CVE Vulnerability Database
Search and browse 425,078 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-64949 | HIGH | 8.6 | — | Oct 1, 2026 | Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar f... |
| CVE-2026-64948 | HIGH | 7.1 | — | Oct 1, 2026 | Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora... |
| CVE-2026-64947 | HIGH | 7.5 | — | Oct 1, 2026 | A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload... |
| CVE-2026-64946 | HIGH | 7.4 | — | Oct 1, 2026 | A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Script... |
| CVE-2026-34190 | MEDIUM | 5.9 | — | Oct 1, 2026 | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidat... |
| CVE-2026-34189 | MEDIUM | 5.9 | — | Oct 1, 2026 | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request... |
| CVE-2026-103497 | MEDIUM | 5.5 | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration |
| CVE-2026-103496 | MEDIUM | 5.4 | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications |
| CVE-2026-103495 | MEDIUM | 4.3 | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs |
| CVE-2026-103494 | MEDIUM | 6.6 | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes |
| CVE-2026-103493 | HIGH | 8.1 | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible |
| CVE-2026-103492 | MEDIUM | 6.5 | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments |
| CVE-2026-103491 | MEDIUM | 6.5 | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues |
| CVE-2026-103490 | HIGH | 7.2 | 0.4% | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links |
| CVE-2026-103489 | MEDIUM | 5.4 | 0.1% | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible |
| CVE-2026-103488 | HIGH | 7.1 | 0.3% | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project... |
| CVE-2026-97661 | HIGH | 7.2 | — | Oct 1, 2026 | The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gatewa... |
| CVE-2026-96813 | HIGH | 7.2 | 0.3% | Oct 1, 2026 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored ... |
| CVE-2026-96573 | HIGH | 7.2 | — | Oct 1, 2026 | The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Script... |
| CVE-2026-96268 | MEDIUM | 6.4 | — | Oct 1, 2026 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Script... |
| CVE-2026-95687 | HIGH | 8.8 | 0.5% | Oct 1, 2026 | The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeov... |
| CVE-2026-92244 | HIGH | 7.2 | — | Oct 1, 2026 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via B... |
| CVE-2026-90992 | MEDIUM | 6.4 | — | Oct 1, 2026 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-medi... |
| CVE-2026-89427 | MEDIUM | 6.1 | 0.3% | Oct 1, 2026 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' ... |
| CVE-2026-89424 | MEDIUM | 6.4 | — | Oct 1, 2026 | The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in a... |