CVE-2026-104003 | Medium | 5.4 | 2026-10-16 | The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to… |
CVE-2026-94169 | Critical | 10.0 | 2026-10-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: fr… |
CVE-2026-15222 | Medium | 5.4 | 2026-10-16 | The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder pl… |
CVE-2026-104001 | Medium | 5.4 | 2026-10-16 | The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and… |
CVE-2026-96562 | Medium | 6.5 | 2026-10-16 | The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to… |
CVE-2026-103911 | Medium | 6.5 | 2026-10-16 | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… |
CVE-2026-101335 | Medium | 6.5 | 2026-10-16 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to… |
CVE-2026-111237 | Medium | 5.3 | 2026-10-16 | A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_me… |
CVE-2026-111212 | Medium | 4.8 | 2026-10-16 | A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_modelmeta.custom_me… |
CVE-2026-100159 | Medium | 4.8 | 2026-10-16 | The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() functi… |
CVE-2026-55467 | Low | 2.5 | 2026-10-15 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder… |
CVE-2026-102389 | Medium | 6.5 | 2026-10-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue af… |
CVE-2026-86803 | Medium | 6.5 | 2026-10-15 | The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software… |
CVE-2026-55679 | Medium | 6.5 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php… |
CVE-2026-54566 | | | 2026-10-14 | Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .c… |
CVE-2026-85714 | Critical | 9.1 | 2026-10-14 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the de… |
CVE-2026-108390 | Critical | 9.9 | 2026-10-14 | Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh d… |
CVE-2026-108151 | Medium | 5.3 | 2026-10-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This… |
CVE-2026-103081 | High | 7.5 | 2026-10-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: f… |
CVE-2026-0322 | High | 7.2 | 2026-10-14 | A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network a… |
CVE-2026-73800 | | | 2026-10-14 | Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author… |
CVE-2026-103358 | High | 7.5 | 2026-10-14 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-w… |
CVE-2026-86787 | High | 7.2 | 2026-10-14 | The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine c… |
CVE-2026-110445 | High | 8.8 | 2026-10-14 | TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with… |
CVE-2026-110444 | High | 8.8 | 2026-10-14 | TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted… |
CVE-2026-92097 | Critical | 9.1 | 2026-10-14 | The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the gr… |
CVE-2026-106624 | Critical | 10.0 | 2026-10-13 | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-106621 | Critical | 9.1 | 2026-10-13 | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-105903 | Critical | 9.9 | 2026-10-13 | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the conte… |
CVE-2026-63146 | Critical | 9.8 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php… |
CVE-2026-96220 | High | 7.8 | 2026-10-13 | Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges locally. |
CVE-2026-85359 | High | 7.8 | 2026-10-13 | Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally. |
CVE-2026-83759 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network. |
CVE-2026-103572 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attac… |
CVE-2026-102870 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. |
CVE-2026-102863 | High | 8.8 | 2026-10-13 | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-108385 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108384 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108383 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108382 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108381 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108380 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108379 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108378 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108377 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108376 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-108375 | High | 8.8 | 2026-10-13 | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From ver… |
CVE-2026-104126 | Medium | 6.0 | 2026-10-13 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation r… |
CVE-2026-78802 | Critical | 9.8 | 2026-10-13 | An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. |
CVE-2026-55695 | Critical | 9.1 | 2026-10-13 | FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator can set an a… |
CVE-2026-55675 | Critical | 10.0 | 2026-10-13 | The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows… |
CVE-2026-55376 | High | 8.8 | 2026-10-13 | Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or e… |
CVE-2026-103965 | Medium | 5.4 | 2026-10-13 | An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain c… |
CVE-2026-108962 | Medium | 6.3 | 2026-10-13 | A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLC… |
