CVE Vulnerability Database
Search and browse 423,961 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-105107 | HIGH | 7.6 | 0.3% | Oct 14, 2026 | Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calcu... |
| CVE-2026-105106 | HIGH | 8.8 | 1.6% | Oct 14, 2026 | Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts t... |
| CVE-2026-104909 | HIGH | 8.1 | 1.0% | Oct 14, 2026 | The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 vi... |
| CVE-2026-104764 | HIGH | 7.2 | 0.6% | Oct 14, 2026 | The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and ... |
| CVE-2026-104761 | MEDIUM | 6.4 | 0.3% | Oct 14, 2026 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all vers... |
| CVE-2026-104748 | CRITICAL | 9.8 | 0.6% | Oct 14, 2026 | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable... |
| CVE-2026-103907 | MEDIUM | 6.5 | 0.3% | Oct 14, 2026 | The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil... |
| CVE-2026-103380 | MEDIUM | 4.3 | 0.3% | Oct 14, 2026 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to S... |
| CVE-2026-103367 | HIGH | 8.1 | 1.0% | Oct 14, 2026 | The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all version... |
| CVE-2026-103366 | HIGH | 7.5 | 0.5% | Oct 14, 2026 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to I... |
| CVE-2026-100163 | HIGH | 7.4 | 0.4% | Oct 14, 2026 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to A... |
| CVE-2025-9373 | MEDIUM | 6.4 | 0.3% | Oct 14, 2026 | The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and i... |
| CVE-2026-96904 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a ... |
| CVE-2026-96900 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email addr... |
| CVE-2026-94360 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound paym... |
| CVE-2026-94261 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order... |
| CVE-2026-94260 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being update... |
| CVE-2026-94254 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculate... |
| CVE-2026-92426 | MEDIUM | 4.9 | 0.2% | Oct 14, 2026 | The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before de... |
| CVE-2026-92409 | MEDIUM | 6.8 | 0.2% | Oct 14, 2026 | The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute b... |
| CVE-2026-91076 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incom... |
| CVE-2026-90989 | MEDIUM | 4.3 | 0.2% | Oct 14, 2026 | The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capab... |
| CVE-2026-89310 | CRITICAL | 9.9 | 0.5% | Oct 14, 2026 | A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowin... |
| CVE-2026-89288 | HIGH | 8.6 | 0.2% | Oct 14, 2026 | The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on a... |
| CVE-2026-88927 | MEDIUM | 4.3 | 0.2% | Oct 14, 2026 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may... |