By publication date

Exploited and new serious CVEs: October 2026

8,743 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 86 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-119645No exploit	ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoceasysoft · zentaopms · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-119649No exploit	Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Checkorchardcms · orchard · CWE-863 Broken access control (IDOR)	High7.1	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-119654No exploit	DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorizationdevlive-community · datacap · CWE-862 Broken access control (IDOR)	High8.7	—	0.4%	Oct 30, 2026
34Monitor	CVE-2026-119655No exploit	CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageListcoreunion · coreshop · CWE-89 Pre-auth SQL injection	High8.7	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-119656No exploit	CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageListcoreunion · coreshop · CWE-89 Pre-auth SQL injection	High8.7	—	0.3%	Oct 30, 2026
37Monitor	CVE-2026-119660No exploit	MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Keyyincongcyincong · musebot · CWE-1394 Pre-auth Auth bypass	Critical9.3	—	0.5%	Oct 30, 2026
34Monitor	CVE-2026-119662No exploit	Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backendsongloft-org · songloft · CWE-798 Pre-auth Hard-coded credentials	High8.7	—	0.4%	Oct 30, 2026
34Monitor	CVE-2026-119680No exploit	Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Featuremanageengine · sharepoint manager plus · CWE-79 XSS	High8.5	—	0.2%	Oct 30, 2026
31Monitor	CVE-2026-119682No exploit	Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plusmanageengine · sharepoint manager plus · CWE-862 Pre-auth Broken access control (IDOR)	High7.9	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-45144No exploit	Chamilo LMS: Stored XSS in public user-profile fieldschamilo · chamilo-lms · CWE-79 XSS	High8.9	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-45145No exploit	Chamilo LMS: Database-backed PHP object injection in career deserializationchamilo · chamilo-lms · CWE-502 RCE SQL injection Deserialization	High7.5	—	0.3%	Oct 30, 2026
29Monitor	CVE-2026-61626No exploit	libass: Out-of-bounds bit clears for negative Matroska ReadOrder valueslibass · libass · CWE-787 Memory safety	High7.3	—	0.1%	Oct 30, 2026
29Monitor	CVE-2026-61627No exploit	libass: Out-of-bounds read and write in wrap_lines_measurelibass · libass · CWE-125 Memory safety	High7.3	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-61708No exploit	SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)socfortress · copilot · CWE-284 Broken access control (IDOR)	High8.5	—	0.3%	Oct 30, 2026
39Monitor	CVE-2026-61728No exploit	SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeoversocfortress · copilot · CWE-79 XSS	Critical9.9	—	0.4%	Oct 30, 2026
37Monitor	CVE-2026-61729No exploit	SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injectionsocfortress · copilot · CWE-306 Pre-auth Auth bypass	Critical9.4	—	0.3%	Oct 30, 2026
37Monitor	CVE-2026-61730No exploit	SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mountsocfortress · copilot · CWE-200 Pre-auth Info leak	Critical9.3	—	0.3%	Oct 30, 2026
39Monitor	CVE-2026-61737No exploit	ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-adminhuajian123 · ng-antd-admin · CWE-321 Pre-auth Auth bypass Hard-coded credentials	Critical9.8	—	0.5%	Oct 30, 2026
40Plan	CVE-2026-61738No exploit	SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)socfortress · copilot · CWE-22 pre-auth RCE Path traversal	Critical10.0	—	0.5%	Oct 30, 2026
30Monitor	CVE-2026-61739No exploit	SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)socfortress · copilot · CWE-287 Pre-auth Auth bypass	High7.5	—	0.3%	Oct 30, 2026
37Monitor	CVE-2026-93327No exploit	Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Executiongoogle cloud · application integration · CWE-502 RCE Deserialization	Critical9.4	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-104061No exploit	Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via PSD Image Loaderscribus · scribus · CWE-787 Memory safety	High8.5	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-104062No exploit	Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT Pixmap Loaderscribus · scribus · CWE-787 Memory safety	High8.5	—	0.2%	Oct 30, 2026
34Monitor	CVE-2026-104064No exploit	Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer Handlingscribus · scribus · CWE-190 Memory safety	High8.5	—	0.2%	Oct 30, 2026
