CVE Vulnerability Database
Search and browse 376,485 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-16985 | HIGH | 8.8 | 0.2% | Aug 10, 2026 | The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data writ... |
| CVE-2026-16949 | MEDIUM | 5.8 | 0.2% | Aug 10, 2026 | The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL ... |
| CVE-2026-16299 | CRITICAL | 9.8 | 0.1% | Aug 10, 2026 | The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing u... |
| CVE-2026-16298 | CRITICAL | 9.8 | 0.1% | Aug 10, 2026 | The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthen... |
| CVE-2026-16257 | HIGH | 8.2 | 0.2% | Aug 10, 2026 | The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, wh... |
| CVE-2026-15238 | MEDIUM | 5.4 | 0.1% | Aug 10, 2026 | The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer reco... |
| CVE-2026-15237 | MEDIUM | 5.3 | 0.1% | Aug 10, 2026 | The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a RES... |
| CVE-2026-15229 | MEDIUM | 5.3 | 0.1% | Aug 10, 2026 | The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, ... |
| CVE-2026-15047 | MEDIUM | 6.8 | 0.1% | Aug 10, 2026 | The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside ... |
| CVE-2026-14941 | MEDIUM | 5.4 | 0.1% | Aug 10, 2026 | The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on seve... |
| CVE-2026-14860 | MEDIUM | 5.3 | 0.1% | Aug 10, 2026 | The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from ... |
| CVE-2026-14293 | HIGH | 8.8 | 0.2% | Aug 10, 2026 | The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option ... |
| CVE-2026-14238 | MEDIUM | 4.1 | 0.2% | Aug 10, 2026 | The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body... |
| CVE-2026-14237 | HIGH | 7.2 | 0.1% | Aug 10, 2026 | The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorizat... |
| CVE-2026-14211 | LOW | 3.8 | 0.1% | Aug 10, 2026 | The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated empl... |
| CVE-2026-14206 | HIGH | 7.5 | 0.2% | Aug 10, 2026 | The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns... |
| CVE-2026-13701 | MEDIUM | 4.8 | 0.2% | Aug 10, 2026 | The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it o... |
| CVE-2026-13600 | HIGH | 8.1 | 0.2% | Aug 10, 2026 | The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before settin... |
| CVE-2026-13170 | HIGH | 7.2 | 0.2% | Aug 10, 2026 | The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to includ... |
| CVE-2026-13133 | HIGH | 8.4 | 0.1% | Aug 10, 2026 | A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is lo... |
| CVE-2026-12971 | LOW | 2.2 | 0.1% | Aug 10, 2026 | The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowi... |
| CVE-2026-12570 | MEDIUM | 5.5 | 0.1% | Aug 10, 2026 | A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack when loading maliciou... |
| CVE-2026-17519 | — | — | — | Aug 10, 2026 | Rejected reason: This is rejected. |
| CVE-2026-72522 | MEDIUM | 6.2 | 0.2% | Aug 10, 2026 | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same ... |
| CVE-2026-19389 | HIGH | 7.1 | 0.2% | Aug 10, 2026 | Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdem... |