Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-103997 | Medium CVSS 6.5 |
- Applications & supply chain |
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,… | 31 Oct 2026 |
| CVE-2026-103962 | Medium CVSS 6.1 |
- Applications & supply chain |
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend… | 31 Oct 2026 |
| CVE-2025-9462 | Medium CVSS 6.5 |
- Applications & supply chain |
The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions… | 31 Oct 2026 |
| CVE-2025-11455 | Medium CVSS 4.3 |
- Applications & supply chain |
The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… | 31 Oct 2026 |
| CVE-2026-90960 | Medium CVSS 5.3 |
- Applications & supply chain |
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… | 31 Oct 2026 |
| CVE-2026-88942 | Medium CVSS 6.1 |
- Applications & supply chain |
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-120019 | Medium CVSS 5.4 |
- Applications & supply chain |
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in… | 31 Oct 2026 |
| CVE-2026-11396 | Medium CVSS 5.3 |
- Applications & supply chain |
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information… | 31 Oct 2026 |
| CVE-2026-119980 | Medium CVSS 6.5 |
- Applications & supply chain |
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-116546 | Medium CVSS 6.4 |
- Applications & supply chain |
The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable… | 31 Oct 2026 |
| CVE-2026-111109 | Medium CVSS 6.1 |
- Applications & supply chain |
The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag… | 31 Oct 2026 |
| CVE-2026-110251 | Medium CVSS 5.4 |
- Applications & supply chain |
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in… | 31 Oct 2026 |
| CVE-2026-107765 | Medium CVSS 6.4 |
- Applications & supply chain |
The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in… | 31 Oct 2026 |
| CVE-2026-92294 | Medium CVSS 6.5 |
- Applications & supply chain |
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file… | 31 Oct 2026 |
| CVE-2026-82214 | Medium CVSS 5.3 |
- Applications & supply chain |
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before… | 31 Oct 2026 |
| CVE-2026-118629 | Medium CVSS 5.3 |
- Applications & supply chain |
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before… | 31 Oct 2026 |
| CVE-2026-118438 | Medium CVSS 6.8 |
- Applications & supply chain |
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before… | 31 Oct 2026 |
| CVE-2026-118184 | Medium CVSS 5.3 |
- Applications & supply chain |
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the… | 31 Oct 2026 |
| CVE-2026-116563 | Medium CVSS 5.4 |
- Applications & supply chain |
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored… | 31 Oct 2026 |
| CVE-2026-110808 | Medium CVSS 4.2 |
- Applications & supply chain |
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role… | 31 Oct 2026 |
| CVE-2026-101326 | Medium CVSS 5.4 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-100155 | Medium CVSS 6.5 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-63401 | Medium CVSS 5.3 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and… | 30 Oct 2026 |
| CVE-2026-63399 | Medium CVSS 6.9 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg`… | 30 Oct 2026 |
| CVE-2026-62277 | Medium CVSS 6.5 |
- Applications & supply chain |
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8,… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.