34Monitor	CVE-2026-104065No exploit	Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via Micrografx Draw Importscribus · scribus · CWE-787 Memory safety	High8.5	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-104066No exploit	Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpackingscribus · scribus · CWE-787 Memory safety	High8.5	—	0.2%	Oct 30, 2026
34Monitor	CVE-2026-104067No exploit	Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Memory Access via SVM Import Pluginscribus · scribus · CWE-787 Memory safety	High8.5	—	0.1%	Oct 30, 2026
31Monitor	CVE-2026-104615No exploit	Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespacesuse · rancher · CWE-290 Auth bypass	High7.9	—	0.2%	Oct 30, 2026
21Monitor	CVE-2026-117182Proof of concept	An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to exeCWE-79 RCE XSS	Medium5.4	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-117183Proof of concept	A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory,CWE-22 Pre-auth Path traversal	High7.5	—	0.4%	Oct 30, 2026
30Monitor	CVE-2026-117184Proof of concept	An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to tCWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 30, 2026
28Monitor	CVE-2026-118238Proof of concept	The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validattenda · w18e · CWE-78 RCE Auth bypass Command injection	High7.2	—	1.5%	Oct 30, 2026
32Monitor	CVE-2026-119287No exploit	Zuke: Command-form registry descriptors bypass the MCP launch policyzuke-build · zuke · CWE-862 Broken access control (IDOR)	High8.0	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-119288No exploit	Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command linezuke-build · zuke · CWE-78 RCE Command injection	High7.0	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-119289No exploit	Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gatezuke-build · zuke · CWE-345	High7.1	—	0.1%	Oct 30, 2026
30Monitor	CVE-2026-119290No exploit	Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runzuke-build · zuke · CWE-532 Pre-auth Info leak	High7.5	—	0.4%	Oct 30, 2026
37Monitor	CVE-2026-119706No exploit	LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserializationinternlm · lmdeploy · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	1.0%	Oct 30, 2026
28Monitor	CVE-2026-119707No exploit	SonicJS through 3.0.0 Missing Authorization in Content Write APIsonicjs-org · sonicjs · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-119708No exploit	abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Namecolinin · abp-next-admin · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-119710No exploit	PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Routepipeshub-ai · pipeshub-ai · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Oct 30, 2026
21Monitor	CVE-2026-119712Proof of concept	PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documentspipeshub-ai · pipeshub-ai · CWE-918 SSRF	Medium5.3	—	0.2%	Oct 30, 2026
34Monitor	CVE-2026-119713No exploit	Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commandspaperclipai · @paperclipai/server · CWE-78 RCE Command injection	High8.7	—	0.7%	Oct 30, 2026
37Monitor	CVE-2026-119716No exploit	pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segmentswbond · pybars3 · CWE-94 pre-auth RCE	Critical9.3	—	0.4%	Oct 30, 2026
34Monitor	CVE-2026-119718No exploit	Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cacheblender · blender · CWE-190 Memory safety	High8.5	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-119719No exploit	Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extractionblender · blender · CWE-190 Memory safety	High8.5	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-119722No exploit	Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()blender · blender · CWE-125 Memory safety	High8.5	—	0.1%	Oct 30, 2026
39Monitor	CVE-2025-49602No exploit	An issue was discovered in Keyfactor EJBCA 9.CWE-613 Pre-auth	Critical9.8	—	0.4%	Oct 30, 2026
25Monitor	CVE-2026-104623Proof of concept	Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management clustersuse · rancher · CWE-290 Auth bypass	Medium6.3	—	0.2%	Oct 30, 2026
40Plan	CVE-2026-112816Proof of concept	Improper certificate validation in the HTTPS listener in LXDcanonical · lxd · CWE-295 Pre-auth Weak crypto	Critical10.0	—	0.3%	Oct 30, 2026
33Monitor	CVE-2026-115642No exploit	In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-openstack · keystonemiddleware · CWE-863 Broken access control (IDOR)	High8.3	—	0.5%	Oct 30, 2026
34Monitor	CVE-2026-119116No exploit	Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-caws · kmstool-enclave · CWE-415 RCE Memory safety	High8.7	—	0.1%	Oct 30, 2026
32Monitor	CVE-2026-119148No exploit	Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpointaws · aws-nitro-enclaves-sdk-c · CWE-807	High8.2	—	0.1%	Oct 30, 2026
