CVE Vulnerability Database
Search and browse 425,078 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-85235 | HIGH | 7.2 | — | Oct 1, 2026 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro... |
| CVE-2026-15983 | HIGH | 8.1 | 0.5% | Oct 1, 2026 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in al... |
| CVE-2026-14995 | HIGH | 7.2 | — | Oct 1, 2026 | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions u... |
| CVE-2026-103664 | MEDIUM | 4.8 | — | Oct 1, 2026 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parame... |
| CVE-2026-103662 | MEDIUM | 5.1 | — | Oct 1, 2026 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation fo... |
| CVE-2026-103659 | HIGH | 7.1 | — | Oct 1, 2026 | MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten op... |
| CVE-2026-103656 | — | — | — | Oct 1, 2026 | Rejected reason: this is rejected |
| CVE-2026-103655 | CRITICAL | 9.3 | — | Oct 1, 2026 | MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time... |
| CVE-2026-103431 | HIGH | 7.7 | — | Oct 1, 2026 | colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote c... |
| CVE-2026-101925 | MEDIUM | 6.4 | — | Oct 1, 2026 | The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admi... |
| CVE-2026-100184 | MEDIUM | 4.7 | 0.2% | Oct 1, 2026 | The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress i... |
| CVE-2026-100179 | MEDIUM | 6.1 | — | Oct 1, 2026 | The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress i... |
| CVE-2026-93882 | HIGH | 7.5 | 0.4% | Oct 1, 2026 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure ... |
| CVE-2026-89047 | MEDIUM | 6.1 | 0.3% | Oct 1, 2026 | The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripti... |
| CVE-2026-78249 | MEDIUM | 6.8 | — | Oct 1, 2026 | A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, in... |
| CVE-2026-75957 | CRITICAL | 9.8 | — | Oct 1, 2026 | The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication B... |
| CVE-2026-19902 | MEDIUM | 6.1 | 0.3% | Oct 1, 2026 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ... |
| CVE-2026-19807 | HIGH | 8.8 | 0.4% | Oct 1, 2026 | The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all version... |
| CVE-2026-15989 | CRITICAL | 9.8 | — | Oct 1, 2026 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up... |
| CVE-2026-103651 | HIGH | 7.6 | — | Oct 1, 2026 | MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (... |
| CVE-2026-103544 | MEDIUM | 6.3 | — | Oct 1, 2026 | A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown... |
| CVE-2025-41753 | CRITICAL | 9.8 | 0.6% | Oct 1, 2026 | The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation.... |
| CVE-2026-96255 | HIGH | 7.5 | — | Oct 1, 2026 | The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records ... |
| CVE-2026-96200 | MEDIUM | 5.3 | — | Oct 1, 2026 | The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment... |
| CVE-2026-96173 | MEDIUM | 5.3 | — | Oct 1, 2026 | The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order ... |