CVE Vulnerability Database
Search and browse 425,066 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-92727 | MEDIUM | 6.4 | 0.2% | Oct 3, 2026 | The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for ... |
| CVE-2026-92551 | MEDIUM | 6.1 | 0.2% | Oct 3, 2026 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePres... |
| CVE-2026-92538 | MEDIUM | 6.1 | 0.2% | Oct 3, 2026 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected... |
| CVE-2026-92536 | HIGH | 8.8 | 0.6% | Oct 3, 2026 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePres... |
| CVE-2026-96270 | HIGH | 7.2 | 0.2% | Oct 3, 2026 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi... |
| CVE-2026-95865 | MEDIUM | 6.5 | 0.3% | Oct 3, 2026 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injectio... |
| CVE-2026-94539 | MEDIUM | 6.5 | 0.3% | Oct 3, 2026 | The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-bas... |
| CVE-2026-94378 | MEDIUM | 6.4 | 0.2% | Oct 3, 2026 | The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored C... |
| CVE-2026-93428 | HIGH | 7.5 | 0.4% | Oct 3, 2026 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi... |
| CVE-2026-92243 | MEDIUM | 6.1 | 0.2% | Oct 3, 2026 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ... |
| CVE-2026-100180 | MEDIUM | 5.4 | 0.2% | Oct 3, 2026 | The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vul... |
| CVE-2026-105090 | MEDIUM | 5.1 | 0.3% | Oct 3, 2026 | Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enfor... |
| CVE-2026-105083 | MEDIUM | 4.2 | 0.1% | Oct 3, 2026 | ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips ... |
| CVE-2026-79113 | MEDIUM | 5.1 | 0.1% | Oct 3, 2026 | OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow. |
| CVE-2026-105080 | CRITICAL | 9.9 | 0.3% | Oct 3, 2026 | In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-conve... |
| CVE-2026-105030 | MEDIUM | 5.3 | 0.3% | Oct 3, 2026 | Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retri... |
| CVE-2026-105029 | MEDIUM | 4.3 | 0.2% | Oct 3, 2026 | UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket... |
| CVE-2026-104479 | MEDIUM | 5.4 | 0.2% | Oct 3, 2026 | Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users ... |
| CVE-2026-104478 | HIGH | 7.1 | 0.4% | Oct 3, 2026 | Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users... |
| CVE-2026-104477 | MEDIUM | 6.1 | 0.2% | Oct 3, 2026 | Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fa... |
| CVE-2026-104476 | MEDIUM | 5.9 | 0.3% | Oct 3, 2026 | Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to ret... |
| CVE-2026-104475 | MEDIUM | 5.4 | 0.2% | Oct 3, 2026 | IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inj... |
| CVE-2026-104474 | MEDIUM | 6.7 | 0.1% | Oct 3, 2026 | OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverifie... |
| CVE-2026-104433 | HIGH | 7.5 | 0.4% | Oct 3, 2026 | Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of includ... |
| CVE-2026-84411 | CRITICAL | 9.8 | 0.9% | Oct 2, 2026 | The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling... |