32Monitor	CVE-2026-61804No exploit	myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Managementmytinywms · mytinywms · CWE-79 XSS	High8.1	—	0.2%	Oct 30, 2026
40Plan	CVE-2026-61826No exploit	Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgerymorpheus65535 · bazarr · CWE-352 Pre-auth SSRF CSRF	Critical10.0	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-65566No exploit	WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerabilitymeow apps · ai engine · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Oct 30, 2026
34Monitor	CVE-2025-8574No exploit	Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletiontigroumeow · database cleaner: cleanup, optimization & repair · CWE-284 Broken access control (IDOR)	High8.7	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-104744No exploit	Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameterindependent analytics · independent analytics pro · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 30, 2026
35Monitor	CVE-2026-105894No exploit	Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Updateakbilisim · ak framework · CWE-269	High8.8	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-107630No exploit	Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_ordsaadiqbal · email templates customizer and designer for wordpress and woocommerce · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.5%	Oct 30, 2026
30Monitor	CVE-2026-110305No exploit	Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injehwk-fr · advanced custom fields: extended · CWE-200 Pre-auth Info leak	High7.5	—	0.6%	Oct 30, 2026
28Monitor	CVE-2026-112365No exploit	easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameterwpdevteam · easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solution · CWE-79 Pre-auth XSS	High7.2	—	0.5%	Oct 30, 2026
32Monitor	CVE-2026-115346No exploit	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Fieldthemefusion · avada \| website builder for wordpress & woocommerce · CWE-434 pre-auth RCE File upload	High8.1	—	0.6%	Oct 30, 2026
29Monitor	CVE-2026-118205No exploit	Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revisionwpdevteam · essential addons for elementor – popular elementor templates & widgets · CWE-269 Pre-auth	High7.4	—	0.4%	Oct 30, 2026
32Monitor	CVE-2026-118696No exploit	In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026jetbrains · intellij idea · CWE-299 Pre-auth	High8.0	—	0.2%	Oct 30, 2026
36Monitor	CVE-2026-118697No exploit	In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 20jetbrains · toolbox app · CWE-295 Pre-auth Weak crypto	Critical9.0	—	0.2%	Oct 30, 2026
32Monitor	CVE-2026-119086No exploit	Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernelfreertos · freertos-kernel · CWE-121 Local privilege escalation Memory safety	High8.2	—	0.1%	Oct 30, 2026
34Monitor	CVE-2026-119760No exploit	sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()dlundquist · sniproxy · CWE-476 Pre-auth Memory safety	High8.7	—	0.4%	Oct 30, 2026
34Monitor	CVE-2026-119762No exploit	Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requestsaxigen · axigen mail server · CWE-674 Pre-auth Denial of service	High8.7	—	0.5%	Oct 30, 2026
29Monitor	CVE-2026-119764No exploit	Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Previewits-a-feature · mythic · CWE-79 Pre-auth XSS	High7.4	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-119777No exploit	Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parserred hat · red hat enterprise linux 10 · CWE-787 Pre-auth Memory safety	High8.8	—	0.5%	Oct 30, 2026
36Monitor	CVE-2026-119978No exploit	Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreflowiseai · flowise · CWE-749 RCE	Critical9.0	—	0.3%	Oct 30, 2026
34Monitor	CVE-2026-119979No exploit	LM Studio before 0.4.22+1 Path Traversal via Model Downloaderelement labs · lm studio · CWE-22 Pre-auth Path traversal	High8.7	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-76012No exploit	Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Uplosmub · photo gallery, sliders, proofing and themes – nextgen gallery · CWE-434 RCE File upload	High7.5	—	0.8%	Oct 30, 2026
28Monitor	CVE-2026-84243No exploit	gettext: Directory traversal via the LANGUAGE environment variablethe gnu c library · glibc · CWE-22 RCE Path traversal Local privilege escalation	High7.0	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-96894No exploit	ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Bodywedevs · erp: complete hr, accounting & crm suite built for woocommerce · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-97638No exploit	Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameterwpmudev · forminator forms – contact form, payment form & custom form builder · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.5%	Oct 30, 2026
