[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108671 | 10 Oct 2026 | CVSS 6.5 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because… | |
| CVE-2026-108658 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any… | |
| CVE-2026-108659 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any… | |
| CVE-2026-108660 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT… | |
| CVE-2026-108661 | 10 Oct 2026 | CVSS 6.5 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST… | |
| CVE-2026-108662 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant… | |
| CVE-2026-108663 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated… | |
| CVE-2026-108664 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged… | |
| CVE-2026-108651 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows… | |
| CVE-2026-108652 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated… | |
| CVE-2026-108653 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any… | |
| CVE-2026-108654 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged… | |
| CVE-2026-108655 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged… | |
| CVE-2026-108656 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint… | |
| CVE-2026-108657 | 10 Oct 2026 | CVSS 8.1 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated… | |
| CVE-2026-108644 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController delete handler that allows any authenticated user… | |
| CVE-2026-108645 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category… | |
| CVE-2026-108646 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated… | |
| CVE-2026-108647 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules… | |
| CVE-2026-108648 | 10 Oct 2026 | CVSS 6.5 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController… | |
| CVE-2026-108649 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets… | |
| CVE-2026-108650 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any… | |
| CVE-2026-108638 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via… | |
| CVE-2026-108639 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via… | |
| CVE-2026-108640 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission… | |
| CVE-2026-108641 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users'… | |
| CVE-2026-108642 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify… | |
| CVE-2026-108643 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary… | |
| CVE-2026-108631 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged… | |
| CVE-2026-108632 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any… | |
| CVE-2026-108633 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission… | |
| CVE-2026-108634 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission… | |
| CVE-2026-108635 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController… | |
| CVE-2026-108636 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any… | |
| CVE-2026-108637 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by… | |
| CVE-2026-108624 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged… | |
| CVE-2026-108625 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records… | |
| CVE-2026-108626 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged… | |
| CVE-2026-108627 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated… | |
| CVE-2026-108628 | 10 Oct 2026 | CVSS 8.1 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that… | |
| CVE-2026-108629 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any… | |
| CVE-2026-108630 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify… | |
| CVE-2026-108617 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by… | |
| CVE-2026-108618 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via… | |
| CVE-2026-108619 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via… | |
| CVE-2026-108620 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated… | |
| CVE-2026-108621 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user… | |
| CVE-2026-108622 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to… | |
| CVE-2026-108623 | 10 Oct 2026 | CVSS 7.1 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user… | |
| CVE-2026-108611 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated… | |
| CVE-2026-108612 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows… | |
| CVE-2026-108613 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user… | |
| CVE-2026-108614 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated… | |
| CVE-2026-108615 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged… | |
| CVE-2026-108616 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any… | |
| CVE-2026-108605 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user… | |
| CVE-2026-108606 | 10 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user… | |
| CVE-2026-108607 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video… | |
| CVE-2026-108608 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice… | |
| CVE-2026-108609 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice… | |
| CVE-2026-108610 | 10 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated… | |
