Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-66570 | High CVSS 7.1 |
- Applications & supply chain |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss… | 1 Nov 2026 |
| CVE-2026-120232 | High CVSS 8.5 |
- Applications & supply chain |
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the… | 1 Nov 2026 |
| CVE-2026-120224 | High CVSS 8.6 |
- Applications & supply chain |
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function… | 1 Nov 2026 |
| CVE-2026-120135 | High CVSS 8.2 |
- Applications & supply chain |
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0.… | 31 Oct 2026 |
| CVE-2026-76010 | High CVSS 8.8 |
- Applications & supply chain |
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code… | 31 Oct 2026 |
| CVE-2026-120114 | High CVSS 7.2 |
- Applications & supply chain |
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored… | 31 Oct 2026 |
| CVE-2026-109197 | High CVSS 7.5 |
- Applications & supply chain |
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all… | 31 Oct 2026 |
| CVE-2026-120075 | High CVSS 7.2 |
- Applications & supply chain |
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and… | 31 Oct 2026 |
| CVE-2026-116086 | High CVSS 8.8 |
- Applications & supply chain |
A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an… | 31 Oct 2026 |
| CVE-2026-114217 | High CVSS 8.6 |
- Applications & supply chain |
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in… | 31 Oct 2026 |
| CVE-2026-110530 | High CVSS 7.2 |
- Applications & supply chain |
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,… | 31 Oct 2026 |
| CVE-2026-118057 | High CVSS 7.2 |
- Applications & supply chain |
The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-120040 | High CVSS 7.5 |
- Applications & supply chain |
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,… | 31 Oct 2026 |
| CVE-2026-119163 | High CVSS 7.5 |
- Applications & supply chain |
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-119162 | High CVSS 7.2 |
- Applications & supply chain |
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to… | 31 Oct 2026 |
| CVE-2026-119089 | High CVSS 7.2 |
- Applications & supply chain |
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-119065 | High CVSS 7.2 |
- Applications & supply chain |
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-118070 | High CVSS 7.2 |
- Applications & supply chain |
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in… | 31 Oct 2026 |
| CVE-2026-116548 | High CVSS 7.2 |
- Applications & supply chain |
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-116522 | High CVSS 7.2 |
- Applications & supply chain |
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'… | 31 Oct 2026 |
| CVE-2026-115840 | High CVSS 7.2 |
- Applications & supply chain |
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-107750 | High CVSS 7.2 |
- Applications & supply chain |
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-107653 | High CVSS 7.2 |
- Applications & supply chain |
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &… | 31 Oct 2026 |
| CVE-2026-119977 | High CVSS 8.1 |
- Applications & supply chain |
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable,… | 31 Oct 2026 |
| CVE-2026-118638 | High CVSS 7.5 |
- Applications & supply chain |
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that… | 31 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.