Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
154,717 matching · page 150/3095Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-62038(opens NVD record) | High | 7.3 | Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions. | Oct 10, 2026 |
| CVE-2026-62037(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions. | Oct 10, 2026 |
| CVE-2026-62035(opens NVD record) | Medium | 6.3 | Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions. | Oct 10, 2026 |
| CVE-2026-62034(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions. | Oct 10, 2026 |
| CVE-2026-62033(opens NVD record) | High | 7.6 | Subscriber Settings Change in uListing <= 2.2.0 versions. | Oct 10, 2026 |
| CVE-2026-62032(opens NVD record) | Critical | 9.8 | Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. | Oct 10, 2026 |
| CVE-2026-62031(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in uListing <= 2.2.0 versions. | Oct 10, 2026 |
| CVE-2026-62030(opens NVD record) | High | 7.2 | Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions. | Oct 10, 2026 |
| CVE-2026-62027(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions. | Oct 10, 2026 |
| CVE-2026-62025(opens NVD record) | Critical | 9.0 | Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions. | Oct 10, 2026 |
| CVE-2026-62024(opens NVD record) | Critical | 9.9 | Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions. | Oct 10, 2026 |
| CVE-2026-62022(opens NVD record) | Critical | 9.8 | Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions. | Oct 10, 2026 |
| CVE-2026-62021(opens NVD record) | High | 8.8 | Subscriber PHP Object Injection in Angio <= 1.1.1 versions. | Oct 10, 2026 |
| CVE-2026-62020(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. | Oct 10, 2026 |
| CVE-2026-57742(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2. | Oct 10, 2026 |
| CVE-2026-48194(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. | Oct 10, 2026 |
| CVE-2026-48193(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. | Oct 10, 2026 |
| CVE-2026-45440(opens NVD record) | High | 7.6 | Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. | Oct 10, 2026 |
| CVE-2026-42777(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. | Oct 10, 2026 |
| CVE-2026-42724(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. | Oct 10, 2026 |
| CVE-2026-42723(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. | Oct 10, 2026 |
| CVE-2026-42722(opens NVD record) | High | 7.6 | Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. | Oct 10, 2026 |
| CVE-2026-42719(opens NVD record) | Critical | 9.8 | Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. | Oct 10, 2026 |
| CVE-2026-42718(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. | Oct 10, 2026 |
| CVE-2026-42717(opens NVD record) | High | 7.6 | Administrator SQL Injection in Leyka <= 3.32.3 versions. | Oct 10, 2026 |
| CVE-2026-42716(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. | Oct 10, 2026 |
| CVE-2026-42715(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions. | Oct 10, 2026 |
| CVE-2026-42712(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. | Oct 10, 2026 |
| CVE-2026-42711(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions. | Oct 10, 2026 |
| CVE-2026-42709(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions. | Oct 10, 2026 |
| CVE-2026-42706(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in DK <= 3.2.1 versions. | Oct 10, 2026 |
| CVE-2026-42705(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in Grand News <= 3.4 versions. | Oct 10, 2026 |
| CVE-2026-42704(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. | Oct 10, 2026 |
| CVE-2026-42702(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0. | Oct 10, 2026 |
| CVE-2026-42699(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions. | Oct 10, 2026 |
| CVE-2026-42697(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5. | Oct 10, 2026 |
| CVE-2026-42696(opens NVD record) | Critical | 10.0 | Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19. | Oct 10, 2026 |
| CVE-2026-42693(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. | Oct 10, 2026 |
| CVE-2026-42633(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Events Manager <= 7.4.6 versions. | Oct 10, 2026 |
| CVE-2026-42632(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions. | Oct 10, 2026 |
| CVE-2026-42631(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. | Oct 10, 2026 |
| CVE-2026-42630(opens NVD record) | High | 7.5 | Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. | Oct 10, 2026 |
| CVE-2026-42419(opens NVD record) | Medium | 5.9 | Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. | Oct 10, 2026 |
| CVE-2026-40808(opens NVD record) | Medium | 6.5 | Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | Oct 10, 2026 |
| CVE-2026-40805(opens NVD record) | High | 7.7 | Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. | Oct 10, 2026 |
| CVE-2026-40803(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions. | Oct 10, 2026 |
| CVE-2026-40802(opens NVD record) | High | 7.6 | Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | Oct 10, 2026 |
| CVE-2026-40801(opens NVD record) | High | 8.1 | Subscriber Broken Access Control in Wordable <= 8.2.10 versions. | Oct 10, 2026 |
| CVE-2026-40800(opens NVD record) | Critical | 9.3 | Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions. | Oct 10, 2026 |
| CVE-2026-40777(opens NVD record) | High | 8.1 | Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | Oct 10, 2026 |