boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Wednesday, September 30, 2026 · all times UTC← 2026-09-29 · archive

Security Box Score — September 30, 2026 — page 2

Edition of September 30, 2026, continued — page 2 of 2. Back to page 1

Results (continued, ranked) — ranks 401–636 of 636
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-970657.1—HappyformsHappyformsCWE-79WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-970777.1—SpacetimeAd InserterCWE-79WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-972357.1—ThemeRexThemeREX AddonsCWE-79WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulner…
CVE-2026-972377.1—Crocoblock. Jetimpex Inc.JetEngineCWE-79WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-972507.1—Dylan KuhnGeo MashupCWE-79WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-972537.1—KreaturaLayerSliderCWE-79WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-972717.1—WPFunnelsWPFunnelsCWE-79WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-972727.1—PremmercePremmerce Permalink Manager for WooCommerceCWE-79WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cros…
CVE-2026-972897.1—ExpressTech SystemsQuiz And Survey MasterCWE-79WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS…
CVE-2026-972907.1—Sayontan SinhaPhotonic Gallery & Lightbox for Flickr, SmugMug & OthersCWE-79WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= …
CVE-2026-1005077.1—If-So Dynamic ContentIf-So Dynamic Content PersonalizationCWE-79WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site…
CVE-2026-1005107.1—BoldGridPost and Page Builder by BoldGridCWE-79WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Sc…
CVE-2026-1018797.1—OpenClawOpenClaw Windows NodeCWE-862OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
CVE-2026-1018817.1—OpenClawOpenClaw Windows NodeCWE-770OpenClaw Windows Node before 2026.7.1 Denial of Service
CVE-2026-1021097.1—KiteworksSecure Data FormsCWE-89Kiteworks Secure Data Forms SQL injection
CVE-2026-1023767.1—WPMU DEVBrandaCWE-79WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1023857.1—Kevin StoverNinja FormsCWE-79WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-1023917.1—jetmonstersJetFormBuilderCWE-79WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulne…
CVE-2026-1023957.1—supsysticEasy Google MapsCWE-79WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vuln…
CVE-2026-1023967.1—supsysticUltimate Maps by SupsysticCWE-79WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (…
CVE-2026-1023987.1—supsysticPopup by SupsysticCWE-79WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vu…
CVE-2026-1032427.1—Red HatRed Hat Enterprise Linux 10CWE-122Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_fil…
CVE-2026-475827.0—NVIDIAGeForceCWE-787NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel …
CVE-2026-475967.0—NVIDIAGeForceCWE-281NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475987.0—NVIDIAGeForceCWE-416NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-sour…
CVE-2026-1021277.0—KiteworksEmail Protection GatewayCWE-611Kiteworks Email Protection Gateway Improper Restriction of XML External Entit…
CVE-2026-963426.9—Amauri.IOWPMobile.AppCWE-862WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability
CVE-2026-1002756.9—JetBrainsYouTrackCWE-79In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error no…
CVE-2026-1032436.9—ModelTCLightLLMCWE-918LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
CVE-2026-1034766.9—yii2-starter-kityii2-starter-kitCWE-639yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-down…
CVE-2026-1035306.9—decolua9RouterCWE-918decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
CVE-2026-1035926.9—peceesimple-routerCWE-348simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers
CVE-2026-107266.8—Cato NetworksSDP ClientCWE-73Cato Windows SDP Client arbitrary file disclosure due to improper TLS certifi…
CVE-2026-968246.8—envatoTemplate Kit – ImportCWE-22WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vu…
CVE-2026-972426.8—phuongweboWEBO MCPCWE-22WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability
CVE-2026-475096.7—NVIDIAGeForceCWE-787NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475156.7—NVIDIAGeForceCWE-125NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475226.7—NVIDIAGeForceCWE-20NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475246.7—NVIDIAGeForceCWE-125NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475256.7—NVIDIAGeForceCWE-129NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475276.7—NVIDIAGeForceCWE-125NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475296.7—NVIDIAGeForceCWE-787NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475326.7—NVIDIAGeForceCWE-787NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475336.7—NVIDIAGeForceCWE-129NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475376.7—NVIDIAGeForceCWE-787NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475386.7—NVIDIAGeForceCWE-787NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475396.7—NVIDIAVirtual GPU ManagerCWE-681NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the ker…
