CVEs published November 7, 2026
473 CVEs were published on November 7, 2026: 69 critical, 149 high. 1 is now in CISA KEV. 1 early warning was posted.
- Published
- 473
- Critical
- 69
- High
- 149
- Medium
- 233
- Low
- 9
- Unrated
- 13
- Now in CISA KEV
- 1
- Fix available
- 261
- Early warnings
- 1
Most affected products
- IBM API Connect
- 208
- Linux
- 14
- TOTOLINK CA300-PoE
- 9
- Directorist: AI-Powered Business Directory, Listings & Clas…
- 6
- fraunhoferhhi vvdec
- 6
- peterschulznl WP Data Access – App Builder for Tables, Form…
- 5
- tomdever wpForo Forum
- 5
- frappe erpnext
- 4
- Advanced Custom Fields
- 3
- artbees Jupiter X Core
- 3
Early warnings 1
Critical 69
- CVE-2026-124060TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflowTOTOLINK CA300-PoE
- CVE-2026-124059TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-124058TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-124057TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-123966Tenda AC19 saveParentControlInfo heap-based overflowTenda AC19
- CVE-2026-120984Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy importRed Hat Build of Keycloak · Red Hat Single Sign-On
- CVE-2026-122041Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via…Themehigh Checkout Field Editor for WooCommerce
- CVE-2026-123776RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks…RRD-CGI-Image
- CVE-2026-104014Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password…naimurrahmannahid Naimur Email OTP Verification for WooComm…
- CVE-2026-119075Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkoutthemegrill Registration Form for WooCommerce
- CVE-2026-118066Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in…Appointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-121265SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and updateSQL-Abstract
- CVE-2026-123961TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-123960TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-123959TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflowTOTOLINK CA300-PoE
- CVE-2026-123958TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-123957TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflowTOTOLINK CA300-PoE
- CVE-2026-121491Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host HeaderFiber Admin
- CVE-2026-121379Tournamatch < 4.7.1 - Subscriber+ Arbitrary File DeletionTournamatch
- CVE-2026-18535IBM API Connect Denial of ServiceIBM API Connect
- CVE-2026-18838Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-18836Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17410Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17409Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17408Multiple Vulnerabilities in IBM API ConnectIBM API Connect
Show all 69 entriesShow fewer entries
- CVE-2026-17403Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17402Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17399Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17396Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17394Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17392Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17360Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17359Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17354Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17353Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17344Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17342Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17340Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17339Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17338Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17336Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17329Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17313Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17301Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17299Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17298Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17297Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17296Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17292Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17278Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17239Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17158Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17150Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17147Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17146Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17134Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17132Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17131Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17117Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17066Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17049Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16920Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16918Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16884Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16720Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-123218IBM Aspera Faspex Authorization BypassIBM Aspera Faspex
- CVE-2026-19803Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' ParameterPrintcart Store – Web to Print Product Designer for WooComm…
- CVE-2026-17362Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-93754payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Executionpayever Checkout – Composable Payment Gateway
High 149
- CVE-2026-120531Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameterwedevs Subscribe2 – Form, Email Subscribers & Newsletters
- CVE-2026-124318Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fieldstreeio
- CVE-2026-124315Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_itemsfrappe erpnext
- CVE-2026-124314Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activitiesfrappe erpnext
- CVE-2026-99281tun: Require CAP_NET_ADMIN to attach to an ownerless deviceLinux
- CVE-2026-99277ksmbd: hold a connection reference for each session channelLinux
- CVE-2026-120839WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerabilityMagepeople WpTravelly
- CVE-2026-120841WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerabilityMagepeople WpTravelly
- CVE-2026-119156Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template…codename065 Download Manager
- CVE-2026-121765WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs TranslatePress
- CVE-2026-93429VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parametere4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2026-115548Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent HeaderQuttera ThreatSign – Web Malware Scanner for WordPress
- CVE-2026-111317JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Sourcejetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-109214User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Inputwedevs User Frontend – Membership, User Registration, User…
- CVE-2026-111370WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker…osamaesh WP Visitor Statistics
- CVE-2026-109991FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information…teamfunnelkit FunnelKit Payment Gateway for Stripe WooComme…
- CVE-2026-118267WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update…peterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-123418Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameterandy_moyle Church Admin
- CVE-2026-122231WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Valuewestguard WS Form LITE – Drag & Drop Contact Form Builder
- CVE-2026-109230WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameterosamaesh WP Visitor Statistics
- CVE-2026-93766Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' ParameterHappyforms Pro
- CVE-2026-104746Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Metastylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-104768AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Optionrubengc AutomatorWP – No-Code Workflow Automation, Integrat…
- CVE-2026-119183JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Metajetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-116751Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array KeysBooking for Appointments and Events Calendar – Amelia Pro
