CVE Vulnerability Database
Search and browse 424,998 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-98375 | — | — | 0.2% | Oct 9, 2026 | In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet... |
| CVE-2026-97075 | MEDIUM | 6.5 | 0.2% | Oct 9, 2026 | Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Cont... |
| CVE-2026-4264 | MEDIUM | 5.1 | 0.3% | Oct 9, 2026 | Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The ... |
| CVE-2026-19575 | HIGH | 7.8 | 0.1% | Oct 9, 2026 | The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, valid... |
| CVE-2026-19574 | HIGH | 7 | 0.1% | Oct 9, 2026 | The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in... |
| CVE-2026-19571 | MEDIUM | 6.7 | 0.1% | Oct 9, 2026 | The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-b... |
| CVE-2026-19570 | HIGH | 8.8 | 0.3% | Oct 9, 2026 | The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basi... |
| CVE-2026-19569 | HIGH | 8.8 | 0.2% | Oct 9, 2026 | dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kern... |
| CVE-2026-106155 | HIGH | 8.9 | 0.2% | Oct 9, 2026 | In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the sh... |
| CVE-2026-106145 | HIGH | 7.1 | 0.1% | Oct 9, 2026 | In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent S... |
| CVE-2025-14123 | MEDIUM | 6.8 | 0.2% | Oct 9, 2026 | The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5... |
| CVE-2026-97076 | HIGH | 7.5 | 0.3% | Oct 9, 2026 | Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affec... |
| CVE-2026-93548 | HIGH | 8.8 | 0.1% | Oct 9, 2026 | The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user... |
| CVE-2026-92990 | MEDIUM | 5.3 | 0.1% | Oct 9, 2026 | The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is ... |
| CVE-2026-92989 | MEDIUM | 4.3 | 0.1% | Oct 9, 2026 | The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-... |
| CVE-2026-88931 | MEDIUM | 5.3 | 0.1% | Oct 9, 2026 | The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an ... |
| CVE-2026-87841 | MEDIUM | 5.3 | 0.1% | Oct 9, 2026 | The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receiv... |
| CVE-2026-86850 | MEDIUM | 6.5 | 0.1% | Oct 9, 2026 | The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two ... |
| CVE-2026-81929 | HIGH | 7.2 | 0.2% | Oct 9, 2026 | The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via ... |
| CVE-2026-106097 | MEDIUM | 6.8 | 0.2% | Oct 9, 2026 | The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it ... |
| CVE-2026-106095 | LOW | 3.3 | 0.1% | Oct 9, 2026 | The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management ac... |
| CVE-2026-101028 | MEDIUM | 6 | 0.3% | Oct 9, 2026 | Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot re... |
| CVE-2025-15700 | HIGH | 8.8 | 0.4% | Oct 9, 2026 | The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP arc... |
| CVE-2026-87110 | MEDIUM | 5.3 | 0.3% | Oct 9, 2026 | An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that... |
| CVE-2026-87109 | MEDIUM | 6.5 | 0.2% | Oct 9, 2026 | An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed thr... |