CVE-2026-475426.7—NVIDIAGeForceCWE-20NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475436.7—NVIDIAGeForceCWE-20VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in th…
CVE-2026-475446.7—NVIDIAVirtual GPU ManagerCWE-125NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability in the ker…
CVE-2026-475466.7—NVIDIAGeForceCWE-20NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475476.7—NVIDIAGeForceCWE-20NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-1021416.7—KiteworksCoreCWE-73Kiteworks Core Privilege Escalation through External Control of File Name or …
CVE-2026-1021336.6—KiteworksCoreCWE-77Kiteworks Core Arbitrary File Write through Command Injection
CVE-2026-1021356.6—KiteworksEmail Protection GatewayCWE-502Kiteworks Email Protection Gateway Deserialization of Untrusted Data
CVE-2026-1021456.6—KiteworksCoreCWE-93Kiteworks Core Server-Side Request Forgery through CRLF Injection
CVE-2026-620786.5—Leap13Premium Addons for ElementorCWE-79WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Script…
CVE-2026-620796.5—QodeQi Addons For ElementorCWE-79WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS)…
CVE-2026-620806.5—LeevioHappy Addons for ElementorCWE-79WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting …
CVE-2026-620846.5—Jeff StarrUser Submitted PostsCWE-79WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS…
CVE-2026-940746.5—NSquaredSimply Schedule AppointmentsCWE-862WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Co…
CVE-2026-940776.5—10upSafe SVGCWE-79WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-946746.5—SweetCodePixel Manager for WooCommerceCWE-79WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripti…
CVE-2026-963386.5—CozmoslabsProfile BuilderCWE-79WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulner…
CVE-2026-963476.5—BooklyBooklyCWE-639WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vu…
CVE-2026-968296.5—POSIMYTHThe Plus Addons for Elementor Page Builder LiteCWE-79WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.1 - C…
CVE-2026-968346.5—NexcessGiveWPCWE-862WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability
CVE-2026-968356.5—KingAddons.comKing Addons for ElementorCWE-79WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting …
CVE-2026-970676.5—Shane BishopEWWW Image OptimizerCWE-79WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) v…
CVE-2026-972366.5—ThemeRexThemeREX AddonsCWE-79WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulner…
CVE-2026-972396.5—Jose ContiMCP Content Manager LiteCWE-862WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vu…
CVE-2026-972476.5—Creative ThemesBlocksy CompanionCWE-862WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerab…
CVE-2026-972626.5—Visual ComposerVisual Composer Website BuilderCWE-79WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scri…
CVE-2026-972656.5—Crocoblock. Jetimpex Inc.JetEngineCWE-79WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-972666.5—NexcessVirtue/Ascend/Pinnacle ToolkitCWE-79WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scri…
CVE-2026-972706.5—Justin SternbergCMB2CWE-79WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-972796.5—ChoubyPolylangCWE-79WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability
CVE-2026-972866.5—WP ChillStrong TestimonialsCWE-79WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) v…
CVE-2026-972886.5—Jayson T CoteOAuth ServerCWE-79WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-972926.5—YITHEMESYITH WooCommerce Tab ManagerCWE-79WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scriptin…
CVE-2026-972986.5—KingAddonsKing Addons for ElementorCWE-79WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting …
CVE-2026-973016.5—Cool PluginsCool Formkit LiteCWE-79WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vuln…
CVE-2026-1002746.5—JetBrainsYouTrackCWE-770In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via…
CVE-2026-1002796.5—JetBrainsYouTrackCWE-918In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed…
CVE-2026-1005136.5—AmanCF7 Views &#8211; Complete Entry Management for Contact Form 7CWE-79WordPress CF7 Views &#8211; Complete Entry Management for Contact Form 7 plug…
CVE-2026-1021246.5—KiteworksCoreCWE-306Kiteworks Core Missing Authentication for Critical Function
CVE-2026-1021396.5—KiteworksEmail Protection GatewayCWE-639Kiteworks Email Protection Gateway Incorrect Authorization
CVE-2026-1021466.5—KiteworksEmail Protection GatewayCWE-73Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side T…
CVE-2026-1023756.5—OptimoleOptimoleCWE-862WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability
CVE-2026-1023866.5—Jacob N. BreetveltWP Photo Album PlusCWE-79WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XS…
CVE-2026-1023976.5—supsysticUltimate Maps by SupsysticCWE-862WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control …
CVE-2026-1029916.5—sqlalchemymakoCWE-22Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