Show all 149 entriesShow fewer entries
- CVE-2026-116537Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameterjackdewey Link Library
- CVE-2026-93755Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For HeaderHappyforms Pro
- CVE-2026-121762WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerabilityBlubrry Podcasting PowerPress Podcasting
- CVE-2026-107616Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure…melograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-95870wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parametertomdever wpForo Forum
- CVE-2026-119164wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parametertomdever wpForo Forum
- CVE-2026-103900WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameterdenishua WPJAM Basic
- CVE-2026-119155wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parametertomdever wpForo Forum
- CVE-2026-66669WordPress Superb Addons: Blocks, Patterns & theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerabilitySuplugins Superb Addons: Blocks, Patterns & Theme Desig…
- CVE-2026-104738Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parametersnasirahmed Advanced Form Integration — Connect Forms to 300…
- CVE-2026-120537TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpointcozmoslabs TranslatePress – Translate Multilingual sites wi…
- CVE-2026-115811Strong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameterwpchill Strong Testimonials
- CVE-2026-122037AgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup WizardAgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi…
- CVE-2026-87112QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parametersquarka QA Assistants – Driven by data
- CVE-2026-116558Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widgetunitecms Unlimited Elements for Elementor
- CVE-2026-122001Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRFKomfortkasse for WooCommerce
- CVE-2026-121866Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option UpdateiLeads SMS Gateway by Exsile
- CVE-2026-121848Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link GenerationMagic Link
- CVE-2026-117525FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment PopupFV Flowplayer Video Player
- CVE-2026-17386Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17384Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-75590Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-19128Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-19121Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17411Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17407Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17406Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17405Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17404Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17401Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17400Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17398Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17397Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17388Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17387Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17385Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17383Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17382Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17381Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17380Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17379Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17378Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17376Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17375Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17374Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17373Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17365Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17363Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17361Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17358Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17357Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17356Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17355Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17352Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17345Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17343Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17341Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17337Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17335Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17334Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17333Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17332Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17331Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17330Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17328Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17327Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17326Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17325Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17324Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17323Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17322Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17321Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17320Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17319Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17318Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17316Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17311Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17309Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17295Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17294Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17293Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17291Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17290Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17289Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17288Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17287Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17285Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17284Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17283Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17282Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17281Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17280Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17279Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17244Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17228Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17190Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17188Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17187Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17172Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17129Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17112Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17108Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16912Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16880Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16854Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16718Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16717Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16716Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16715Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16714Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16712Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16709Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-105002Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-120043Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameteriovamihai Affiliate Program Suite — SliceWP Affiliates
- CVE-2026-119167TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE…cozmoslabs TranslatePress – Translate Multilingual sites wi…
- CVE-2026-120677Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment ContentOptimole – Optimize Images | Convert WebP & AVIF | CDN & La…
- CVE-2026-119158Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatargenetechproducts Pie Register – User Registration, Profiles…
- CVE-2026-120739Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset DescriptorOptimole – Optimize Images | Convert WebP & AVIF | CDN & La…