| CVE-2026-78533 | 10 Oct 2026 | CVSS 9.8 | AncoraThemes QweryUnauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | |
| CVE-2026-78534 | 10 Oct 2026 | CVSS 7.1 | Keen IT Solutions EducavoUnauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. | |
| CVE-2026-78535 | 10 Oct 2026 | CVSS 9.8 | ThemeRex PhotoliaUnauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | |
| CVE-2026-81797 | 10 Oct 2026 | CVSS 9.8 | ThemeRex Buzz Stone | Magazine & Viral Blog WordPress ThemeUnauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | |
| CVE-2026-97853 | 10 Oct 2026 | CVSS 6.9 | ericmj decimalMemory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the… | |
| CVE-2026-66566 | 10 Oct 2026 | CVSS 8.1 | Elated-Themes AmbientUnauthenticated Local File Inclusion in Ambient <= 1.7 versions. | |
| CVE-2026-66567 | 10 Oct 2026 | CVSS 9.8 | AncoraThemes AnestaUnauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. | |
| CVE-2026-66568 | 10 Oct 2026 | CVSS 9.8 | axiomthemes OriginalUnauthenticated PHP Object Injection in Original <= 1.9.0 versions. | |
| CVE-2026-66569 | 10 Oct 2026 | CVSS 9.8 | axiomthemes KickerUnauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | |
| CVE-2026-78529 | 10 Oct 2026 | CVSS 9.8 | ThemeREX AllianceUnauthenticated PHP Object Injection in Alliance <= 3.11 versions. | |
| CVE-2026-78530 | 10 Oct 2026 | CVSS 7.7 | Chimpstudio FoodBakerySubscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. | |
| CVE-2026-78531 | 10 Oct 2026 | CVSS 9.8 | ThemeREX JacquelineUnauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | |
| CVE-2026-78532 | 10 Oct 2026 | CVSS 7.1 | designthemes LMSUnauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. | |
| CVE-2026-65459 | 10 Oct 2026 | CVSS 7.5 | WPMU DEV ForminatorUnauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. | |
| CVE-2026-66480 | 10 Oct 2026 | CVSS 5.3 | YITH WooCommerce Product Add-OnsExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve… | |
| CVE-2026-66481 | 10 Oct 2026 | CVSS 6.8 | Presto Player ProAuthor Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions. | |
| CVE-2026-66482 | 10 Oct 2026 | CVSS 9.8 | AncoraThemes Drone MediaUnauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. | |
| CVE-2026-66483 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Education CenterUnauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. | |
| CVE-2026-66563 | 10 Oct 2026 | CVSS 9.8 | ThemeREX WindsorUnauthenticated PHP Object Injection in Windsor <= 2.10 versions. | |
| CVE-2026-66564 | 10 Oct 2026 | CVSS 9.8 | ThemeREX ShiftCVUnauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. | |
| CVE-2026-66565 | 10 Oct 2026 | CVSS 9.8 | axiomthemes FC UnitedUnauthenticated PHP Object Injection in FC United <= 1.1.1 versions. | |
| CVE-2026-62117 | 10 Oct 2026 | CVSS 8.5 | Dmitry V. Barcode Scanner with Inventory & Order ManagerSubscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | |
| CVE-2026-62118 | 10 Oct 2026 | CVSS 7.3 | Dmitry V. Barcode Scanner with Inventory & Order ManagerUnauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | |
| CVE-2026-62120 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Law OfficeUnauthenticated PHP Object Injection in Law Office <= 3.20 versions. | |
| CVE-2026-62123 | 10 Oct 2026 | CVSS 9.8 | ThemeREX InvetexUnauthenticated PHP Object Injection in Invetex <= 2.18 versions. | |
| CVE-2026-62124 | 10 Oct 2026 | CVSS 9.8 | ThemeREX N7 | Golf Club Sports & EventsUnauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. | |
| CVE-2026-62125 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Asia GardenUnauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. | |
| CVE-2026-62129 | 10 Oct 2026 | CVSS 9.9 | WPFunnels Creator LMSContributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. | |
| CVE-2026-62130 | 10 Oct 2026 | CVSS 7.2 | Amir Helzer WooCommerce Multilingual & MulticurrencyShop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions. | |
| CVE-2026-62094 | 10 Oct 2026 | CVSS 8.1 | kutethemes TechOneUnauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. | |
| CVE-2026-62095 | 10 Oct 2026 | CVSS 7.1 | kutethemes BiolifeUnauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions. | |
| CVE-2026-62096 | 10 Oct 2026 | CVSS 8.1 | kutethemes BiolifeUnauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. | |
| CVE-2026-62098 | 10 Oct 2026 | CVSS 6.5 | kutethemes BoutiqueUnauthenticated Content Injection in Boutique <= 2.3.3 versions. | |
| CVE-2026-62099 | 10 Oct 2026 | CVSS 8.1 | kutethemes BoutiqueUnauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. | |
| CVE-2026-62100 | 10 Oct 2026 | CVSS 7.1 | kutethemes KuteShopUnauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions. | |
| CVE-2026-62115 | 10 Oct 2026 | CVSS 8.1 | kutethemes KuteShopUnauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. | |
| CVE-2026-62116 | 10 Oct 2026 | CVSS 7.1 | Dmitry V. Barcode Scanner with Inventory & Order ManagerUnauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | |
| CVE-2026-62076 | 10 Oct 2026 | CVSS 9.8 | The4 KallesUnauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions. | |
| CVE-2026-62077 | 10 Oct 2026 | CVSS 9.8 | BoldThemes AvalaUnauthenticated PHP Object Injection in Avala <= 1.1.4 versions. |
Page 92 of 168