CVE Vulnerability Database
Search and browse 420,610 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-107447 | MEDIUM | 5.3 | 0.2% | Oct 21, 2026 | The Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its o... |
| CVE-2026-105256 | MEDIUM | 5.3 | 0.1% | Oct 21, 2026 | The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is char... |
| CVE-2026-104642 | LOW | 2.7 | 0.1% | Oct 21, 2026 | The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the... |
| CVE-2026-104641 | MEDIUM | 5.3 | 0.1% | Oct 21, 2026 | The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payme... |
| CVE-2026-103301 | MEDIUM | 5.3 | 0.1% | Oct 21, 2026 | The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notif... |
| CVE-2026-101138 | MEDIUM | 5.3 | 0.2% | Oct 21, 2026 | The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages ad... |
| CVE-2026-17557 | MEDIUM | 6.5 | 0.3% | Oct 21, 2026 | A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit... |
| CVE-2026-111075 | HIGH | 8.7 | 0.4% | Oct 21, 2026 | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-... |
| CVE-2026-111074 | HIGH | 8.7 | 0.4% | Oct 21, 2026 | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial ... |
| CVE-2026-110899 | HIGH | 7.1 | — | Oct 21, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja... |
| CVE-2026-107435 | HIGH | 7.1 | — | Oct 21, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Te... |
| CVE-2026-96901 | LOW | 3.7 | 0.1% | Oct 21, 2026 | The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-r... |
| CVE-2026-93856 | MEDIUM | 4.3 | 0.3% | Oct 21, 2026 | In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user... |
| CVE-2026-92999 | MEDIUM | 5.3 | 0.1% | Oct 21, 2026 | The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a l... |
| CVE-2026-92998 | HIGH | 8.6 | 0.2% | Oct 21, 2026 | The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using ... |
| CVE-2026-92997 | HIGH | 8.6 | 0.2% | Oct 21, 2026 | The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before u... |
| CVE-2026-88784 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a pag... |
| CVE-2026-87838 | MEDIUM | 6.5 | 0.1% | Oct 21, 2026 | The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification ... |
| CVE-2026-87837 | MEDIUM | 5.3 | 0.1% | Oct 21, 2026 | The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider not... |
| CVE-2026-86611 | MEDIUM | 4.3 | 0.1% | Oct 21, 2026 | The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF c... |
| CVE-2026-85642 | HIGH | 7.5 | 0.2% | Oct 21, 2026 | The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timest... |
| CVE-2026-81813 | MEDIUM | 6.8 | 0.2% | Oct 21, 2026 | The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking o... |
| CVE-2026-81812 | MEDIUM | 6.4 | 0.2% | Oct 21, 2026 | The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route,... |
| CVE-2026-79627 | HIGH | 7.1 | 0.2% | Oct 21, 2026 | The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG be... |
| CVE-2026-71195 | CRITICAL | 9.9 | 0.5% | Oct 21, 2026 | In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns th... |