- CVE-2026-120540iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment…iubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…
- CVE-2026-119175Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment…gijo Flying Images: Optimize and Lazy Load Images for Faste…
- CVE-2026-104913Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.jsonesaia Interactive Real Estate – Floor Plan & Building Visua…
- CVE-2026-120082GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_contentpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-119070Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL ReplacerOptimole – Optimize Images | Convert WebP & AVIF | CDN & La…
- CVE-2026-120512Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field ValueForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
Medium, low and unrated 255
- CVE-2026-99284net: skbuff: propagate shared-frag marker in skb_zerocopy()Linux
- CVE-2026-99283netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packetsLinux
- CVE-2026-123472WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerabilityeLightUp Meta Box – WordPress Custom Fields Framework
- CVE-2026-119522WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerabilityThemeGrill User Registration
- CVE-2026-123461WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerabilityPluginUs.Net FOX
- CVE-2026-120836WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerabilityeLightUp Meta Box – WordPress Custom Fields Framework
- CVE-2026-124258WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerabilityThemeGrill User Registration
- CVE-2026-123992DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scriptingDataEase
- CVE-2026-123991DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted uploadDataEase
- CVE-2026-123990DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injectionDataEase
- CVE-2026-123989ESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permissionESEngine DeepSeek-Reasonix
- CVE-2026-124317libexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16libexpat
- CVE-2026-124316Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requestsfrappe erpnext
- CVE-2026-124313Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_docfrappe erpnext
- CVE-2026-124312Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfofraunhoferhhi vvdec
- CVE-2026-124311Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlkfraunhoferhhi vvdec
- CVE-2026-124310Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPicfraunhoferhhi vvdec
- CVE-2026-124309Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNestingfraunhoferhhi vvdec
- CVE-2026-124308Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufsfraunhoferhhi vvdec
- CVE-2026-124307Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinitionfraunhoferhhi vvdec
- CVE-2026-99282net/sched: sch_teql: fix use-after-free on lower qdisc dropLinux
- CVE-2026-99280ksmbd: drain session procfs readers before dropping table referencesLinux
- CVE-2026-99279ksmbd: reclaim ended sessions on logoff and expirationLinux
- CVE-2026-99278ksmbd: limit sessions on each connectionLinux
- CVE-2026-99276ksmbd: defer connection scavenging while session locks are busyLinux
Show all 255 entriesShow fewer entries
- CVE-2026-99275smb: client: reject short SESSION_SETUP responsesLinux
- CVE-2026-99274smb: client: fix fiemap wild read on empty truncated responseLinux
- CVE-2026-99273ksmbd: reserve space for the UTF-16 terminator in stream infoLinux
- CVE-2026-99272smb: client: validate the data area in SMB2_read()Linux
- CVE-2026-99271ALSA: line6: Clear prev_fbuf on capture buffer releaseLinux
- CVE-2026-123988SililaWijesinghe Food Ordering System admin exposure of information through directory listingSililaWijesinghe Food Ordering System
- CVE-2026-123860WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerabilityCrocoblock JetFormBuilder
- CVE-2026-123964OpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loopOpenBMB Internet of Agents
- CVE-2026-123861WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerabilityCrocoBlock JetFormBuilder – Hierarchical Select
- CVE-2026-121777WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerabilityCool Plugins Cool Formkit Lite
- CVE-2026-123467WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerabilityStylemixThemes Motors
- CVE-2026-122659WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerabilityWP ManageNinja Fluent Booking
- CVE-2026-121579WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerabilityUnlimited Elements For Elementor
- CVE-2026-121575WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerabilityWP User Manager
- CVE-2026-122660WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerabilityBAKKBONE Australia FloristPress
- CVE-2026-123483WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerabilityCrocoblock JetFormBuilder
- CVE-2026-123183WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerabilityPluginUs.Net Active Products Tables for WooCommerce
- CVE-2026-123474WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerabilityLeapWorx Premium Blocks – Gutenberg Blocks for WordPress
- CVE-2026-121775WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerabilityVillaTheme CURCY
- CVE-2026-123462WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-122669WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityEverest Forms
- CVE-2026-122663WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerabilityVillaTheme CURCY
- CVE-2026-121784WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityMagepeople WpBookingly
- CVE-2026-123477WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetEngine
- CVE-2026-123963OpenBMB Internet of Agents Agent Registry app.py register missing authenticationOpenBMB Internet of Agents
- CVE-2026-120579Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via…realmag777 Active Woot Products Tables for WooCommerce. 100…
- CVE-2026-109973Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameteroxilab Flipbox – Awesomes Flip Boxes Image Overlay
- CVE-2026-119498WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerabilityRelyWP Simple Cloudflare Turnstile
- CVE-2026-121977JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Propertyjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-120509Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parametershapedplugin Real Testimonials – Testimonial Slider, Collec…
- CVE-2026-118050Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Messageantoineh Football Pool
- CVE-2026-121976Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameterwpchill Modula Image Gallery – Photo Grid & Video Gallery
- CVE-2026-120685Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chainshapedplugin Real Testimonials – Testimonial Slider, Collec…
- CVE-2026-120683Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parametershapedplugin Real Testimonials – Testimonial Slider, Collec…
- CVE-2026-104760weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site…wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…
- CVE-2026-103914Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameterwpvibes Dynific Addons for Elementor
- CVE-2026-96565WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout…cbutlerjr WP-Members Membership Plugin
- CVE-2026-122059WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attributempol WP ImageViewer
- CVE-2026-118056Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored…oxilab Image Hover Effects Ultimate
- CVE-2026-118047Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via…sbouey Falang multilanguage for WordPress
- CVE-2026-102564Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content…wpvibes Dynific Addons for Elementor
- CVE-2026-121571WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerabilityWP Desk Autopay dla WooCommerce
- CVE-2026-119496WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-123470WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerabilityHivePress
- CVE-2026-119513WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerabilityAhmad JS Help Desk
- CVE-2026-123468WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerabilityStylemixThemes Motors
- CVE-2026-120857WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerabilityVideoWhisper.com 2Way VideoCalls and Random Chat
- CVE-2026-123148WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerabilityTMS IvyForms
