Total
414839 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-94123 | 2026-09-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions. | |||||
| CVE-2026-94122 | 2026-09-30 | N/A | 7.2 HIGH | ||
| Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. | |||||
| CVE-2026-94121 | 2026-09-30 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions. | |||||
| CVE-2026-94120 | 2026-09-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions. | |||||
| CVE-2026-94115 | 2026-09-30 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. | |||||
| CVE-2026-94082 | 2026-09-30 | N/A | 7.6 HIGH | ||
| Author SQL Injection in Quiz Cat <= 3.1.1 versions. | |||||
| CVE-2026-94081 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions. | |||||
| CVE-2026-94078 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions. | |||||
| CVE-2026-94077 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions. | |||||
| CVE-2026-94076 | 2026-09-30 | N/A | 8.8 HIGH | ||
| Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions. | |||||
| CVE-2026-94074 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions. | |||||
| CVE-2026-93771 | 2026-09-30 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions. | |||||
| CVE-2026-93770 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions. | |||||
| CVE-2026-93651 | 2026-09-30 | N/A | 7.2 HIGH | ||
| Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions. | |||||
| CVE-2026-93624 | 2026-09-30 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions. | |||||
| CVE-2026-93621 | 2026-09-30 | N/A | 8.2 HIGH | ||
| Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. | |||||
| CVE-2026-93514 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions. | |||||
| CVE-2026-93512 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions. | |||||
| CVE-2026-81867 | 2026-09-30 | N/A | N/A | ||
| A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially crafted script bypassing param guards. This vulnerability was patched on 28 June 2026, and no customer action is needed. | |||||
| CVE-2026-7172 | 2026-09-30 | N/A | N/A | ||
| Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=com_virtuemart&page=admin.user_list'. Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent. | |||||