Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 330new in the last 7 days
- 8added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-116563 | Medium CVSS 5.4 |
- Applications & supply chain |
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored… | 31 Oct 2026 |
| CVE-2026-116520 | High CVSS 7.2 |
- Applications & supply chain |
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment /… | 31 Oct 2026 |
| CVE-2026-110808 | Medium CVSS 4.2 |
- Applications & supply chain |
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role… | 31 Oct 2026 |
| CVE-2026-109997 | High CVSS 7.2 |
- Applications & supply chain |
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-109234 | High CVSS 7.2 |
- Applications & supply chain |
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress… | 31 Oct 2026 |
| CVE-2026-101326 | Medium CVSS 5.4 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-100155 | Medium CVSS 6.5 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-63401 | Medium CVSS 5.3 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and… | 30 Oct 2026 |
| CVE-2026-63400 | Low CVSS 2.3 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `resetPasswordForToken` updates the… | 30 Oct 2026 |
| CVE-2026-63399 | Medium CVSS 6.9 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg`… | 30 Oct 2026 |
| CVE-2026-63396 | High CVSS 8.7 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query… | 30 Oct 2026 |
| CVE-2026-63393 | High CVSS 8.7 |
- Applications & supply chain |
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0… | 30 Oct 2026 |
| CVE-2026-63346 | High CVSS 8.6 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter… | 30 Oct 2026 |
| CVE-2026-63345 | High CVSS 8.6 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object… | 30 Oct 2026 |
| CVE-2026-63344 | High CVSS 8.6 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in… | 30 Oct 2026 |
| CVE-2026-63339 | High CVSS 8.8 |
- Applications & supply chain |
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an… | 30 Oct 2026 |
| CVE-2026-63338 | High CVSS 8.3 |
- Applications & supply chain |
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an… | 30 Oct 2026 |
| CVE-2026-63224 | High CVSS 7.2 |
- Applications & supply chain |
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV… | 30 Oct 2026 |
| CVE-2026-63184 | High CVSS 7.1 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet… | 30 Oct 2026 |
| CVE-2026-62277 | Medium CVSS 6.5 |
- Applications & supply chain |
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8,… | 30 Oct 2026 |
| CVE-2026-55147 | Medium CVSS 6.3 |
- Applications & supply chain |
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and… | 30 Oct 2026 |
| CVE-2026-55146 | Medium CVSS 4.3 |
- Applications & supply chain |
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and… | 30 Oct 2026 |
| CVE-2026-16760 | High CVSS 8.8 |
- Applications & supply chain |
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the… | 30 Oct 2026 |
| CVE-2026-111578 | High CVSS 7.5 |
- Applications & supply chain |
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape… | 30 Oct 2026 |
| CVE-2026-62991 | Medium CVSS 6.5 |
- Applications & supply chain |
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.