Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-119166 | Medium CVSS 5.3 |
- Identity & access |
The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,… | 31 Oct 2026 |
| CVE-2026-109386 | Medium CVSS 4.3 |
- Identity & access |
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization… | 31 Oct 2026 |
| CVE-2026-109217 | Medium CVSS 5.3 |
- Identity & access |
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure… | 31 Oct 2026 |
| CVE-2026-62860 | Medium CVSS 5.3 |
- Identity & access |
Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login`… | 30 Oct 2026 |
| CVE-2026-62337 | Medium CVSS 6.9 |
- Identity & access |
SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof… | 30 Oct 2026 |
| CVE-2026-55493 | Medium CVSS 6.5 |
- Identity & access |
HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.