CVE Vulnerability Database
Search and browse 419,784 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-107776 | LOW | 2.2 | 0.2% | Nov 5, 2026 | The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger a... |
| CVE-2026-100109 | CRITICAL | 9.8 | 0.4% | Nov 5, 2026 | The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating use... |
| CVE-2026-123033 | HIGH | 8.3 | — | Nov 5, 2026 | Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release tr... |
| CVE-2026-123029 | HIGH | 7.5 | — | Nov 5, 2026 | Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files ... |
| CVE-2026-123025 | CRITICAL | 9.4 | — | Nov 5, 2026 | An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-c... |
| CVE-2026-123017 | MEDIUM | 6.5 | 0.3% | Nov 5, 2026 | GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) cal... |
| CVE-2026-91049 | MEDIUM | 6.4 | 0.2% | Nov 5, 2026 | The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content b... |
| CVE-2026-90967 | MEDIUM | 4.3 | 0.1% | Nov 5, 2026 | The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in o... |
| CVE-2026-90966 | MEDIUM | 4.3 | 0.1% | Nov 5, 2026 | The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing pack... |
| CVE-2026-90965 | MEDIUM | 5.3 | 0.1% | Nov 5, 2026 | The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in ... |
| CVE-2026-90964 | MEDIUM | 5.3 | 0.1% | Nov 5, 2026 | The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email acti... |
| CVE-2026-90963 | MEDIUM | 5.3 | 0.1% | Nov 5, 2026 | The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check i... |
| CVE-2026-88814 | LOW | 3.7 | 0.1% | Nov 5, 2026 | The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance ... |
| CVE-2026-87856 | MEDIUM | 5.3 | 0.1% | Nov 5, 2026 | The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on sta... |
| CVE-2026-86795 | MEDIUM | 5.3 | 0.1% | Nov 5, 2026 | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX action... |
| CVE-2026-86442 | HIGH | 8.2 | 0.1% | Nov 5, 2026 | The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied po... |
| CVE-2026-85570 | MEDIUM | 4.3 | 0.1% | Nov 5, 2026 | The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included ... |
| CVE-2026-85351 | MEDIUM | 5 | 0.1% | Nov 5, 2026 | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performi... |
| CVE-2026-85347 | MEDIUM | 6.8 | 0.2% | Nov 5, 2026 | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value be... |
| CVE-2026-85346 | MEDIUM | 4.3 | 0.1% | Nov 5, 2026 | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on seve... |
| CVE-2026-19256 | CRITICAL | 9.8 | 0.1% | Nov 5, 2026 | The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made ... |
| CVE-2026-16304 | HIGH | 8.1 | 0.1% | Nov 5, 2026 | The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplie... |
| CVE-2026-123014 | HIGH | 8.7 | — | Nov 5, 2026 | iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to... |
| CVE-2026-109150 | HIGH | 7.1 | 0.1% | Nov 5, 2026 | The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF ch... |
| CVE-2026-107787 | LOW | 3.1 | 0.1% | Nov 5, 2026 | The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowin... |