Total
417702 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-62003 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | |||||
| CVE-2026-61998 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | |||||
| CVE-2026-61997 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | |||||
| CVE-2026-61996 | 2026-10-30 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. | |||||
| CVE-2026-61992 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | |||||
| CVE-2026-61991 | 2026-10-30 | N/A | 10.0 CRITICAL | ||
| Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | |||||
| CVE-2026-61989 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | |||||
| CVE-2026-5461 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory. | |||||
| CVE-2026-57207 | 2026-10-30 | N/A | 5.9 MEDIUM | ||
| NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1. | |||||
| CVE-2026-54865 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. | |||||
| CVE-2026-54864 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | |||||
| CVE-2026-54860 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |||||
| CVE-2026-54857 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | |||||
| CVE-2026-54856 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | |||||
| CVE-2026-54852 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1. | |||||
| CVE-2026-42701 | 2026-10-30 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | |||||
| CVE-2026-42694 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. | |||||
| CVE-2026-42691 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0. | |||||
| CVE-2026-27394 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | |||||
| CVE-2026-27063 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7. | |||||