[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96332 | 9 Oct 2026 | CVSS 7.1 | yalla ya! Simple PaymentImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows… | |
| CVE-2026-96333 | 9 Oct 2026 | CVSS 7.5 | Liquid Web / StellarWP GiveWPAuthentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a… | |
| CVE-2026-96334 | 9 Oct 2026 | CVSS 5.6 | ThemeGrill User RegistrationMissing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-96336 | 9 Oct 2026 | CVSS 7.5 | WPMU DEV ForminatorAuthentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a… | |
| CVE-2026-96337 | 9 Oct 2026 | CVSS 6.5 | properfraction ProfilePressMissing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-95608 | 9 Oct 2026 | CVSS 7.1 | PluginUs.Net HUSKYImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter… | |
| CVE-2026-95609 | 9 Oct 2026 | CVSS 7.1 | David Lingren Media LIbrary AssistantImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant… | |
| CVE-2026-95610 | 9 Oct 2026 | CVSS 8.5 | UpSolution CoreImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind… | |
| CVE-2026-96327 | 9 Oct 2026 | CVSS 9.3 | VibeThemes WPLMSImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL… | |
| CVE-2026-96328 | 9 Oct 2026 | CVSS 9.3 | jegtheme JNews - Pay WriterImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer… | |
| CVE-2026-96329 | 9 Oct 2026 | CVSS 8.5 | tagDiv Opt-In BuilderImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription… | |
| CVE-2026-96330 | 9 Oct 2026 | CVSS 9.3 | tagDiv Opt-In BuilderImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription… | |
| CVE-2026-95589 | 9 Oct 2026 | CVSS 6.5 | Magepeople inc. Deposits and Partial Payments for WooCommerceMissing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce… | |
| CVE-2026-95591 | 9 Oct 2026 | CVSS 7.1 | e4jvikwp VikBooking Hotel Booking Engine & PMSImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS… | |
| CVE-2026-95596 | 9 Oct 2026 | CVSS 7.1 | Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder AddonsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor… | |
| CVE-2026-95597 | 9 Oct 2026 | CVSS 6.5 | codemstory 워드프레스 결제 심플페이Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-95598 | 9 Oct 2026 | CVSS 7.1 | codepeople Search in PlaceImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place… | |
| CVE-2026-95599 | 9 Oct 2026 | CVSS 8.5 | TaskbuilderImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows… | |
| CVE-2026-95607 | 9 Oct 2026 | CVSS 8.5 | VibeThemes WPLMSImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL… | |
| CVE-2026-94641 | 9 Oct 2026 | CVSS 7.1 | Stiofan UsersWPImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected… | |
| CVE-2026-94661 | 9 Oct 2026 | CVSS 7.1 | Crocoblock JetBlogImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected… | |
| CVE-2026-94663 | 9 Oct 2026 | CVSS 8.5 | Metagauss ProfileGridImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid… | |
| CVE-2026-94664 | 9 Oct 2026 | CVSS 7.5 | add-ons.org PDF for Contact Form 7Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7… | |
| CVE-2026-94665 | 9 Oct 2026 | CVSS 6.5 | Mamunur Rashid Classified ListingImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing… | |
| CVE-2026-94666 | 9 Oct 2026 | CVSS 7.5 | ZealousWeb Generate PDF using Contact Form 7Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7… | |
| CVE-2026-94667 | 9 Oct 2026 | CVSS 6.5 | Crocoblock JetReviewsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored… | |
| CVE-2026-94668 | 9 Oct 2026 | CVSS 7.1 | Dimitri Grassi Salon booking systemImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system… | |
| CVE-2026-94166 | 9 Oct 2026 | CVSS 7.1 | UpSolution CoreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows… | |
| CVE-2026-94167 | 9 Oct 2026 | CVSS 7.1 | Extend Themes Kubio AI Page BuilderImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio… | |
| CVE-2026-94170 | 9 Oct 2026 | CVSS 7.1 | Heateor Support Sassy Social ShareImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share… | |
| CVE-2026-94415 | 9 Oct 2026 | CVSS 7.1 | Muffingroup BethemeImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected… | |