CVE-2026-1030016.5—jpadillapyjwtCWE-471PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-veri…
CVE-2026-475656.4—NVIDIAGeForceCWE-362NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475866.4—NVIDIAGeForceCWE-416NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-918606.3—vaadinvaadinCWE-1321Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep M…
CVE-2026-968216.3—Mahmudul Hasan ArifFluentBoardsCWE-266WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability
CVE-2026-1021366.3—KiteworksCoreCWE-93Kiteworks Core Command Execution through Configuration Injection
CVE-2026-1029836.3—withastroastroCWE-625Astro: Netlify Image CDN allowlist bypass enables SSRF
CVE-2026-1032226.3—BloscC-Blosc2CWE-189Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer ove…
CVE-2026-1033976.3—Liquid-coOpenSaveCWE-290OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender
CVE-2026-1033886.2—MISPMISPCWE-79MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source …
CVE-2026-1033896.2—MISPMISPCWE-20MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correla…
CVE-2026-475186.0—NVIDIAGeForceCWE-732NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a…
CVE-2026-551745.9—shrecUltrafastSecp256k1CWE-345UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-sign…
CVE-2026-946815.9—Tijmen SmitWP Store LocatorCWE-770WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerab…
CVE-2026-1002675.9—JetBrainsYouTrackCWE-1333In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailb…
CVE-2026-1002765.9—JetBrainsYouTrackCWE-863In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow…
CVE-2026-1021105.9—KiteworksCoreCWE-306Missing authentication on a Kiteworks appliance setup function
CVE-2026-1023845.9—Supreme ModulesSupreme Modules LiteCWE-79WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) …
CVE-2026-474925.5—NVIDIAGeForceCWE-862NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475065.5—NVIDIAGeForceCWE-121NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-…
CVE-2026-475175.5—NVIDIAGeForceCWE-476NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475345.5—NVIDIAGeForceCWE-369NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475495.5—NVIDIAGeForceCWE-476NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475555.5—NVIDIAGeForceCWE-908NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475575.5—NVIDIAGeForceCWE-476NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475665.5—NVIDIAGeForceCWE-401NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475675.5—NVIDIAGeForceCWE-400NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475685.5—NVIDIAGeForceCWE-400NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-475815.5—NVIDIAGeForceCWE-667NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel …
CVE-2026-475845.5—NVIDIAGeForceCWE-476NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel …
CVE-2026-476035.5—NVIDIAGeForceCWE-862NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-476045.5—NVIDIAGeForceCWE-862NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-972385.5—Crocoblock. Jetimpex Inc.JetEngineCWE-79WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerabi…
CVE-2026-1032295.5—AdithyaYellojuRestaurant-Management-SystemCWE-74AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script del…
CVE-2026-1032305.5—AdithyaYellojuRestaurant-Management-SystemCWE-74AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_qu…
CVE-2026-1032315.5—AdithyaYellojuRestaurant-Management-SystemCWE-74AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mys…
CVE-2026-1032325.5—AdithyaYellojuRestaurant-Management-SystemCWE-74AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sq…
CVE-2026-1032415.5—vllm-projectvLLMCWE-404vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service
CVE-2026-137205.4—GrafanaGrafana OSSCWE-285Editor can forge file-provisioning provenance on dashboards via the dashboard…
CVE-2026-620815.4—wpdeskFlexible PDF CouponsCWE-639WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object Ref…
CVE-2026-620835.4—WPFunnelsCreator LMSCWE-1284WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability
CVE-2026-941735.4—Strategy11 TeamBusiness DirectoryCWE-639WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object Refere…
CVE-2026-964505.4—pixfortpixfort CoreCWE-79WordPress pixfort Core plugin < 4.3.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-972435.4—flexymaAllAble ConnectorCWE-862WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerab…
CVE-2026-972855.4—NexcessThe Events CalendarCWE-862WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulner…
CVE-2026-972995.4—KnitPayRazorpay Payment Links for WooCommerceCWE-352WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site…
CVE-2026-1002615.4—JetBrainsYouTrackCWE-288In JetBrains YouTrack before 2026.2.18991 changing article visibility setting…
CVE-2026-1021345.4—KiteworksCoreCWE-420Kiteworks Core Unprotected Alternate Channel
CVE-2026-1023995.4—supsysticPhoto Gallery by SupsysticCWE-352WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Fo…