- CVE-2026-120837WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerabilityEverest Forms
- CVE-2026-121724WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerabilityWebberZone Contextual Related Posts
- CVE-2026-120364WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityUntapwp Vidplex
- CVE-2026-119523WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2026-119525WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerabilityWP Desk Dropshipping XML for WooCommerce
- CVE-2026-120365WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerabilityAguila Technologies WP Customer Area
- CVE-2026-119478WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerabilityStylemixThemes MasterStudy LMS
- CVE-2026-119508WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerabilityMamunur Rashid Radius Booking — Booking Calendar for Appoin…
- CVE-2026-119492WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerabilityMetaphor Creations Ditty
- CVE-2026-119501WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerabilityBdThemes Element Pack Elementor Addons
- CVE-2026-121783WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerabilityPassionate Programmer Peter WP Data Access
- CVE-2026-119490WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerabilityMade with Fuel Better Notifications for WP
- CVE-2026-119486WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerabilityWP ManageNinja FluentBoards
- CVE-2026-119500WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins Flash & HTML5 Video
- CVE-2026-120840WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerabilityThemeGrill User Registration
- CVE-2026-120842WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerabilityBrainstorm Force SureForms
- CVE-2026-119520WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Spectra
- CVE-2026-119494WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerabilityGemini Labs Site Reviews
- CVE-2026-120850WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityElementor Website Builder
- CVE-2026-119493WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerabilityMetaphor Creations Ditty
- CVE-2026-119507WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerabilityWPDeveloper NotificationX
- CVE-2026-119473WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerabilityproperfraction ProfilePress
- CVE-2026-119465WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerabilityWPVibes Elementor Addon Elements
- CVE-2026-120532wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Formstomdever wpForo Forum
- CVE-2026-118784WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Namejohn-dagelmore WPSpeed – WordPress Speed, Cache & Performan…
- CVE-2026-104992Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure…melograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-120548YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via…icopydoc YML for Yandex Market
- CVE-2026-110004wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parametertomdever wpForo Forum
- CVE-2026-120514Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameterdylanjkotze Zephyr Project Manager
- CVE-2026-123464WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-119502WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerabilityBdThemes Ultimate Store Kit Elementor Addons
- CVE-2026-122668WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-120853WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerabilityBrainstorm Force CartFlows
- CVE-2026-120852WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerabilityBrainstorm Force CartFlows
- CVE-2026-123469WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-119491WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-61990WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers WCFM Membership
- CVE-2026-119484WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerabilityPhoto Gallery by Supsystic
- CVE-2026-120847WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerabilityWpmet Metform
- CVE-2026-119511WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerabilitySaeed MC Woocommerce Wishlist
- CVE-2026-121766WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerabilityBlubrry Podcasting PowerPress Podcasting
- CVE-2026-123466WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerabilityLeapWorx Premium Blocks – Gutenberg Blocks for WordPress
- CVE-2026-121768WordPress Contact Form 7 – Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerabilityMarkus Wiesenhofer Contact Form 7 – Post Fields
- CVE-2026-52713WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2026-119467WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerabilityWPVibes AnyWhere Elementor
- CVE-2026-119510WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilitySaeed MC Woocommerce Wishlist
- CVE-2026-121781WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerabilityWP ManageNinja Fluent Booking
- CVE-2026-119489WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerabilityBootstrapped Ventures WP Recipe Maker
- CVE-2026-120849WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerabilityWC Lovers WCFM Marketplace
- CVE-2026-120848WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerabilityWC Lovers WCFM Marketplace
- CVE-2026-124274WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-122675WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerabilityWpmet Wp Social
- CVE-2026-121761WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerabilityInfomaniak Network VOD Infomaniak
- CVE-2026-121767WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerabilityweDevs weDocs
- CVE-2026-121778WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerabilityWP Lab WP-Lister Lite for Amazon
- CVE-2026-121779WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerabilityYITH WooCommerce Subscription
- CVE-2026-39733WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerabilityproperfraction ProfilePress
- CVE-2026-123881OpenBMB Internet of Agents Message app.py fetch_chat_record access controlOpenBMB Internet of Agents
- CVE-2026-118800aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attributekodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…
- CVE-2026-118801aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcodekodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…
- CVE-2026-121792GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameterrubengc GamiPress – Gamification plugin to reward points, b…
- CVE-2026-120530WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile BiographyWebToffee WP Backup and Migration
- CVE-2026-120479WP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project…peterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-122265Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parametervanquish83 Vanquish Upload Files for WooCommerce
- CVE-2026-118204WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Rendererpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-121536WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameterpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-93370Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay EndpointPaystack WooCommerce Payment Gateway
- CVE-2026-116621Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Fieldultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-118048WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Labelpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-120515SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and…rainbowgeek SEOPress – AI SEO Plugin & On-site SEO
- CVE-2026-103917Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameterexpresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- CVE-2026-83495Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltrationRed Hat OpenShift AI
- CVE-2026-121858Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables SearchEvent Tickets with Ticket Scanner
- CVE-2026-121857Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackendEvent Tickets with Ticket Scanner
- CVE-2026-121796Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG UploadAdd From Server Lite
- CVE-2026-121492Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_updateFiber Admin
- CVE-2026-121380Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST APITournamatch
- CVE-2026-119073Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module PaginationLive Composer
