CVE Vulnerability Database
Search and browse 420,257 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-61997 | CRITICAL | 9.8 | 0.5% | Oct 29, 2026 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. |
| CVE-2026-61996 | HIGH | 8.5 | 0.4% | Oct 29, 2026 | Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. |
| CVE-2026-61995 | HIGH | 7.1 | — | Oct 29, 2026 | Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. |
| CVE-2026-61993 | HIGH | 7.1 | — | Oct 29, 2026 | Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. |
| CVE-2026-61992 | CRITICAL | 9.8 | 0.4% | Oct 29, 2026 | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. |
| CVE-2026-61991 | CRITICAL | 10 | 0.7% | Oct 29, 2026 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. |
| CVE-2026-61989 | HIGH | 7.1 | 0.2% | Oct 29, 2026 | Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. |
| CVE-2026-61988 | HIGH | 7.1 | — | Oct 29, 2026 | Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions. |
| CVE-2026-54866 | HIGH | 7.1 | — | Oct 29, 2026 | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions. |
| CVE-2026-54865 | MEDIUM | 6.5 | 0.2% | Oct 29, 2026 | Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. |
| CVE-2026-54864 | HIGH | 7.1 | 0.2% | Oct 29, 2026 | Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. |
| CVE-2026-54860 | CRITICAL | 9.8 | 0.5% | Oct 29, 2026 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. |
| CVE-2026-54859 | CRITICAL | 9.8 | — | Oct 29, 2026 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. |
| CVE-2026-54858 | CRITICAL | 9.8 | — | Oct 29, 2026 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. |
| CVE-2026-54857 | CRITICAL | 9.8 | 0.5% | Oct 29, 2026 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. |
| CVE-2026-54856 | CRITICAL | 9.8 | 0.5% | Oct 29, 2026 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. |
| CVE-2026-48200 | MEDIUM | 5.3 | — | Oct 29, 2026 | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-... |
| CVE-2026-42701 | HIGH | 7.2 | 0.4% | Oct 29, 2026 | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. |
| CVE-2026-42694 | MEDIUM | 4.3 | 0.2% | Oct 29, 2026 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allow... |
| CVE-2026-42692 | HIGH | 7.1 | — | Oct 29, 2026 | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. |
| CVE-2026-42690 | MEDIUM | 5.4 | — | Oct 29, 2026 | Subscriber Broken Access Control in LearnPress <= 4.4.10 versions. |
| CVE-2026-27394 | HIGH | 7.1 | 0.2% | Oct 29, 2026 | Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. |
| CVE-2026-20942 | MEDIUM | 4.3 | 0.6% | Oct 29, 2026 | Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker ... |
| CVE-2026-18894 | CRITICAL | 9.8 | — | Oct 29, 2026 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code... |
| CVE-2026-119145 | CRITICAL | 9.9 | — | Oct 29, 2026 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handl... |