CVE-2026-470965.3—AJA Video SystemsHELO PlusCWE-79AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter
CVE-2026-867785.3—Maksisoft Technology, IT, and Software Industry and Trade Inc.Maksisoft GymCWE-204Username Enumeration in Maksisoft Technology's Maksisoft Gym
CVE-2026-935475.3—vaadinvaadinCWE-285Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be …
CVE-2026-945455.3—vercelsatoriCWE-116Satori-generated SVG has improper escaping
CVE-2026-946735.3—NSquaredSimply Schedule AppointmentsCWE-639WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct …
CVE-2026-970665.3—NexcessGiveWPCWE-639WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) …
CVE-2026-970785.3—BoldGridClient Invoicing by Sprout InvoicesCWE-639WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Di…
CVE-2026-972495.3—CozmoslabsPaid Member SubscriptionsCWE-290WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vu…
CVE-2026-972595.3—WP Hosting ASPay with Vipps for WooCommerceCWE-639WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Ob…
CVE-2026-972615.3—VillaThemeNotivoCWE-201WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability
CVE-2026-972825.3—RadiusThemeReview SchemaCWE-639WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (…
CVE-2026-973025.3—ThemeisleMPGCWE-201WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability
CVE-2026-1002605.3—JetBrainsYouTrackCWE-1188In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authent…
CVE-2026-1005085.3—WordPress.orgTwo FactorCWE-770WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability
CVE-2026-1018835.3—OpenClawOpenClaw Windows NodeCWE-918OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present
CVE-2026-1021445.3—KiteworksEmail Protection GatewayCWE-306Kiteworks Email Protection Gateway Uncontrolled Resource Consumption
CVE-2026-1031185.3—n/aGraphicsMagickCWE-404GraphicsMagick WPG File wpg.c ExtractPostscript recursion
CVE-2026-1032275.3—n/aGPACCWE-119GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow
CVE-2026-1033965.3—mlogclubbbs-goCWE-863bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount
CVE-2026-1033995.3—Red HatRed Hat Enterprise Linux 10CWE-444Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-conti…
CVE-2026-1035485.3—ItronMV-90 xiCWE-257Improperly Stored Credentials
CVE-2026-1035875.1—WebkulQloAppsCWE-79QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
CVE-2026-1035885.1—WebkulQloAppsCWE-79QloApps through 1.7.0 Reflected XSS via exceptions field
CVE-2026-1035895.1—WebkulQloAppsCWE-79QloApps through 1.7.0 Reflected XSS via Room Type Editor
CVE-2026-1035905.1—WebkulQloAppsCWE-79QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
CVE-2026-972464.9—ShortPixelShortPixel Image OptimizerCWE-502WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection v…
CVE-2026-1002724.9—JetBrainsYouTrackCWE-639In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notifi…
CVE-2026-1002784.9—JetBrainsYouTrackCWE-863In JetBrains YouTrack before 2026.2.19197 users with restricted permission co…
CVE-2026-1021114.9—KiteworksCoreCWE-1284Kiteworks Core Improper Validation of Specified Quantity in Input
CVE-2026-1021404.9—KiteworksCoreCWE-345Kiteworks Core Insufficient Verification of Data Authenticity
CVE-2026-928994.8—Apache Software FoundationApache WSS4JCWE-290Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
CVE-2026-1002654.8—JetBrainsRiderCWE-494In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party…
CVE-2026-1002634.7—JetBrainsYouTrackCWE-79In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-…
CVE-2026-1021074.6—KiteworksCoreCWE-639Kiteworks Core user impersonation in a file-request feature
CVE-2026-475264.4—NVIDIAGeForceCWE-476NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475314.4—NVIDIAGeForceCWE-476NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in t…
CVE-2026-475624.4—NVIDIAGeForceCWE-116NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mo…
CVE-2026-137194.3—GrafanaGrafana EnterpriseCWE-200Alert rules in restricted folders disclosed via the alert rules list API
CVE-2026-946724.3—10upSafe SVGCWE-639WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR)…
CVE-2026-970744.3—OmnisendNewsletters, Email Marketing, SMS and Popups by OmnisendCWE-639WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= …
CVE-2026-970794.3—Webba Appointment BookingWebba BookingCWE-639WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (…
CVE-2026-972674.3—miniOrangePrevent files / folders accessCWE-862WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Cont…
CVE-2026-1002574.3—JetBrainsYouTrackCWE-918In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was…
CVE-2026-1002584.3—JetBrainsYouTrackCWE-201In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-…
CVE-2026-1002594.3—JetBrainsYouTrackCWE-863In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt ch…
CVE-2026-1002694.3—JetBrainsYouTrackCWE-862In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Repor…
CVE-2026-1020904.3—KiteworksCoreCWE-601Kiteworks Core content injection
CVE-2026-1021224.3—KiteworksCoreCWE-863Kiteworks Core Incorrect Authorization
