Search
98,287 CVEs
CVEs (98,287, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 451–475 of 98,287 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-94268 | HIGH | Patched | 8.1 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not resolve the target of th… |
| CVE-2026-94267 | CRITICAL | Patched | 9.0 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability c… |
| CVE-2026-94264 | MEDIUM | Patched | 6.8 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some … |
| CVE-2026-94262 | HIGH | Patched | 8.1 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not verify that the requeste… |
| CVE-2026-113501 | LOW | Patched | 3.1 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the … |
| CVE-2026-113500 | HIGH | Patched | 7.5 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an att… |
| CVE-2026-113499 | HIGH | Patched | 7.5 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attri… |
| CVE-2026-113472 | MEDIUM | Patched | 5.4 | 2026-10-23 | The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-… |
| CVE-2026-112230 | LOW | Patched | 3.7 | 2026-10-23 | The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated r… |
| CVE-2026-112219 | MEDIUM | Patched | 4.9 | 2026-10-23 | The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrat… |
| CVE-2026-111982 | HIGH | Patched | 7.2 | 2026-10-23 | The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, … |
| CVE-2026-111966 | MEDIUM | Patched | 6.8 | 2026-10-23 | The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which … |
| CVE-2026-111738 | MEDIUM | Patched | 5.5 | 2026-10-23 | The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict whi… |
| CVE-2026-111737 | LOW | Patched | 3.5 | 2026-10-23 | The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow… |
| CVE-2026-110537 | LOW | Patched | 3.8 | 2026-10-23 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts targeted by its login-approval… |
| CVE-2026-110510 | LOW | Patched | 3.5 | 2026-10-23 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using it to build markup, which could… |
| CVE-2026-109936 | HIGH | Patched | 7.5 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can … |
| CVE-2026-109935 | NONE | Patched | — | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing … |
| CVE-2026-109934 | MEDIUM | Patched | 5.3 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, trea… |
| CVE-2026-109933 | MEDIUM | Patched | 6.8 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allo… |
| CVE-2026-107858 | HIGH | Patched | — | 2026-10-23 | Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Age… |
| CVE-2026-86055 | HIGH | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emai… |
| CVE-2026-86020 | MEDIUM | Patched | 4.6 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in … |
| CVE-2026-86019 | MEDIUM | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured ma… |
| CVE-2026-86018 | MEDIUM | Patched | — | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximu… |