Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
102,590 matching · page 153/2052Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-62022(opens NVD record) | Critical | 9.8 | Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions. | Oct 10, 2026 |
| CVE-2026-62021(opens NVD record) | High | 8.8 | Subscriber PHP Object Injection in Angio <= 1.1.1 versions. | Oct 10, 2026 |
| CVE-2026-62020(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. | Oct 10, 2026 |
| CVE-2026-57742(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2. | Oct 10, 2026 |
| CVE-2026-48194(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. | Oct 10, 2026 |
| CVE-2026-48193(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. | Oct 10, 2026 |
| CVE-2026-45440(opens NVD record) | High | 7.6 | Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. | Oct 10, 2026 |
| CVE-2026-42777(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. | Oct 10, 2026 |
| CVE-2026-42724(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. | Oct 10, 2026 |
| CVE-2026-42723(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. | Oct 10, 2026 |
| CVE-2026-42722(opens NVD record) | High | 7.6 | Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. | Oct 10, 2026 |
| CVE-2026-42719(opens NVD record) | Critical | 9.8 | Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. | Oct 10, 2026 |
| CVE-2026-42718(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. | Oct 10, 2026 |
| CVE-2026-42717(opens NVD record) | High | 7.6 | Administrator SQL Injection in Leyka <= 3.32.3 versions. | Oct 10, 2026 |
| CVE-2026-42716(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. | Oct 10, 2026 |
| CVE-2026-42715(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions. | Oct 10, 2026 |
| CVE-2026-42712(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. | Oct 10, 2026 |
| CVE-2026-42711(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions. | Oct 10, 2026 |
| CVE-2026-42709(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions. | Oct 10, 2026 |
| CVE-2026-42706(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in DK <= 3.2.1 versions. | Oct 10, 2026 |
| CVE-2026-42705(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in Grand News <= 3.4 versions. | Oct 10, 2026 |
| CVE-2026-42704(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. | Oct 10, 2026 |
| CVE-2026-42702(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0. | Oct 10, 2026 |
| CVE-2026-42699(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions. | Oct 10, 2026 |
| CVE-2026-42697(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5. | Oct 10, 2026 |
| CVE-2026-42696(opens NVD record) | Critical | 10.0 | Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19. | Oct 10, 2026 |
| CVE-2026-42693(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. | Oct 10, 2026 |
| CVE-2026-42633(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Events Manager <= 7.4.6 versions. | Oct 10, 2026 |
| CVE-2026-42632(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions. | Oct 10, 2026 |
| CVE-2026-42631(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. | Oct 10, 2026 |
| CVE-2026-42630(opens NVD record) | High | 7.5 | Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. | Oct 10, 2026 |
| CVE-2026-42419(opens NVD record) | Medium | 5.9 | Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. | Oct 10, 2026 |
| CVE-2026-40808(opens NVD record) | Medium | 6.5 | Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | Oct 10, 2026 |
| CVE-2026-40805(opens NVD record) | High | 7.7 | Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. | Oct 10, 2026 |
| CVE-2026-40803(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions. | Oct 10, 2026 |
| CVE-2026-40802(opens NVD record) | High | 7.6 | Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | Oct 10, 2026 |
| CVE-2026-40801(opens NVD record) | High | 8.1 | Subscriber Broken Access Control in Wordable <= 8.2.10 versions. | Oct 10, 2026 |
| CVE-2026-40800(opens NVD record) | Critical | 9.3 | Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions. | Oct 10, 2026 |
| CVE-2026-40777(opens NVD record) | High | 8.1 | Subscriber Broken Access Control in WPSection <= 1.5.1 versions. | Oct 10, 2026 |
| CVE-2026-39802(opens NVD record) | High | 8.1 | Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions. | Oct 10, 2026 |
| CVE-2026-39801(opens NVD record) | Critical | 9.8 | Subscriber Privilege Escalation in AIWU <= 1.5.9 versions. | Oct 10, 2026 |
| CVE-2026-39800(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions. | Oct 10, 2026 |
| CVE-2026-39799(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions. | Oct 10, 2026 |
| CVE-2026-27350(opens NVD record) | High | 7.2 | Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta. | Oct 10, 2026 |
| CVE-2026-108604(opens NVD record) | Medium | 6.3 | Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts. | Oct 10, 2026 |
| CVE-2026-108603(opens NVD record) | Low | 3.3 | slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths. | Oct 10, 2026 |
| CVE-2026-108602(opens NVD record) | Medium | 4.3 | Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services. | Oct 10, 2026 |
| CVE-2026-107434(opens NVD record) | Medium | 5.4 | Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions. | Oct 10, 2026 |
| CVE-2026-107420(opens NVD record) | Medium | 5.3 | Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions. | Oct 10, 2026 |
| CVE-2026-103685(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4. | Oct 10, 2026 |