| CVE-2026-94503 | 9 Oct 2026 | CVSS 10.0 | PX-lab ZombifyUnrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects… | |
| CVE-2026-94568 | 9 Oct 2026 | CVSS 7.2 | WP Hosting AS Pay with Vipps for WooCommerceDeserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects… | |
| CVE-2026-94632 | 9 Oct 2026 | CVSS 7.1 | Stiofan BlockStrap Page Builder - Bootstrap BlocksImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap… | |
| CVE-2026-78339 | 9 Oct 2026 | CVSS 7.1 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource… | |
| CVE-2026-78340 | 9 Oct 2026 | CVSS 6.7 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pathname to a Restricted… | |
| CVE-2026-78341 | 9 Oct 2026 | CVSS 7.2 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged… | |
| CVE-2026-93947 | 9 Oct 2026 | CVSS 9.3 | Shinetheme TravelerImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL… | |
| CVE-2026-94158 | 9 Oct 2026 | CVSS 7.1 | bkninja Gloria Admin PanelImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel… | |
| CVE-2026-94159 | 9 Oct 2026 | CVSS 7.1 | KlbTheme Total DonationsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows… | |
| CVE-2026-94161 | 9 Oct 2026 | CVSS 7.1 | ThemeGoods Grand RestaurantImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant… | |
| CVE-2026-62049 | 9 Oct 2026 | CVSS 6.5 | Crocoblock JetBlocks For ElementorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks… | |
| CVE-2026-71884 | 9 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. BC-LTS-JAVAIn Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter… | |
| CVE-2026-78023 | 9 Oct 2026 | CVSS 8.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key… | |
| CVE-2026-78024 | 9 Oct 2026 | CVSS 8.7 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high… | |
| CVE-2026-78025 | 9 Oct 2026 | CVSS 7.5 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function… | |
| CVE-2026-78026 | 9 Oct 2026 | CVSS 8.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key… | |
| CVE-2026-78027 | 9 Oct 2026 | CVSS 6.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high… | |
| CVE-2026-107935 | 9 Oct 2026 | CVSS 9.3 | Red Hat Build of Podman DesktopA path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated… | |
| CVE-2026-84224 | 9 Oct 2026 | CVSS 4.1 | Unknown KirkiThe Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access… | |
| CVE-2026-78018 | 9 Oct 2026 | CVSS 7.1 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default… | |
| CVE-2026-78019 | 9 Oct 2026 | CVSS 8.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere… | |
| CVE-2026-78020 | 9 Oct 2026 | CVSS 8.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An… | |
| CVE-2026-78021 | 9 Oct 2026 | CVSS 5.3 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive… | |
| CVE-2026-78022 | 9 Oct 2026 | CVSS 8.1 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low… | |
| CVE-2026-84220 | 9 Oct 2026 | CVSS 4.8 | Unknown KirkiThe Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments… | |
| CVE-2026-107655 | 9 Oct 2026 | CVSS 4.0 | Red Hat Hardened ImagesA flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes… | |
| CVE-2026-76769 | 9 Oct 2026 | CVSS 8.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability. A low privileged… | |
| CVE-2026-76779 | 9 Oct 2026 | CVSS 9.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts… | |
| CVE-2026-78013 | 9 Oct 2026 | CVSS 6.3 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default… | |
| CVE-2026-78015 | 9 Oct 2026 | CVSS 5.3 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An… | |
| CVE-2026-78016 | 9 Oct 2026 | CVSS 4.3 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input… | |
| CVE-2026-78017 | 9 Oct 2026 | CVSS 3.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions… | |
| CVE-2026-104635 | 9 Oct 2026 | CVSS 8.2 | elixir-protobuf protobufUncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the… | |
| CVE-2026-98377 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in __vlan_insert_inner_tag()… | |
| CVE-2026-98378 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: bpf: Skip unsettled links in link iterator bpf_link_prime() inserts a link into… | |
