CVE Vulnerability Database
Search and browse 425,069 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-81740 | MEDIUM | 5.3 | 0.1% | Oct 2, 2026 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from ... |
| CVE-2026-78471 | MEDIUM | 5.4 | 0.2% | Oct 2, 2026 | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all version... |
| CVE-2026-15897 | HIGH | 8.8 | 0.3% | Oct 2, 2026 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up... |
| CVE-2026-15896 | CRITICAL | 9.1 | 0.9% | Oct 2, 2026 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up ... |
| CVE-2026-13718 | MEDIUM | 6.8 | 0.2% | Oct 2, 2026 | The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before stori... |
| CVE-2026-19660 | CRITICAL | 9.8 | 0.4% | Oct 2, 2026 | The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.... |
| CVE-2026-10026 | HIGH | 7.2 | 0.3% | Oct 2, 2026 | The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This... |
| CVE-2026-93367 | HIGH | 7.2 | 0.2% | Oct 2, 2026 | The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Sc... |
| CVE-2026-14378 | CRITICAL | 9.8 | 0.5% | Oct 2, 2026 | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in ... |
| CVE-2026-104123 | HIGH | 7.3 | 0.3% | Oct 2, 2026 | A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is ... |
| CVE-2026-104120 | HIGH | 7.3 | 0.3% | Oct 2, 2026 | A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026... |
| CVE-2026-21140 | MEDIUM | 6.9 | 0.1% | Oct 2, 2026 | Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitra... |
| CVE-2026-104480 | CRITICAL | 9.4 | 0.4% | Oct 2, 2026 | Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecogn... |
| CVE-2026-104054 | MEDIUM | 6.3 | 0.2% | Oct 2, 2026 | A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki... |
| CVE-2026-104053 | MEDIUM | 6.3 | 0.2% | Oct 2, 2026 | A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown functi... |
| CVE-2026-104052 | MEDIUM | 6.3 | 0.2% | Oct 2, 2026 | A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown functi... |
| CVE-2026-103098 | HIGH | 7.5 | 0.2% | Oct 2, 2026 | Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather th... |
| CVE-2026-103097 | HIGH | 7.5 | 0.2% | Oct 2, 2026 | An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineer... |
| CVE-2026-103096 | HIGH | 7.5 | 0.2% | Oct 2, 2026 | API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered,... |
| CVE-2026-86345 | CRITICAL | 9 | 0.4% | Oct 2, 2026 | A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection w... |
| CVE-2026-103766 | HIGH | 7.2 | 0.4% | Oct 2, 2026 | ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager... |
| CVE-2026-103765 | CRITICAL | 9.4 | 0.5% | Oct 2, 2026 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata hand... |
| CVE-2026-103764 | CRITICAL | 9.8 | 0.6% | Oct 2, 2026 | Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allow... |
| CVE-2026-103761 | HIGH | 7.5 | 0.4% | Oct 1, 2026 | Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePee... |
| CVE-2026-103760 | MEDIUM | 5.9 | 0.4% | Oct 1, 2026 | Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem... |