CVE Vulnerability Database
Search and browse 424,998 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-62041 | MEDIUM | 5.4 | 0.1% | Oct 9, 2026 | Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Conf... |
| CVE-2026-62040 | MEDIUM | 5.3 | 0.2% | Oct 9, 2026 | Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-a... |
| CVE-2026-62039 | MEDIUM | 6.5 | 0.1% | Oct 9, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Aud... |
| CVE-2026-62036 | MEDIUM | 4.3 | 0.2% | Oct 9, 2026 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks a... |
| CVE-2026-39779 | MEDIUM | 4.3 | — | Oct 9, 2026 | Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Acce... |
| CVE-2026-107419 | MEDIUM | 5.4 | 0.2% | Oct 9, 2026 | Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allo... |
| CVE-2026-103329 | MEDIUM | 5.3 | — | Oct 9, 2026 | The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook ... |
| CVE-2026-97791 | HIGH | 7.5 | 0.2% | Oct 9, 2026 | In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to s... |
| CVE-2026-97468 | CRITICAL | 9.1 | 0.2% | Oct 9, 2026 | Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptograph... |
| CVE-2026-86463 | HIGH | 7.5 | 0.3% | Oct 9, 2026 | Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pat... |
| CVE-2026-79650 | MEDIUM | 6.1 | 0.2% | Oct 9, 2026 | Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentica... |
| CVE-2026-78384 | HIGH | 7.5 | 0.3% | Oct 9, 2026 | CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted ... |
| CVE-2026-73179 | HIGH | 8.1 | 0.3% | Oct 9, 2026 | Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in A... |
| CVE-2026-71575 | CRITICAL | 9.1 | 0.3% | Oct 9, 2026 | The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds ... |
| CVE-2026-108039 | HIGH | 7.5 | 0.3% | Oct 9, 2026 | By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML docume... |
| CVE-2026-107938 | CRITICAL | 9.1 | 0.2% | Oct 9, 2026 | In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostn... |
| CVE-2026-107937 | HIGH | 7.5 | 0.4% | Oct 9, 2026 | In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max... |
| CVE-2026-100227 | HIGH | 7.5 | 0.2% | Oct 9, 2026 | Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XM... |
| CVE-2026-96809 | CRITICAL | 9.3 | 0.2% | Oct 9, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interacti... |
| CVE-2026-96761 | HIGH | 7.1 | — | Oct 9, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-... |
| CVE-2026-96671 | HIGH | 8.8 | — | Oct 9, 2026 | Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross... |
| CVE-2026-96607 | HIGH | 7.1 | — | Oct 9, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms ne... |
| CVE-2026-96553 | HIGH | 7.1 | 0.1% | Oct 9, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSe... |
| CVE-2026-96539 | MEDIUM | 5.6 | 0.1% | Oct 9, 2026 | Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalat... |
| CVE-2026-96518 | MEDIUM | 5.9 | — | Oct 9, 2026 | Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configur... |