28Monitor	CVE-2026-105077No exploit	WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerabilityspacetime · ad inserter · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 30, 2026
39Monitor	CVE-2026-116386No exploit	WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerabilitycozy vision technologies pvt. ltd. · sms alert order notifications · CWE-266 Pre-auth	Critical9.8	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-116401No exploit	WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerabilityrealmag777 · husky · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-116405No exploit	WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · vikrentcar · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-116847No exploit	WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilitykitae park · mang board wp · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-116851No exploit	WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerabilityimplecode · ecommerce product catalog · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 30, 2026
36Monitor	CVE-2026-116852No exploit	WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerabilitymarketing fire · widget options · CWE-94 RCE	Critical9.1	—	0.5%	Oct 30, 2026
30Monitor	CVE-2026-116861No exploit	WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilitywpdesk · flexible chat · CWE-201 Pre-auth	High7.5	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-116862No exploit	WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerabilityacato · wp rest cache · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-118086No exploit	WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerabilityhakan ozevin · wp base booking · CWE-266	High8.8	—	0.3%	Oct 30, 2026
28Monitor	CVE-2026-118089No exploit	WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerabilityrextheme · product feed manager · CWE-502 Deserialization	High7.2	—	0.3%	Oct 30, 2026
35Monitor	CVE-2026-118090No exploit	WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerabilitystylemix · masterstudy lms · CWE-502 Deserialization	High8.8	—	0.4%	Oct 30, 2026
32Monitor	CVE-2026-119117No exploit	Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Javaaws · amazon-kinesis-producer · CWE-214	High8.2	—	0.1%	Oct 30, 2026
39Monitor	CVE-2026-119526No exploit	WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerabilitythemerex · royal event · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.4%	Oct 30, 2026
28Monitor	CVE-2026-28160No exploit	WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · vikrentcar · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 30, 2026
37Monitor	CVE-2026-39732Proof of concept	WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerabilityivijan-stefan stipic · transliterator · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Oct 30, 2026
30Monitor	CVE-2026-39734No exploit	WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerabilitysaad iqbal · wp easypay · CWE-35 Pre-auth Path traversal	High7.5	—	0.4%	Oct 30, 2026
39Monitor	CVE-2026-39738No exploit	WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerabilityfunnelkit · funnelkit automations · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.4%	Oct 30, 2026
28Monitor	CVE-2026-39786No exploit	WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerabilitybookingalgorithms · ba book everything · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-46560No exploit	OpenAM Authentication Bypass via RADIUS Spoofingopenidentityplatform · openam · CWE-347 Pre-auth Auth bypass Weak crypto	High7.5	—	0.1%	Oct 30, 2026
28Monitor	CVE-2026-48201No exploit	WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerabilityraul p. · fast velocity minify · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 30, 2026
28Monitor	CVE-2026-54855No exploit	WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilitycozmoslabs · profile builder · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 30, 2026
30Monitor	CVE-2026-59978No exploit	AdminNeo: version-cache array injection causes persistent denial of serviceadminneo-org · adminneo · CWE-20 Pre-auth CSRF Denial of service	High7.5	—	0.6%	Oct 30, 2026
32Monitor	CVE-2026-61586No exploit	Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)copernik-eu · copernik-xml-factory · CWE-611 Pre-auth SSRF XXE	High8.2	—	0.3%	Oct 30, 2026

CVE-2026-119645
28Monitor
ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
easysoft · zentaopmsOct 30, 2026
CVE-2026-119649
28Monitor
Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
orchardcms · orchardOct 30, 2026
CVE-2026-119654
34Monitor
DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
devlive-community · datacapOct 30, 2026
CVE-2026-119655
34Monitor
CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SQL injection
