Search
105 CVEs · published 2026-10-17 to 2026-10-17
CVEs (105)
Showing 1–25 of 105
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-111823 | CRITICAL | Patched | 9.8 | 2026-10-17 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. |
| CVE-2026-111853 | HIGH | Patched | 8.8 | 2026-10-17 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. In… |
| CVE-2026-111854 | HIGH | Patched | 8.1 | 2026-10-17 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to … |
| CVE-2026-111855 | HIGH | Patched | 7.5 | 2026-10-17 | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient v… |
| CVE-2026-104734 | HIGH | 7.2 | 2026-10-17 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via d… | |
| CVE-2026-107762 | HIGH | 7.5 | 2026-10-17 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,… | |
| CVE-2026-107763 | MEDIUM | 4.3 | 2026-10-17 | The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly veri… | |
| CVE-2026-109208 | HIGH | 7.2 | 2026-10-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_… | |
| CVE-2026-110653 | CRITICAL | 9.1 | 2026-10-17 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versi… | |
| CVE-2026-111601 | MEDIUM | 6.1 | 2026-10-17 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including… | |
| CVE-2026-111602 | LOW | 3.7 | 2026-10-17 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,… | |
| CVE-2026-103899 | HIGH | 7.2 | 2026-10-17 | The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, … | |
| CVE-2026-104736 | CRITICAL | 9.8 | 2026-10-17 | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout… | |
| CVE-2026-107744 | MEDIUM | 6.5 | 2026-10-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.… | |
| CVE-2026-107752 | MEDIUM | 4.9 | 2026-10-17 | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all vers… | |
| CVE-2026-108123 | HIGH | 7.5 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin … | |
| CVE-2026-109368 | MEDIUM | 6.5 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' par… | |
| CVE-2026-109369 | MEDIUM | 6.8 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin … | |
| CVE-2026-109985 | MEDIUM | 6.4 | 2026-10-17 | The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all ve… | |
| CVE-2026-109989 | MEDIUM | 6.4 | 2026-10-17 | The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to … | |
| CVE-2026-110268 | MEDIUM | 4.9 | 2026-10-17 | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. Thi… | |
| CVE-2026-111726 | MEDIUM | 6.4 | 2026-10-17 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to i… | |
| CVE-2026-92715 | MEDIUM | Patched | 4.3 | 2026-10-17 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via … |
| CVE-2026-92798 | HIGH | 8.1 | 2026-10-17 | The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient i… | |
| CVE-2026-92978 | MEDIUM | 4.3 | 2026-10-17 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPres… |