CVE-2026-108961 | Medium | 6.3 | 2026-10-13 | A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference… |
CVE-2026-108957 | Medium | 6.3 | 2026-10-13 | A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_t… |
CVE-2026-89107 | Critical | 9.9 | 2026-10-13 | SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-speci… |
CVE-2026-108945 | Medium | 5.3 | 2026-10-13 | A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultral… |
CVE-2026-108944 | Medium | 4.8 | 2026-10-13 | A security vulnerability has been detected in repository RAE up to a4d18c4db766419cbe7cb8c02cd9f7ceb0ec9041. Affected by this vulnerability is the function get… |
CVE-2026-108943 | Medium | 5.3 | 2026-10-13 | A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained of the file lightx2v/models/runners/cosm… |
CVE-2026-108942 | Low | 3.5 | 2026-10-13 | A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_it… |
CVE-2026-96119 | Critical | 9.9 | 2026-10-13 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to imprope… |
CVE-2026-108941 | Medium | 4.8 | 2026-10-13 | A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_args of the file internal/utils/common.py of the compone… |
CVE-2026-82108 | High | 8.8 | 2026-10-12 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special ele… |
CVE-2026-108936 | Low | 2.4 | 2026-10-12 | A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The ma… |
CVE-2026-108935 | Low | 2.4 | 2026-10-12 | A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the component P… |
CVE-2026-90920 | Critical | 9.8 | 2026-10-12 | IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation. |
CVE-2026-108934 | Low | 2.4 | 2026-10-12 | A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the co… |
CVE-2026-108933 | Low | 2.4 | 2026-10-12 | A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site… |
CVE-2026-108932 | Medium | 4.3 | 2026-10-12 | A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP Hostname Han… |
CVE-2026-18537 | High | 8.7 | 2026-10-12 | IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container… |
CVE-2026-18533 | Medium | 6.5 | 2026-10-12 | IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container… |
CVE-2026-108931 | Medium | 4.3 | 2026-10-12 | A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP Handler. The ma… |
CVE-2026-108920 | Medium | 4.3 | 2026-10-12 | A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php… |
CVE-2026-108919 | Medium | 4.3 | 2026-10-12 | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php o… |
CVE-2026-109347 | High | 7.2 | 2026-10-12 | Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by pre… |
CVE-2026-109308 | High | 8.8 | 2026-10-12 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without… |
CVE-2026-108908 | Low | 2.4 | 2026-10-12 | A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi… |
CVE-2026-107248 | High | 8.8 | 2026-10-12 | Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages”… |
CVE-2026-108898 | Low | 3.5 | 2026-10-12 | A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the argument… |
CVE-2026-103537 | Medium | 5.4 | 2026-10-12 | Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate(… |
CVE-2026-103535 | High | 8.8 | 2026-10-12 | Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. Th… |
CVE-2026-109199 | High | 8.8 | 2026-10-12 | LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity… |
CVE-2026-108834 | Medium | 4.3 | 2026-10-12 | A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Para… |
CVE-2026-108827 | Medium | 4.1 | 2026-10-12 | A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the comp… |
CVE-2026-108816 | Medium | 6.3 | 2026-10-12 | A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component P… |
CVE-2026-108815 | Low | 3.5 | 2026-10-12 | A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scriptin… |
CVE-2026-108802 | Low | 3.5 | 2026-10-12 | A weakness has been identified in y_project RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictio… |
CVE-2026-108566 | Low | 3.5 | 2026-10-11 | A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/inde… |
CVE-2026-62098 | Medium | 6.5 | 2026-10-10 | Unauthenticated Content Injection in Boutique <= 2.3.3 versions. |
CVE-2026-42696 | Critical | 10.0 | 2026-10-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-… |
CVE-2026-39802 | High | 8.1 | 2026-10-10 | Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions. |
CVE-2026-108598 | Critical | 9.8 | 2026-10-10 | Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricte… |
CVE-2026-108593 | Medium | 6.4 | 2026-10-10 | 9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated das… |
CVE-2026-103071 | High | 7.5 | 2026-10-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer a… |
CVE-2026-108551 | Critical | 9.8 | 2026-10-10 | openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by… |
CVE-2026-97670 | Critical | 9.1 | 2026-10-10 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin n… |
CVE-2026-104021 | High | 7.2 | 2026-10-10 | The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache_settings[cache_coo… |
CVE-2026-108259 | High | 8.2 | 2026-10-09 | Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorpor… |
CVE-2026-78797 | Critical | 9.8 | 2026-10-09 | An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua. |