coreunion · coreshopOct 30, 2026
CVE-2026-119656
34Monitor
CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SQL injection
coreunion · coreshopOct 30, 2026
CVE-2026-119660
37Monitor
MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
yincongcyincong · musebotOct 30, 2026
CVE-2026-119662
34Monitor
Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
songloft-org · songloftOct 30, 2026
CVE-2026-119680
34Monitor
Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
HighCVSS 8.5No exploitEPSS 0%
- XSS
manageengine · sharepoint manager plusOct 30, 2026
CVE-2026-119682
31Monitor
Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus
HighCVSS 7.9No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
manageengine · sharepoint manager plusOct 30, 2026
CVE-2026-45144
35Monitor
Chamilo LMS: Stored XSS in public user-profile fields
HighCVSS 8.9No exploitEPSS 0%
- XSS
chamilo · chamilo-lmsOct 30, 2026
CVE-2026-45145
30Monitor
Chamilo LMS: Database-backed PHP object injection in career deserialization
HighCVSS 7.5No exploitEPSS 0%
- RCE
- SQL injection
- Deserialization
chamilo · chamilo-lmsOct 30, 2026
CVE-2026-61626
29Monitor
libass: Out-of-bounds bit clears for negative Matroska ReadOrder values
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
libass · libassOct 30, 2026
CVE-2026-61627
29Monitor
libass: Out-of-bounds read and write in wrap_lines_measure
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
libass · libassOct 30, 2026
CVE-2026-61708
34Monitor
SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
socfortress · copilotOct 30, 2026
CVE-2026-61728
39Monitor
SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
CriticalCVSS 9.9No exploitEPSS 0%
- XSS
socfortress · copilotOct 30, 2026
CVE-2026-61729
37Monitor
SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
socfortress · copilotOct 30, 2026
CVE-2026-61730
37Monitor
SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Info leak
socfortress · copilotOct 30, 2026
CVE-2026-61737
39Monitor
ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
huajian123 · ng-antd-adminOct 30, 2026
CVE-2026-61738
40Plan
SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- Path traversal
socfortress · copilotOct 30, 2026
CVE-2026-61739
30Monitor
SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
socfortress · copilotOct 30, 2026
CVE-2026-93327
37Monitor
Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Deserialization
google cloud · application integrationOct 30, 2026
CVE-2026-104061
34Monitor
Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via PSD Image Loader
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
scribus · scribusOct 30, 2026
CVE-2026-104062
34Monitor
Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT Pixmap Loader
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
scribus · scribusOct 30, 2026
CVE-2026-104064
34Monitor
Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Overflow via TIFF Tile Buffer Handling
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
scribus · scribusOct 30, 2026
CVE-2026-104065
34Monitor
Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Out-of-Bounds Write via Micrografx Draw Import
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
scribus · scribusOct 30, 2026
CVE-2026-104066
34Monitor
Scribus before 1.6.7 and 1.7.x before 1.7.4 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
scribus · scribusOct 30, 2026
CVE-2026-104067
34Monitor
Scribus before 1.6.7 and 1.7.x before 1.7.4 Out-of-Bounds Memory Access via SVM Import Plugin
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
scribus · scribusOct 30, 2026
CVE-2026-104615
31Monitor
Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace
HighCVSS 7.9No exploitEPSS 0%
- Auth bypass
suse · rancherOct 30, 2026
CVE-2026-117182
21Monitor
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to exe
MediumCVSS 5.4Proof of conceptEPSS 0%
- RCE
- XSS
Oct 30, 2026
CVE-2026-117183
30Monitor
A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory,
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
Oct 30, 2026
CVE-2026-117184
30Monitor
An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to t
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
Oct 30, 2026
CVE-2026-118238
28Monitor
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validat
HighCVSS 7.2Proof of conceptEPSS 1%
- RCE
- Auth bypass
- Command injection
tenda · w18eOct 30, 2026
CVE-2026-119287
32Monitor
Zuke: Command-form registry descriptors bypass the MCP launch policy
HighCVSS 8.0No exploitEPSS 0%
- Broken access control (IDOR)
zuke-build · zukeOct 30, 2026
CVE-2026-119288
28Monitor
Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Command injection
zuke-build · zukeOct 30, 2026
CVE-2026-119289
28Monitor
Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate
HighCVSS 7.1No exploitEPSS 0%
zuke-build · zukeOct 30, 2026
CVE-2026-119290
30Monitor
Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
zuke-build · zukeOct 30, 2026
CVE-2026-119706
37Monitor
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Deserialization
internlm · lmdeployOct 30, 2026
CVE-2026-119707
28Monitor
SonicJS through 3.0.0 Missing Authorization in Content Write API
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
sonicjs-org · sonicjsOct 30, 2026
CVE-2026-119708
28Monitor
abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
colinin · abp-next-adminOct 30, 2026
CVE-2026-119710
28Monitor
PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
pipeshub-ai · pipeshub-aiOct 30, 2026
CVE-2026-119712
21Monitor
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
MediumCVSS 5.3Proof of conceptEPSS 0%
- SSRF
pipeshub-ai · pipeshub-aiOct 30, 2026
CVE-2026-119713
34Monitor
Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Command injection
paperclipai · @paperclipai/serverOct 30, 2026
CVE-2026-119716
37Monitor
pybars3 through 0.9.7 and pybars4 through 0.9.13 Code Injection via Bracketed Path Segments
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
wbond · pybars3Oct 30, 2026
CVE-2026-119718
34Monitor
Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
blender · blenderOct 30, 2026
CVE-2026-119719
34Monitor
Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
blender · blenderOct 30, 2026
CVE-2026-119722
34Monitor
Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
blender · blenderOct 30, 2026
CVE-2025-49602
39Monitor
An issue was discovered in Keyfactor EJBCA 9.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
Oct 30, 2026
CVE-2026-104623
25Monitor
Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
MediumCVSS 6.3Proof of conceptEPSS 0%
- Auth bypass
suse · rancherOct 30, 2026
CVE-2026-112816
40Plan
Improper certificate validation in the HTTPS listener in LXD
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
canonical · lxdOct 30, 2026
CVE-2026-115642
33Monitor
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
openstack · keystonemiddlewareOct 30, 2026
CVE-2026-119116
34Monitor
Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Memory safety
aws · kmstool-enclaveOct 30, 2026
CVE-2026-119148
32Monitor
Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint
HighCVSS 8.2No exploitEPSS 0%
aws · aws-nitro-enclaves-sdk-cOct 30, 2026
CVE-2026-61804
32Monitor
myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management
HighCVSS 8.1No exploitEPSS 0%
- XSS
mytinywms · mytinywmsOct 30, 2026
CVE-2026-61826
40Plan
Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- SSRF
- CSRF
morpheus65535 · bazarrOct 30, 2026
CVE-2026-65566
35Monitor
WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
meow apps · ai engineOct 30, 2026
CVE-2025-8574
34Monitor
Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
tigroumeow · database cleaner: cleanup, optimization & repairOct 30, 2026
CVE-2026-104744
28Monitor
Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
independent analytics · independent analytics proOct 30, 2026
CVE-2026-105894
35Monitor
Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update
HighCVSS 8.8No exploitEPSS 0%
akbilisim · ak frameworkOct 30, 2026
CVE-2026-107630
30Monitor
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_ord
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
saadiqbal · email templates customizer and designer for wordpress and woocommerceOct 30, 2026
CVE-2026-110305
30Monitor
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Inje
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
hwk-fr · advanced custom fields: extendedOct 30, 2026
CVE-2026-112365
28Monitor
easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpdevteam · easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solutionOct 30, 2026
CVE-2026-115346
32Monitor
Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- File upload
themefusion · avada | website builder for wordpress & woocommerceOct 30, 2026
CVE-2026-118205
29Monitor
Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
wpdevteam · essential addons for elementor – popular elementor templates & widgetsOct 30, 2026
CVE-2026-118696
32Monitor
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026
HighCVSS 8.0No exploitEPSS 0%
- Pre-auth
jetbrains · intellij ideaOct 30, 2026
CVE-2026-118697
36Monitor
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 20
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
- Weak crypto
jetbrains · toolbox appOct 30, 2026
CVE-2026-119086
32Monitor
Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel
HighCVSS 8.2No exploitEPSS 0%
- Local privilege escalation
