CVE-2026-108860 | Critical | 9.1 | 2026-10-11 | BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded… |
CVE-2026-108753 | Critical | 9.4 | 2026-10-11 | Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public J… |
CVE-2026-108576 | Critical | 10.0 | 2026-10-11 | A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The mani… |
CVE-2026-86717 | Critical | 9.1 | 2026-10-11 | The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete ar… |
CVE-2026-86706 | Critical | 9.1 | 2026-10-11 | The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which opt… |
CVE-2026-85121 | Critical | 9.1 | 2026-10-11 | The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create an… |
CVE-2026-85118 | Critical | 9.8 | 2026-10-11 | The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenti… |
CVE-2026-84737 | Critical | 9.8 | 2026-10-11 | The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to… |
CVE-2026-84734 | Critical | 9.8 | 2026-10-11 | The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before aut… |
CVE-2026-84254 | Critical | 9.8 | 2026-10-11 | The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, a… |
CVE-2026-84253 | Critical | 9.8 | 2026-10-11 | The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, an… |
CVE-2026-84252 | Critical | 9.8 | 2026-10-11 | The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does… |
CVE-2026-84251 | Critical | 9.8 | 2026-10-11 | The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and… |
CVE-2026-81649 | Critical | 9.1 | 2026-10-11 | The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credentia… |
CVE-2026-108540 | Critical | 9.9 | 2026-10-11 | A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing… |
CVE-2026-104028 | Critical | 9.8 | 2026-10-11 | The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-… |
CVE-2026-108707 | Critical | 9.8 | 2026-10-11 | Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API en… |
CVE-2026-81797 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. |
CVE-2026-78535 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. |
CVE-2026-78533 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. |
CVE-2026-78531 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |
CVE-2026-78529 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. |
CVE-2026-66569 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
CVE-2026-66568 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
CVE-2026-66567 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. |
CVE-2026-66565 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
CVE-2026-66564 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
CVE-2026-66563 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. |
CVE-2026-66483 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. |
CVE-2026-66482 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. |
CVE-2026-62129 | Critical | 9.9 | 2026-10-10 | Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. |
CVE-2026-62125 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. |
CVE-2026-62124 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. |
CVE-2026-62123 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. |
CVE-2026-62120 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. |
CVE-2026-62090 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. |
CVE-2026-62087 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. |
CVE-2026-62086 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Juno <= 2.25 versions. |
CVE-2026-62077 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. |
CVE-2026-62076 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions. |
CVE-2026-62054 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. |
CVE-2026-62053 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. |
CVE-2026-62052 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. |
CVE-2026-62051 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. |
CVE-2026-62050 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. |
CVE-2026-62032 | Critical | 9.8 | 2026-10-10 | Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. |
CVE-2026-62031 | Critical | 9.3 | 2026-10-10 | Unauthenticated SQL Injection in uListing <= 2.2.0 versions. |
CVE-2026-62025 | Critical | 9.0 | 2026-10-10 | Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions. |
CVE-2026-62024 | Critical | 9.9 | 2026-10-10 | Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions. |
CVE-2026-62022 | Critical | 9.8 | 2026-10-10 | Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions. |
CVE-2026-42723 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. |
CVE-2026-42719 | Critical | 9.8 | 2026-10-10 | Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. |
CVE-2026-42718 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. |
CVE-2026-42716 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. |
CVE-2026-42696 | Critical | 10.0 | 2026-10-10 | Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions. |
CVE-2026-40800 | Critical | 9.3 | 2026-10-10 | Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions. |
CVE-2026-39801 | Critical | 9.8 | 2026-10-10 | Subscriber Privilege Escalation in AIWU <= 1.5.9 versions. |
CVE-2026-108598 | Critical | 9.8 | 2026-10-10 | Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricte… |
CVE-2026-106610 | Critical | 9.8 | 2026-10-10 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affec… |
CVE-2026-105892 | Critical | 9.8 | 2026-10-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddy… |
CVE-2026-105889 | Critical | 9.3 | 2026-10-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Bli… |
CVE-2026-104398 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injecti… |
CVE-2026-108551 | Critical | 9.8 | 2026-10-10 | openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by… |
CVE-2026-93945 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0. |
CVE-2026-93944 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15. |
CVE-2026-93943 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0. |
CVE-2026-93942 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0. |
CVE-2026-93941 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2. |
CVE-2026-93940 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0. |
CVE-2026-93938 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7. |
CVE-2026-93937 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0. |
CVE-2026-93936 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4. |
CVE-2026-93935 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through… |
CVE-2026-93934 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13. |
CVE-2026-93933 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1… |
CVE-2026-93932 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through… |
CVE-2026-93931 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0. |
CVE-2026-93930 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0. |
CVE-2026-93929 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.1… |
CVE-2026-93927 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0. |
CVE-2026-62046 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2… |
CVE-2026-62045 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through… |
CVE-2026-104803 | Critical | 9.8 | 2026-10-10 | The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters… |
CVE-2026-104801 | Critical | 9.1 | 2026-10-10 | The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validatio… |
CVE-2026-97670 | Critical | 9.1 | 2026-10-10 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin n… |
CVE-2026-103889 | Critical | 9.8 | 2026-10-10 | The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'x… |
CVE-2026-94589 | Critical | 9.8 | 2026-10-10 | The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all version… |
CVE-2026-107645 | Critical | 9.1 | 2026-10-10 | The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_reg… |
CVE-2026-104732 | Critical | 9.8 | 2026-10-10 | The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists beca… |
CVE-2026-108474 | Critical | 9.8 | 2026-10-10 | In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions |
CVE-2026-108264 | Critical | 9.1 | 2026-10-09 | Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied… |
CVE-2026-108263 | Critical | 9.9 | 2026-10-09 | Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workf… |
CVE-2026-108261 | Critical | 9.3 | 2026-10-09 | Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index… |
CVE-2026-107845 | Critical | 9.3 | 2026-10-09 | Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is re… |
CVE-2026-15340 | Critical | 9.8 | 2026-10-09 | lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. |
CVE-2026-108109 | Critical | 9.1 | 2026-10-09 | PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauth… |
CVE-2026-108107 | Critical | 9.8 | 2026-10-09 | PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request param… |
CVE-2026-105278 | Critical | 9.8 | 2026-10-09 | The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the ma… |
CVE-2026-100730 | Critical | 9.8 | 2026-10-09 | A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker mu… |
CVE-2026-86405 | Critical | 9.8 | 2026-10-09 | Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signatu… |