CVE Vulnerability Database
Search and browse 420,382 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-110505 | MEDIUM | 6.8 | 0.2% | Oct 29, 2026 | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG f... |
| CVE-2026-110504 | MEDIUM | 6.8 | 0.2% | Oct 29, 2026 | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is... |
| CVE-2026-110030 | MEDIUM | 5.3 | 0.1% | Oct 29, 2026 | The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not hon... |
| CVE-2026-108763 | MEDIUM | 4.3 | 0.1% | Oct 29, 2026 | The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler t... |
| CVE-2026-108686 | LOW | 3.7 | 0.2% | Oct 29, 2026 | The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, all... |
| CVE-2026-108685 | LOW | 3.7 | 0.2% | Oct 29, 2026 | The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profil... |
| CVE-2026-105258 | LOW | 3.5 | 0.2% | Oct 29, 2026 | The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings... |
| CVE-2026-103693 | CRITICAL | 9 | 0.2% | Oct 29, 2026 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an una... |
| CVE-2024-3586 | LOW | 3.5 | 0.2% | Oct 29, 2026 | The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high... |
| CVE-2026-96741 | HIGH | 7.2 | 0.2% | Oct 29, 2026 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Ou... |
| CVE-2026-96669 | HIGH | 7.2 | 0.3% | Oct 29, 2026 | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'se... |
| CVE-2026-96666 | HIGH | 7.2 | 0.3% | Oct 29, 2026 | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via... |
| CVE-2026-96228 | HIGH | 8.1 | 0.5% | Oct 29, 2026 | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,... |
| CVE-2026-93904 | HIGH | 7.5 | 0.5% | Oct 29, 2026 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to generic S... |
| CVE-2026-93855 | HIGH | 7.5 | 0.4% | Oct 29, 2026 | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' paramete... |
| CVE-2026-93757 | HIGH | 7.5 | 0.4% | Oct 29, 2026 | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Bindi... |
| CVE-2026-42949 | MEDIUM | 5.6 | 0.2% | Oct 29, 2026 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A spec... |
| CVE-2026-42922 | CRITICAL | 9.8 | 0.5% | Oct 29, 2026 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially ... |
| CVE-2026-40063 | MEDIUM | 5.3 | 0.3% | Oct 29, 2026 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809... |
| CVE-2026-118426 | MEDIUM | 5.3 | 0.3% | Oct 29, 2026 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call ... |
| CVE-2026-109516 | CRITICAL | 9.8 | 0.6% | Oct 29, 2026 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeo... |
| CVE-2026-66092 | MEDIUM | 4.8 | 0.3% | Oct 29, 2026 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encod... |
| CVE-2026-66091 | MEDIUM | 6.9 | 0.4% | Oct 29, 2026 | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation... |
| CVE-2026-66090 | HIGH | 7.1 | 0.3% | Oct 29, 2026 | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user ... |
| CVE-2026-66089 | MEDIUM | 6.1 | 0.3% | Oct 29, 2026 | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves ext... |