- Memory safety
freertos · freertos-kernelOct 30, 2026
CVE-2026-119760
34Monitor
sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
dlundquist · sniproxyOct 30, 2026
CVE-2026-119762
34Monitor
Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
axigen · axigen mail serverOct 30, 2026
CVE-2026-119764
29Monitor
Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XSS
its-a-feature · mythicOct 30, 2026
CVE-2026-119777
35Monitor
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
red hat · red hat enterprise linux 10Oct 30, 2026
CVE-2026-119978
36Monitor
Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore
CriticalCVSS 9.0No exploitEPSS 0%
- RCE
flowiseai · flowiseOct 30, 2026
CVE-2026-119979
34Monitor
LM Studio before 0.4.22+1 Path Traversal via Model Downloader
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
element labs · lm studioOct 30, 2026
CVE-2026-76012
30Monitor
Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Uplo
HighCVSS 7.5No exploitEPSS 0%
- RCE
- File upload
smub · photo gallery, sliders, proofing and themes – nextgen galleryOct 30, 2026
CVE-2026-84243
28Monitor
gettext: Directory traversal via the LANGUAGE environment variable
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Path traversal
- Local privilege escalation
the gnu c library · glibcOct 30, 2026
CVE-2026-96894
28Monitor
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wedevs · erp: complete hr, accounting & crm suite built for woocommerceOct 30, 2026
CVE-2026-97638
30Monitor
Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wpmudev · forminator forms – contact form, payment form & custom form builderOct 30, 2026
CVE-2026-105077
28Monitor
WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
spacetime · ad inserterOct 30, 2026
CVE-2026-116386
39Monitor
WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cozy vision technologies pvt. ltd. · sms alert order notificationsOct 30, 2026
CVE-2026-116401
30Monitor
WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
realmag777 · huskyOct 30, 2026
CVE-2026-116405
28Monitor
WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
e4jvikwp · vikrentcarOct 30, 2026
CVE-2026-116847
28Monitor
WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kitae park · mang board wpOct 30, 2026
CVE-2026-116851
28Monitor
WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
implecode · ecommerce product catalogOct 30, 2026
CVE-2026-116852
36Monitor
WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
marketing fire · widget optionsOct 30, 2026
CVE-2026-116861
30Monitor
WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
wpdesk · flexible chatOct 30, 2026
CVE-2026-116862
30Monitor
WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
acato · wp rest cacheOct 30, 2026
CVE-2026-118086
35Monitor
WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
hakan ozevin · wp base bookingOct 30, 2026
CVE-2026-118089
28Monitor
WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
rextheme · product feed managerOct 30, 2026
CVE-2026-118090
35Monitor
WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
stylemix · masterstudy lmsOct 30, 2026
CVE-2026-119117
32Monitor
Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java
HighCVSS 8.2No exploitEPSS 0%
aws · amazon-kinesis-producerOct 30, 2026
CVE-2026-119526
39Monitor
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
themerex · royal eventOct 30, 2026
CVE-2026-28160
28Monitor
WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
e4jvikwp · vikrentcarOct 30, 2026
CVE-2026-39732
37Monitor
WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
ivijan-stefan stipic · transliteratorOct 30, 2026
CVE-2026-39734
30Monitor
WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
saad iqbal · wp easypayOct 30, 2026
CVE-2026-39738
39Monitor
WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
funnelkit · funnelkit automationsOct 30, 2026
CVE-2026-39786
28Monitor
WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
bookingalgorithms · ba book everythingOct 30, 2026
CVE-2026-46560
30Monitor
OpenAM Authentication Bypass via RADIUS Spoofing
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
openidentityplatform · openamOct 30, 2026
CVE-2026-48201
28Monitor
WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
raul p. · fast velocity minifyOct 30, 2026
CVE-2026-54855
28Monitor
WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
cozmoslabs · profile builderOct 30, 2026
CVE-2026-59978
30Monitor
AdminNeo: version-cache array injection causes persistent denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- CSRF
- Denial of service
adminneo-org · adminneoOct 30, 2026
CVE-2026-61586
32Monitor
Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SSRF
- XXE
copernik-eu · copernik-xml-factoryOct 30, 2026