE-2026-103694 | 11 Oct 2026 | CVSS 8.8 | Unknown Mobile builderThe Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST… | |
| CVE-2026-103695 | 11 Oct 2026 | CVSS 8.6 | Unknown Mobile builderThe Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing… | |
| CVE-2026-104028 | 11 Oct 2026 | CVSS 9.8 | Unknown Anton ExtensionsThe Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing… | |
| CVE-2026-104680 | 11 Oct 2026 | CVSS 7.2 | Unknown Envira GalleryThe Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery… | |
| CVE-2026-104681 | 11 Oct 2026 | CVSS 2.7 | Unknown Envira GalleryThe Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller… | |
| CVE-2026-104682 | 11 Oct 2026 | CVSS 2.7 | Unknown Envira GalleryThe Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the… | |
| CVE-2026-104684 | 11 Oct 2026 | CVSS 2.7 | Unknown Envira GalleryThe Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors… | |
| CVE-2026-106029 | 11 Oct 2026 | CVSS 7.5 | Unknown WeddingCity LiteThe WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media… | |
| CVE-2026-103305 | 11 Oct 2026 | CVSS 8.8 | Unknown PrenotazioniThe Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of… | |
| CVE-2026-108538 | 11 Oct 2026 | CVSS 6.3 | GPACA security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the… | |
| CVE-2026-108539 | 11 Oct 2026 | CVSS 6.3 | GPACA vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component… | |
| CVE-2026-108523 | 11 Oct 2026 | CVSS 4.3 | Studio-Saelix SenchoA vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the… | |
| CVE-2026-108522 | 11 Oct 2026 | CVSS 8.3 | Studio-Saelix SenchoA vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login… | |
| CVE-2026-108521 | 11 Oct 2026 | CVSS 4.7 | Studio-Saelix SenchoA vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file… | |
| CVE-2026-108705 | 11 Oct 2026 | CVSS 4.3 | 1Panel-dev CordysCRMCordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users… | |
| CVE-2026-108706 | 11 Oct 2026 | CVSS 4.3 | elunez eladmineladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to… | |
| CVE-2026-108707 | 11 Oct 2026 | CVSS 9.8 | WuKongOpenSource Wukong_HRMWukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every… | |
| CVE-2026-108708 | 11 Oct 2026 | CVSS 8.8 | WuKongOpenSource Wukong_HRMWukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator… | |
| CVE-2026-108696 | 11 Oct 2026 | CVSS 4.3 | CoreUnion CoreShopCoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other… | |
| CVE-2026-108700 | 11 Oct 2026 | CVSS 6.5 | 1Panel-dev CordysCRM1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling… | |
| CVE-2026-108701 | 11 Oct 2026 | CVSS 4.3 | 1Panel-dev CordysCRM1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST… | |
| CVE-2026-108702 | 11 Oct 2026 | CVSS 4.3 | 1Panel-dev CordysCRM1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to… | |
| CVE-2026-108703 | 11 Oct 2026 | CVSS 5.4 | 1Panel-dev CordysCRMCordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any… | |
| CVE-2026-108704 | 11 Oct 2026 | CVSS 4.3 | 1Panel-dev CordysCRMCordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by… | |
| CVE-2026-108690 | 11 Oct 2026 | CVSS 4.3 | gz-yami mall4jmall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an… | |
| CVE-2026-108691 | 11 Oct 2026 | CVSS 5.4 | gz-yami mall4jmall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart… | |
| CVE-2026-108692 | 11 Oct 2026 | CVSS 6.5 | 1Panel-dev CordysCRM1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source… | |
| CVE-2026-108693 | 11 Oct 2026 | CVSS 7.0 | ImageMagickImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches… | |
| CVE-2026-108694 | 11 Oct 2026 | CVSS 6.5 | C4illin ConvertXConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because… | |
| CVE-2026-108695 | 11 Oct 2026 | CVSS 7.1 | MultiVendorXMultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide… | |
| CVE-2026-108689 | 11 Oct 2026 | CVSS 5.4 | WuKongOpenSource Wukong AICRMWukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat… | |
| CVE-2026-108688 | 11 Oct 2026 | CVSS 4.3 | elunez eladminEladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged… | |
| CVE-2026-108679 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any… | |
| CVE-2026-108680 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling… | |
| CVE-2026-108672 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows… | |
| CVE-2026-108673 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated… | |
| CVE-2026-108674 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged… | |
| CVE-2026-108675 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged… | |
| CVE-2026-108676 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows… | |
| CVE-2026-108677 | 10 Oct 2026 | CVSS 6.5 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users… | |
| CVE-2026-108678 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated… | |
| CVE-2026-108665 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user… | |
| CVE-2026-108666 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any… | |
| CVE-2026-108667 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt… | |
| CVE-2026-108668 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any… | |
| CVE-2026-108669 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro… | |
| CVE-2026-108670 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any… |
Page 91 of 168