Search
105 CVEs · published 2026-10-17 to 2026-10-17
CVEs (105)
Showing 51–75 of 105
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-111887 | MEDIUM | Patched | 5.3 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display na… |
| CVE-2026-111886 | HIGH | Patched | 6.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP … |
| CVE-2026-111885 | HIGH | Patched | 5.5 | 2026-10-17 | phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target gro… |
| CVE-2026-111884 | HIGH | Patched | 8.3 | 2026-10-17 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::upd… |
| CVE-2026-111882 | HIGH | Patched | 8.1 | 2026-10-17 | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-fac… |
| CVE-2026-111881 | HIGH | Patched | 7.6 | 2026-10-17 | FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-by… |
| CVE-2026-111880 | HIGH | Patched | 7.4 | 2026-10-17 | FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated at… |
| CVE-2026-110882 | MEDIUM | 4.3 | 2026-10-17 | Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Se… | |
| CVE-2025-71435 | LOW | Patched | 4.2 | 2026-10-17 | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is iss… |
| CVE-2024-58398 | MEDIUM | Patched | 4.3 | 2026-10-17 | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is … |
| CVE-2026-109701 | HIGH | 7.1 | 2026-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflec… | |
| CVE-2026-110889 | HIGH | 7.5 | 2026-10-17 | Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects G… | |
| CVE-2026-111110 | HIGH | 7.2 | 2026-10-17 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all… | |
| CVE-2026-110253 | MEDIUM | 5.4 | 2026-10-17 | The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation… | |
| CVE-2026-109983 | MEDIUM | 6.4 | 2026-10-17 | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due … | |
| CVE-2026-100316 | HIGH | 7.2 | 2026-10-17 | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and i… | |
| CVE-2026-110384 | HIGH | 7.1 | 2026-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allow… | |
| CVE-2026-97314 | MEDIUM | Patched | 6.5 | 2026-10-17 | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthentica… |
| CVE-2026-92433 | MEDIUM | Patched | 6.5 | 2026-10-17 | The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-li… |
| CVE-2026-92432 | MEDIUM | Patched | 4.3 | 2026-10-17 | The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitor… |
| CVE-2026-92431 | LOW | Patched | 3.7 | 2026-10-17 | The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of te… |
| CVE-2026-91074 | MEDIUM | 6.8 | 2026-10-17 | The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated use… | |
| CVE-2026-81344 | MEDIUM | 6.6 | 2026-10-17 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that … | |
| CVE-2026-81343 | MEDIUM | 5.3 | 2026-10-17 | The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted val… | |
| CVE-2026-110527 | MEDIUM | Patched | 5.3 | 2026-10-17 | The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step f… |