| CVE-2026-98379 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rpfilter: reject routes without inet6_dev ip6_route_lookup() can… | |
| CVE-2026-98380 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcf_action_delete()… | |
| CVE-2026-98381 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth_set_channels() tears… | |
| CVE-2026-98382 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices __bpf_offload_dev_match()… | |
| CVE-2026-98383 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can… | |
| CVE-2026-98384 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() sk_protocol… | |
| CVE-2026-19575 | 9 Oct 2026 | CVSS 7.8 | zephyrproject zephyrThe user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with… | |
| CVE-2026-4264 | 9 Oct 2026 | CVSS 5.1 | BeeTienda eCommerce PlatformReflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack… | |
| CVE-2026-97075 | 9 Oct 2026 | CVSS 6.5 | WP Media WP RocketMissing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-98375 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header… | |
| CVE-2026-98376 | 9 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement… | |
| CVE-2025-14123 | 9 Oct 2026 | CVSS 6.8 | davidanderson Redux FrameworkThe Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the… | |
| CVE-2026-106145 | 9 Oct 2026 | CVSS 7.1 | Progress Software Telerik Report ServerIn Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an… | |
| CVE-2026-106155 | 9 Oct 2026 | CVSS 8.9 | Progress Software Telerik Report ServerIn Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows… | |
| CVE-2026-19569 | 9 Oct 2026 | CVSS 8.8 | zephyrproject zephyrdynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as… | |
| CVE-2026-19570 | 9 Oct 2026 | CVSS 8.8 | zephyrproject zephyrThe LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE)… | |
| CVE-2026-19571 | 9 Oct 2026 | CVSS 6.7 | zephyrproject zephyrThe ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request… | |
| CVE-2026-19574 | 9 Oct 2026 | CVSS 7.0 | zephyrproject zephyrThe ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init()… | |
| CVE-2026-92989 | 9 Oct 2026 | CVSS 4.3 | Unknown SendPress NewslettersThe SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing… | |
| CVE-2026-92990 | 9 Oct 2026 | CVSS 5.3 | Unknown SendPress NewslettersThe SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather… | |
| CVE-2026-93548 | 9 Oct 2026 | CVSS 8.8 | Unknown FooSalesThe FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any… | |
| CVE-2026-97076 | 9 Oct 2026 | CVSS 7.5 | WP Media WP RocketExecutable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before… | |
| CVE-2026-81929 | 9 Oct 2026 | CVSS 7.2 | OceanWP Ocean Pro DemosThe Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in… | |
| CVE-2026-86850 | 9 Oct 2026 | CVSS 6.5 | Unknown SKU Error Fixer for WooCommerceThe SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which… | |
| CVE-2026-87841 | 9 Oct 2026 | CVSS 5.3 | Unknown UnitechPayThe UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated… | |
| CVE-2026-88931 | 9 Oct 2026 | CVSS 5.3 | Unknown Social Web SuiteThe Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint… | |
| CVE-2026-101028 | 9 Oct 2026 | CVSS 6.0 | ash-project ashIncorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2… | |
| CVE-2026-106095 | 9 Oct 2026 | CVSS 3.3 | Unknown Code SnippetsThe Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network… | |
| CVE-2026-106097 | 9 Oct 2026 | CVSS 6.8 | Unknown Code SnippetsThe Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its… | |
| CVE-2025-15700 | 9 Oct 2026 | CVSS 8.8 | Unknown AWP ClassifiedsThe AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its… | |
| CVE-2026-87109 | 9 Oct 2026 | CVSS 6.5 | MongoDB Ops ManagerAn authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints… | |
| CVE-2026-87110 | 9 Oct 2026 | CVSS 5.3 | MongoDB Ops ManagerAn unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without… | |
| CVE-2026-107909 | 9 Oct 2026 | CVSS 9.1 | FalkorDBA heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB… | |
| CVE-2026-107910 | 9 Oct 2026 | CVSS 8.1 | FalkorDBAn improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote… |
Page 98 of 168