CVE Vulnerability Database
Search and browse 424,998 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-94058 | HIGH | 7.1 | — | Oct 9, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck t... |
| CVE-2026-8374 | HIGH | 8.5 | 0.1% | Oct 9, 2026 | Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the el... |
| CVE-2026-86405 | CRITICAL | 9.8 | 0.2% | Oct 9, 2026 | Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. Prest... |
| CVE-2026-85531 | CRITICAL | 9.8 | 0.2% | Oct 9, 2026 | Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenC... |
| CVE-2026-62029 | MEDIUM | 6.5 | — | Oct 9, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPF... |
| CVE-2026-62028 | MEDIUM | 5.4 | 0.1% | Oct 9, 2026 | Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-ima... |
| CVE-2026-106602 | MEDIUM | 4.8 | 0.2% | Oct 9, 2026 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Rec... |
| CVE-2026-106601 | MEDIUM | 5.4 | — | Oct 9, 2026 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Rec... |
| CVE-2026-105883 | HIGH | 7.1 | — | Oct 9, 2026 | Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Ac... |
| CVE-2026-105877 | MEDIUM | 6.9 | — | Oct 9, 2026 | Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retri... |
| CVE-2026-105872 | HIGH | 7.2 | 0.3% | Oct 9, 2026 | Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-f... |
| CVE-2026-105870 | HIGH | 7.1 | 0.1% | Oct 9, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. ... |
| CVE-2026-105318 | HIGH | 7.1 | — | Oct 9, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMa... |
| CVE-2026-104392 | HIGH | 8.8 | — | Oct 9, 2026 | Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Inj... |
| CVE-2026-104079 | MEDIUM | 4.3 | 0.2% | Oct 9, 2026 | Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint... |
| CVE-2026-103413 | HIGH | 8.8 | 0.4% | Oct 9, 2026 | Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled ... |
| CVE-2026-103412 | HIGH | 8.8 | 0.5% | Oct 9, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. ... |
| CVE-2026-103220 | MEDIUM | 4.5 | — | Oct 9, 2026 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when pars... |
| CVE-2026-101130 | LOW | 3.6 | — | Oct 9, 2026 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when pars... |
| CVE-2026-101094 | LOW | 3.6 | — | Oct 9, 2026 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 characte... |
| CVE-2026-89235 | MEDIUM | 6.8 | — | Oct 9, 2026 | The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it ... |
| CVE-2026-87846 | MEDIUM | 5.3 | — | Oct 9, 2026 | The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership chec... |
| CVE-2026-86851 | MEDIUM | 6.5 | — | Oct 9, 2026 | The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acti... |
| CVE-2026-85348 | MEDIUM | 4.3 | — | Oct 9, 2026 | The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its setting... |
| CVE-2026-62042 | MEDIUM | 5.3 | — | Oct 9, 2026 | Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly ... |