CVE Vulnerability Database
Search and browse 423,833 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-109930 | MEDIUM | 5.3 | — | Oct 16, 2026 | The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential v... |
| CVE-2026-107648 | HIGH | 7.2 | — | Oct 16, 2026 | The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the... |
| CVE-2026-105959 | HIGH | 7.5 | 0.5% | Oct 16, 2026 | A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when... |
| CVE-2026-109119 | HIGH | 8.8 | — | Oct 16, 2026 | Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authe... |
| CVE-2026-109118 | MEDIUM | 4.6 | — | Oct 16, 2026 | Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, his... |
| CVE-2026-96768 | HIGH | 7.2 | 0.3% | Oct 16, 2026 | The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body ... |
| CVE-2026-14452 | HIGH | 8.6 | — | Oct 16, 2026 | Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 an... |
| CVE-2026-110703 | MEDIUM | 6.4 | 0.4% | Oct 16, 2026 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to ... |
| CVE-2026-107649 | MEDIUM | 5.4 | 0.4% | Oct 16, 2026 | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' pa... |
| CVE-2026-106030 | MEDIUM | 6.8 | 0.1% | Oct 16, 2026 | NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to ... |
| CVE-2026-93681 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
| CVE-2026-92766 | HIGH | 7.5 | 0.3% | Oct 16, 2026 | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's... |
| CVE-2026-15575 | MEDIUM | 5.3 | 0.2% | Oct 16, 2026 | Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. T... |
| CVE-2026-15219 | MEDIUM | 6.5 | 0.2% | Oct 16, 2026 | Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploi... |
| CVE-2026-14177 | HIGH | 7.5 | 0.2% | Oct 16, 2026 | Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Foot... |
| CVE-2026-111472 | CRITICAL | 9.3 | 0.2% | Oct 16, 2026 | An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retriev... |
| CVE-2026-111311 | HIGH | 8.8 | 0.5% | Oct 16, 2026 | The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More... |
| CVE-2026-109224 | HIGH | 7.2 | 0.3% | Oct 16, 2026 | The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payment... |
| CVE-2026-104726 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in al... |
| CVE-2026-104003 | MEDIUM | 5.4 | 0.2% | Oct 16, 2026 | The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to,... |
| CVE-2026-101300 | HIGH | 7.1 | 0.2% | Oct 16, 2026 | Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to th... |
| CVE-2026-96870 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... |
| CVE-2026-87111 | HIGH | 7.2 | 0.2% | Oct 16, 2026 | The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress... |
| CVE-2026-75903 | HIGH | 8.1 | 0.5% | Oct 16, 2026 | The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1... |
| CVE-2026-19621 | MEDIUM | 6.5 | 0.2% | Oct 16, 2026 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integr... |