Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-119980 | Medium CVSS 6.5 |
- Applications & supply chain |
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-119166 | Medium CVSS 5.3 |
- Identity & access |
The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,… | 31 Oct 2026 |
| CVE-2026-116546 | Medium CVSS 6.4 |
- Applications & supply chain |
The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable… | 31 Oct 2026 |
| CVE-2026-111109 | Medium CVSS 6.1 |
- Applications & supply chain |
The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag… | 31 Oct 2026 |
| CVE-2026-110251 | Medium CVSS 5.4 |
- Applications & supply chain |
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in… | 31 Oct 2026 |
| CVE-2026-109386 | Medium CVSS 4.3 |
- Identity & access |
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to authorization… | 31 Oct 2026 |
| CVE-2026-109217 | Medium CVSS 5.3 |
- Identity & access |
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure… | 31 Oct 2026 |
| CVE-2026-107765 | Medium CVSS 6.4 |
- Applications & supply chain |
The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in… | 31 Oct 2026 |
| CVE-2026-94361 | Medium CVSS 5.3 |
- Network & security devices |
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an… | 31 Oct 2026 |
| CVE-2026-92294 | Medium CVSS 6.5 |
- Applications & supply chain |
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file… | 31 Oct 2026 |
| CVE-2026-82214 | Medium CVSS 5.3 |
- Applications & supply chain |
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before… | 31 Oct 2026 |
| CVE-2026-118629 | Medium CVSS 5.3 |
- Applications & supply chain |
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before… | 31 Oct 2026 |
| CVE-2026-118438 | Medium CVSS 6.8 |
- Applications & supply chain |
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before… | 31 Oct 2026 |
| CVE-2026-118184 | Medium CVSS 5.3 |
- Applications & supply chain |
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the… | 31 Oct 2026 |
| CVE-2026-116563 | Medium CVSS 5.4 |
- Applications & supply chain |
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored… | 31 Oct 2026 |
| CVE-2026-110808 | Medium CVSS 4.2 |
- Applications & supply chain |
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role… | 31 Oct 2026 |
| CVE-2026-110042 | Medium CVSS 4.9 |
- Network & security devices |
The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays… | 31 Oct 2026 |
| CVE-2026-101326 | Medium CVSS 5.4 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-100155 | Medium CVSS 6.5 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-77152 | Medium CVSS 5.3 |
- Operating systems & software |
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field… | 31 Oct 2026 |
| CVE-2026-63410 | Medium CVSS 5.9 |
- Operating systems & software |
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time… | 30 Oct 2026 |
| CVE-2026-63402 | Medium CVSS 5.9 |
- Operating systems & software |
i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js`… | 30 Oct 2026 |
| CVE-2026-63401 | Medium CVSS 5.3 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and… | 30 Oct 2026 |
| CVE-2026-63399 | Medium CVSS 6.9 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg`… | 30 Oct 2026 |
| CVE-2026-61725 | Medium CVSS 6.1 |
- Operating systems & software |
sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.