Search
4,651 CVEs
CVEs (4,651, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 126–150 of 4,651 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-110981 | HIGH | Patched | 7.1 | 2026-10-18 | The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its … |
| CVE-2026-111041 | MEDIUM | Patched | 4.9 | 2026-10-18 | The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted … |
| CVE-2026-111877 | LOW | 4.3 | 2026-10-18 | A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a … | |
| CVE-2026-111942 | LOW | 4.3 | 2026-10-18 | A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument S… | |
| CVE-2026-87844 | MEDIUM | 5.3 | 2026-10-18 | The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting req… | |
| CVE-2026-96534 | HIGH | Patched | 7.7 | 2026-10-18 | The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before usi… |
| CVE-2026-107436 | HIGH | 8.8 | 2026-10-18 | Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a… | |
| CVE-2026-108485 | HIGH | 7.1 | 2026-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStor… | |
| CVE-2026-109894 | CRITICAL | 9.3 | 2026-10-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Bo… | |
| CVE-2026-109895 | HIGH | 7.1 | 2026-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Bo… | |
| CVE-2026-110365 | MEDIUM | 6.5 | 2026-10-18 | Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This is… | |
| CVE-2026-110372 | CRITICAL | 9.8 | 2026-10-18 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. | |
| CVE-2026-110373 | HIGH | 8.1 | 2026-10-18 | Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone… | |
| CVE-2026-110382 | HIGH | 7.1 | 2026-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments all… | |
| CVE-2026-110383 | HIGH | 7.5 | 2026-10-18 | Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows … | |
| CVE-2026-110880 | MEDIUM | 6.5 | 2026-10-18 | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects K… | |
| CVE-2026-110883 | MEDIUM | 6.5 | 2026-10-18 | Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue aff… | |
| CVE-2026-110885 | MEDIUM | 6.5 | 2026-10-18 | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a throug… | |
| CVE-2026-110886 | CRITICAL | 9.8 | 2026-10-18 | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversatio… | |
| CVE-2026-110895 | HIGH | 8.5 | 2026-10-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This is… | |
| CVE-2026-110897 | HIGH | 7.1 | 2026-10-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-fo… | |
| CVE-2026-111984 | LOW | 4.3 | 2026-10-18 | A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of … | |
| CVE-2026-111985 | LOW | 4.3 | 2026-10-18 | A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of… | |
| CVE-2026-111998 | CRITICAL | 9.8 | 2026-10-18 | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admi… | |
| CVE-2026-111999 | HIGH | 7.5 | 2026-10-18 | Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway… |