CVE Vulnerability Database
Search and browse 424,901 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-107694 | LOW | 2.7 | 0.2% | Oct 11, 2026 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that t... |
| CVE-2026-107507 | LOW | 2.7 | 0.2% | Oct 11, 2026 | The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowi... |
| CVE-2026-106029 | HIGH | 7.5 | 0.3% | Oct 11, 2026 | The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleti... |
| CVE-2026-104684 | LOW | 2.7 | 0.2% | Oct 11, 2026 | The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before re... |
| CVE-2026-104682 | LOW | 2.7 | 0.2% | Oct 11, 2026 | The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feat... |
| CVE-2026-104681 | LOW | 2.7 | 0.2% | Oct 11, 2026 | The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to... |
| CVE-2026-104680 | HIGH | 7.2 | 0.3% | Oct 11, 2026 | The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves f... |
| CVE-2026-104028 | CRITICAL | 9.8 | 0.6% | Oct 11, 2026 | The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-t... |
| CVE-2026-103695 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL stat... |
| CVE-2026-103694 | HIGH | 8.8 | 0.3% | Oct 11, 2026 | The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can u... |
| CVE-2026-103305 | HIGH | 8.8 | 0.2% | Oct 11, 2026 | The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, an... |
| CVE-2026-108539 | MEDIUM | 6.3 | 0.3% | Oct 11, 2026 | A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_q... |
| CVE-2026-108538 | MEDIUM | 6.3 | 0.2% | Oct 11, 2026 | A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the fi... |
| CVE-2026-108523 | MEDIUM | 4.3 | 0.3% | Oct 11, 2026 | A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file... |
| CVE-2026-108522 | HIGH | 8.3 | 0.4% | Oct 11, 2026 | A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login... |
| CVE-2026-108521 | MEDIUM | 4.7 | 0.2% | Oct 11, 2026 | A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemot... |
| CVE-2026-108708 | HIGH | 8.8 | 0.3% | Oct 11, 2026 | Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every ca... |
| CVE-2026-108707 | CRITICAL | 9.8 | 0.6% | Oct 11, 2026 | Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthentic... |
| CVE-2026-108706 | MEDIUM | 4.3 | 0.2% | Oct 11, 2026 | eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allo... |
| CVE-2026-108705 | MEDIUM | 4.3 | 0.2% | Oct 11, 2026 | CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint tha... |
| CVE-2026-108704 | MEDIUM | 4.3 | 0.2% | Oct 11, 2026 | CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to... |
| CVE-2026-108703 | MEDIUM | 5.4 | 0.2% | Oct 11, 2026 | CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authe... |
| CVE-2026-108702 | MEDIUM | 4.3 | 0.2% | Oct 11, 2026 | 1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowin... |
| CVE-2026-108701 | MEDIUM | 4.3 | 0.2% | Oct 11, 2026 | 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule ha... |
| CVE-2026-108700 | MEDIUM | 6.5 | 0.2% | Oct 11, 2026 | 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list... |