CVE-2026-968254.2—David Anderson / Team UpdraftAll In One WP Security & FirewallCWE-290WordPress All In One WP Security & Firewall plugin <= 5.4.8 - Bypass Vulnerab…
CVE-2026-1021374.1—KiteworksCoreCWE-434Kiteworks Core Unrestricted Upload of File with Dangerous Type
CVE-2026-1034363.7—apcupsdapcupsdCWE-457apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() i…
CVE-2026-1002703.3—JetBrainsYouTrackCWE-863In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission use…
CVE-2026-1021383.3—KiteworksCoreCWE-918Kiteworks Core Server-Side Request Forgery (SSRF)
CVE-2026-1002803.1—JetBrainsYouTrackCWE-862In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadab…
CVE-2026-270852.7—Brainstorm ForceAstra WordPress ThemeCWE-80WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerab…
CVE-2026-1002642.7—JetBrainsYouTrackCWE-522In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials coul…
CVE-2026-1002712.7—JetBrainsYouTrackCWE-862In JetBrains YouTrack before 2026.2.19197 missing authorisation on several en…
CVE-2026-1031142.1—OS4EDopenSIS-ClassicCWE-74OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_…
CVE-2026-1031152.1—OS4EDopenSIS-ClassicCWE-74OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
CVE-2026-1031162.1—OS4EDopenSIS-ClassicCWE-74OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery …
CVE-2026-1032262.1—ArtifexGhostscriptCWE-119Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow
CVE-2026-1032332.1—AdithyaYellojuRestaurant-Management-SystemCWE-285AdithyaYelloju Restaurant-Management-System Admin Area admin authorization
CVE-2026-1033872.1—garycourturi-jsCWE-248garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception
CVE-2026-1030122.0—Anthropic@anthropic-ai/claude-codeCWE-696Claude Code selected an API key stored by Claude Code, for example from an ea…
CVE-2026-1031132.0—OS4EDopenSIS-ClassicCWE-74OS4ED openSIS-Classic General Information Tab Student.php save action sql inj…
CVE-2026-1031172.0—OS4EDopenSIS-ClassicCWE-74OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
CVE-2026-1034401.2—The Wikimedia FoundationMediaWiki PageTriage extensionCWE-202pagetriagelist discloses suppressed reviewer usernames
CVE-2026-1034451.2—The Wikimedia FoundationMediaWiki Page_Forms extensionCWE-80Stored XSS through PageForms #autoedit redirect links
CVE-2026-1035851.2—The Wikimedia FoundationMediaWiki MediaSearch extensionCWE-80attacker-controlled javascript license URL via XSS
CVE-2026-1034371.1—The Wikimedia FoundationMediaWiki ReadingLists extensionCWE-80ReadingLists imported metadata permits JavaScript URL XSS
CVE-2026-1034431.1—The Wikimedia FoundationMediaWiki Collection (Book) extensionCWE-80API permits session-seeded javascript URL XSS
CVE-2026-1034441.1—The Wikimedia FoundationMediaWiki WikiForum extensionCWE-80Stored XSS through system messages in WikiForum
CVE-2026-1035841.1—The Wikimedia FoundationMediaWiki CommonsMetadata extensionCWE-80attacker-controlled javascript license URL via XSS
CVE-2026-1034380.3—The Wikimedia FoundationMediaWiki Wikistories extensionCWE-80Various rawParams() and escaped() updates to prevent XSS in Wikistories exten…
CVE-2026-1034390.3—The Wikimedia FoundationMediaWiki Wikbase extensionCWE-80Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
CVE-2026-51852await—n/an/a—agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in py…
CVE-2026-51853await—n/an/a—agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in py…
CVE-2026-51856await—n/an/a—In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session expos…
CVE-2026-51857await—n/an/a—In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can…
CVE-2026-51858await—n/an/a—In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_ex…
CVE-2026-51859await—n/an/a—bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in…
CVE-2026-51860await—n/an/a—bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in…
CVE-2026-51861await—n/an/a—bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/…
CVE-2026-51862await—n/an/a—DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app…
CVE-2026-51864await—n/an/a—DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (…
CVE-2026-51866await—n/an/a—In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/u…
CVE-2026-51867await—n/an/a—agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server…
CVE-2026-51869await—n/an/a—DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes co…
CVE-2026-51870await—n/an/a—DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/…
CVE-2026-51871await—n/an/a—Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in…
CVE-2026-51872await—n/an/a—Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function …
CVE-2026-80490await——Algorithm-AhoCorasick-XSCWE-125Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack s…
CVE-2026-92172await—Meta Platforms, IncMeta Horizon OS—Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced…
CVE-2026-92173await—Meta Platforms, IncMeta Horizon OS—Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be i…
CVE-2026-103500await—MozillaThunderbird—Heap buffer overflow opening large email