Total
417694 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-94175 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. | |||||
| CVE-2026-116847 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. | |||||
| CVE-2026-54854 | 2026-10-30 | N/A | 6.3 MEDIUM | ||
| Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | |||||
| CVE-2026-116410 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. | |||||
| CVE-2026-116853 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | |||||
| CVE-2026-39786 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. | |||||
| CVE-2026-39739 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5. | |||||
| CVE-2026-115604 | 2026-10-30 | N/A | 5.0 MEDIUM | ||
| Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. | |||||
| CVE-2026-104674 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31. | |||||
| CVE-2026-90888 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | |||||
| CVE-2026-62019 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6. | |||||
| CVE-2026-52710 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5. | |||||
| CVE-2026-116854 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. | |||||
| CVE-2026-119620 | 2026-10-30 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-39734 | 2026-10-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. | |||||
| CVE-2026-73186 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. | |||||
| CVE-2026-62057 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0. | |||||
| CVE-2026-27061 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | |||||
| CVE-2026-118090 | 2026-10-30 | N/A | 8.8 HIGH | ||
| Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | |||||
| CVE-2026-119619 | 2026-10-30 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||