Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
153,569 matching · page 131/3072Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-42716(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. | Oct 10, 2026 |
| CVE-2026-42715(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions. | Oct 10, 2026 |
| CVE-2026-42712(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. | Oct 10, 2026 |
| CVE-2026-42711(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions. | Oct 10, 2026 |
| CVE-2026-42709(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions. | Oct 10, 2026 |
| CVE-2026-42706(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in DK <= 3.2.1 versions. | Oct 10, 2026 |
| CVE-2026-42705(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in Grand News <= 3.4 versions. | Oct 10, 2026 |
| CVE-2026-42704(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. | Oct 10, 2026 |
| CVE-2026-42702(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0. | Oct 10, 2026 |
| CVE-2026-42699(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions. | Oct 10, 2026 |
| CVE-2026-42697(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5. | Oct 10, 2026 |
| CVE-2026-42696(opens NVD record) | Critical | 10.0 | Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19. | Oct 10, 2026 |
| CVE-2026-42693(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. | Oct 10, 2026 |
| CVE-2026-42633(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Events Manager <= 7.4.6 versions. | Oct 10, 2026 |
| CVE-2026-42632(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions. | Oct 10, 2026 |
| CVE-2026-42631(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. | Oct 10, 2026 |
| CVE-2026-42630(opens NVD record) | High | 7.5 | Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. | Oct 10, 2026 |
| CVE-2026-42419(opens NVD record) | Medium | 5.9 | Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. | Oct 10, 2026 |
| CVE-2026-40808(opens NVD record) | Medium | 6.5 | Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | Oct 10, 2026 |
| CVE-2026-40805(opens NVD record) | High | 7.7 | Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. | Oct 10, 2026 |
| CVE-2026-40803(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions. | Oct 10, 2026 |
| CVE-2026-40802(opens NVD record) | High | 7.6 | Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | Oct 10, 2026 |
| CVE-2026-40801(opens NVD record) | High | 8.1 | Subscriber Broken Access Control in Wordable <= 8.2.10 versions. | Oct 10, 2026 |
| CVE-2026-40800(opens NVD record) | Critical | 9.3 | Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions. | Oct 10, 2026 |
| CVE-2026-40777(opens NVD record) | High | 8.1 | Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | Oct 10, 2026 |
| CVE-2026-39802(opens NVD record) | High | 8.1 | Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions. | Oct 10, 2026 |
| CVE-2026-39801(opens NVD record) | Critical | 9.8 | Subscriber Privilege Escalation in AIWU <= 1.5.9 versions. | Oct 10, 2026 |
| CVE-2026-39800(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions. | Oct 10, 2026 |
| CVE-2026-39799(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions. | Oct 10, 2026 |
| CVE-2026-27350(opens NVD record) | High | 7.2 | Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta. | Oct 10, 2026 |
| CVE-2026-108604(opens NVD record) | Medium | 6.3 | Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts. | Oct 10, 2026 |
| CVE-2026-108603(opens NVD record) | Low | 3.3 | slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths. | Oct 10, 2026 |
| CVE-2026-108602(opens NVD record) | Medium | 4.3 | Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services. | Oct 10, 2026 |
| CVE-2026-107434(opens NVD record) | Medium | 5.4 | Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions. | Oct 10, 2026 |
| CVE-2026-107420(opens NVD record) | Medium | 5.3 | Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions. | Oct 10, 2026 |
| CVE-2026-103685(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4. | Oct 10, 2026 |
| CVE-2026-96341(opens NVD record) | High | 8.2 | Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3. | Oct 10, 2026 |
| CVE-2026-94590(opens NVD record) | Medium | 6.5 | Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3. | Oct 10, 2026 |
| CVE-2026-57806(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9. | Oct 10, 2026 |
| CVE-2026-108600(opens NVD record) | Medium | 4.7 | open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write. | Oct 10, 2026 |
| CVE-2026-108599(opens NVD record) | Medium | 4.7 | phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval. | Oct 10, 2026 |
| CVE-2026-108598(opens NVD record) | Critical | 9.8 | Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM. | Oct 10, 2026 |
| CVE-2026-108597(opens NVD record) | Medium | 4.8 | Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host. | Oct 10, 2026 |
| CVE-2026-108596(opens NVD record) | Medium | 5.3 | OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions. | Oct 10, 2026 |
| CVE-2026-108595(opens NVD record) | Medium | 5.3 | Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write. | Oct 10, 2026 |
| CVE-2026-108594(opens NVD record) | Low | 3.5 | Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login. | Oct 10, 2026 |
| CVE-2026-108593(opens NVD record) | Medium | 6.4 | 9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call. | Oct 10, 2026 |
| CVE-2026-108592(opens NVD record) | Medium | 5.3 | mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network. | Oct 10, 2026 |
| CVE-2026-108591(opens NVD record) | Medium | 4.4 | InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials. | Oct 10, 2026 |
| CVE-2026-106610(opens NVD record) | Critical | 9.8 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7. | Oct 10, 2026 |