- CVE-2026-118534Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDORDirectorist: AI-Powered Business Directory, Listings & Clas…
- CVE-2026-118533Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment ReceiptDirectorist: AI-Powered Business Directory, Listings & Clas…
- CVE-2026-118532Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image FieldDirectorist: AI-Powered Business Directory, Listings & Clas…
- CVE-2026-118530Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk ActionDirectorist: AI-Powered Business Directory, Listings & Clas…
- CVE-2026-118529Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing CheckoutDirectorist: AI-Powered Business Directory, Listings & Clas…
- CVE-2026-118528Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDORDirectorist: AI-Powered Business Directory, Listings & Clas…
- CVE-2026-117588WP Google Review Slider < 18.11 - Google API Settings Update via CSRFWP Google Review Slider
- CVE-2025-15708Live Composer < 2.1.23 - Admin+ Stored XSS via Partner SlugLive Composer
- CVE-2026-97191Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save PathAdvanced Custom Fields
- CVE-2026-97190Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDORAdvanced Custom Fields
- CVE-2026-97189Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational FieldsAdvanced Custom Fields
- CVE-2026-19124Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17393Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-19131Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-19129Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-19126Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-19122Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-18689Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17428Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17395Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17391Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17390Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17389Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17377Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17372Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17371Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17370Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17369Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17368Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17367Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17366Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17317Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17315Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17314Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17312Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17310Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17308Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17307Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17306Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17305Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17304Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17303Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17302Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17241Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17240Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17238Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17237Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17236Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17233Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17232Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17231Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17230Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17225Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17215Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17214Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17211Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17202Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17167Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17155Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17154Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17144Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17143Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17140Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17139Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17137Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17128Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17114Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17098Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17085Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17067Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17064Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-17062Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16719Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16711Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16710Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-16679IBM API Connect Path TraversalIBM API Connect
- CVE-2026-108178Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-105459Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-110534Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Namedavidanderson Redux Framework
- CVE-2026-93779Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpointsthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-110705Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options…davidanderson Redux Framework
- CVE-2026-120477Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameterwebguyio Stop Spammers Classic
- CVE-2026-9601Stackable <= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameterbfintal Stackable – Page Builder Gutenberg Blocks
- CVE-2026-93902Soledad <= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fieldspencidesign Soledad
- CVE-2026-121516QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest…qodeinteractive QODE Wishlist for WooCommerce
- CVE-2026-120560Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id'…realmag777 Active Woot Products Tables for WooCommerce. 100…
- CVE-2026-119218Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute…wpsoul Greenshift – animation and page builder blocks
- CVE-2026-120741MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpointjetmonsters MotoPress Appointment Booking
- CVE-2026-115816Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Reviewextendthemes Kubio AI Page Builder
- CVE-2026-121515FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Contentfoliovision FV Flowplayer Video Player
- CVE-2026-118067Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields ParameterForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-119165WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display NameWPBakery Page Builder
- CVE-2026-119152Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email FieldAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-119213Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feedwpmanageninja Fluent Support – Helpdesk & Customer Support…
- CVE-2026-119098LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question AnswerLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- CVE-2026-120555Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameterartbees Jupiter X Core
- CVE-2026-119616Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_namepicocodes Noptin – Newsletter, New Post Notifications & Ema…
- CVE-2026-121519Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameterthemeisle Social Slider Feed – Social Media Feed & Gallery…
- CVE-2026-120737Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameterartbees Jupiter X Core
- CVE-2026-120520Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameterwpsoul Greenshift – animation and page builder blocks
- CVE-2026-119219Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Metaartbees Jupiter X Core
- CVE-2026-118046JS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox…rabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2026-118054LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameterthimpress LearnPress – Course Review
- CVE-2026-116562Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameterstylemix Motors – Car Dealership & Classified Listings Plug…