A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?
CISA adds 2 to KEV; 458 CVEs published, led by Mattermost (15).
458 CVEs published October 16, 2026: 44 critical, 164 high, 210 medium, 14 low; 0 in the KEV catalog at press time; 0 with a public exploit reference; 26 awaiting enrichment. Elevated volume. 25 rendered as box scores below; 375 more in the results table on this page; the remaining 58 on continuation pages.
| MTD | YTD | 2025 same span | 2025 full | |
|---|---|---|---|---|
| CVEs published | 8993 | 59123 | — | — |
| KEV catalog size | 1748 | |||
Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.
Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.
3734 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| linux | 269 | 6528 | 532 | 2699 | 910 | 1 | 15 | 6 | 0.1 | 7.8 | .0018 | -637 ▼ |
| microsoft | 1460 | 4363 | 269 | 3016 | 1061 | 17 | 291 | 32 | 0.7 | 7.8 | .0045 | +479 ▲ |
| 340 | 3171 | 390 | 1236 | 1407 | 138 | 80 | 9 | 0.3 | 7.5 | .0026 | -159 ▼ | |
| red hat | 168 | 1067 | 58 | 422 | 526 | 61 | 2 | 0 | 0.0 | 6.5 | .0032 | +67 ▲ |
| apple | 0 | 564 | 67 | 166 | 317 | 14 | 89 | 9 | 1.6 | 6.5 | .0019 | -246 ▼ |
| freebsd | 13 | 61 | 3 | 43 | 9 | 3 | 0 | 0 | 0.0 | 7.8 | .0016 | +13 ▲ |
| suse | 5 | 58 | 8 | 29 | 19 | 2 | 0 | 0 | 0.0 | 7.5 | .0033 | -7 ▼ |
| canonical | 3 | 53 | 16 | 12 | 20 | 5 | 0 | 0 | 0.0 | 7.7 | .0021 | +3 ▲ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cisco | 37 | 219 | 71 | 84 | 63 | 1 | 61 | 18 | 8.2 | 8.4 | .0044 | -60 ▼ |
| ubiquiti | 6 | 71 | 35 | 31 | 3 | 2 | 3 | 3 | 4.2 | 8.8 | .0050 | +6 ▲ |
| palo alto networks | 13 | 65 | 1 | 8 | 38 | 18 | 14 | 3 | 4.6 | 4.8 | .0028 | +4 ▲ |
| fortinet | 12 | 54 | 13 | 14 | 22 | 5 | 31 | 9 | 16.7 | 7.0 | .0038 | +2 ▲ |
| netgear | 6 | 40 | 0 | 0 | 32 | 8 | 0 | 0 | 0.0 | 4.3 | .0025 | +4 ▲ |
| f5 | 11 | 37 | 10 | 20 | 6 | 1 | 5 | 2 | 5.4 | 8.7 | .0048 | +3 ▲ |
| ivanti | 8 | 32 | 8 | 20 | 4 | 0 | 26 | 6 | 18.8 | 8.8 | .0137 | -2 ▼ |
| sonicwall | 6 | 25 | 8 | 12 | 5 | 0 | 19 | 4 | 16.0 | 7.8 | .0049 | +1 ▲ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache | 162 | 869 | 180 | 389 | 266 | 21 | 33 | 2 | 0.2 | 7.5 | .0056 | +71 ▲ |
| mozilla | 85 | 464 | 127 | 185 | 125 | 0 | 9 | 0 | 0.0 | 8.8 | .0028 | -28 ▼ |
| gitlab | 26 | 130 | 9 | 29 | 78 | 14 | 5 | 3 | 2.3 | 5.3 | .0033 | +9 ▲ |
| drupal | 0 | 94 | 11 | 9 | 66 | 8 | 4 | 1 | 1.1 | 5.7 | .0027 | -26 ▼ |
| github | 2 | 25 | 2 | 12 | 11 | 0 | 0 | 0 | 0.0 | 7.4 | .0058 | -1 ▼ |
| docker | 8 | 20 | 2 | 10 | 8 | 0 | 0 | 0 | 0.0 | 7.3 | .0015 | +5 ▲ |
| wordpress | 0 | 6 | 1 | 4 | 1 | 0 | 3 | 3 | 50.0 | 8.7 | .0363 | 0 |
| eclipse | 0 | 2 | 2 | 0 | 0 | 0 | 0 | 0 | 0.0 | 9.3 | .0050 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| oracle | 0 | 2905 | 581 | 1660 | 563 | 101 | 28 | 4 | 0.1 | 7.8 | .0036 | -634 ▼ |
| ibm | 205 | 1228 | 233 | 576 | 398 | 21 | 6 | 1 | 0.1 | 7.5 | .0035 | -2 ▼ |
| adobe | 177 | 1007 | 108 | 465 | 425 | 9 | 21 | 5 | 0.5 | 7.5 | .0035 | +6 ▲ |
| progress | 71 | 137 | 21 | 83 | 32 | 1 | 6 | 1 | 0.7 | 7.5 | .0034 | +68 ▲ |
| zohocorp | 1 | 43 | 6 | 29 | 8 | 0 | 0 | 0 | 0.0 | 8.1 | .0113 | -4 ▼ |
| solarwinds | 0 | 26 | 18 | 5 | 3 | 0 | 10 | 4 | 15.4 | 9.1 | .0067 | 0 |
| veeam | 6 | 25 | 7 | 11 | 7 | 0 | 1 | 0 | 0.0 | 8.5 | .0036 | +6 ▲ |
| servicenow | 0 | 10 | 7 | 3 | 0 | 0 | 2 | 0 | 0.0 | 9.4 | .0046 | 0 |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| siemens | 33 | 87 | 9 | 52 | 23 | 3 | 0 | 0 | 0.0 | 7.3 | .0028 | +18 ▲ |
| d-link | 2 | 76 | 23 | 29 | 12 | 12 | 3 | 0 | 0.0 | 8.5 | .0164 | -19 ▼ |
| synology | 0 | 46 | 5 | 10 | 25 | 6 | 0 | 0 | 0.0 | 5.6 | .0032 | 0 |
| rockwell automation | 2 | 45 | 5 | 34 | 6 | 0 | 0 | 0 | 0.0 | 8.7 | .0028 | -16 ▼ |
| advantech | 0 | 20 | 2 | 17 | 1 | 0 | 0 | 0 | 0.0 | 8.6 | .0071 | -17 ▼ |
| schneider electric | 1 | 19 | 2 | 12 | 5 | 0 | 0 | 0 | 0.0 | 8.6 | .0043 | -8 ▼ |
| abb | 1 | 12 | 1 | 6 | 5 | 0 | 0 | 0 | 0.0 | 7.2 | .0017 | +1 ▲ |
| hitachi energy | 0 | 12 | 2 | 4 | 6 | 0 | 0 | 0 | 0.0 | 7.0 | .0025 | -4 ▼ |
| Vendor | MTD | YTD | C | H | M | L | KEV | KEV YTD | KEV/100 | Med CVSS | Med EPSS | Δ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| dell | 52 | 430 | 45 | 194 | 170 | 21 | 2 | 1 | 0.2 | 7.2 | .0026 | -101 ▼ |
| nvidia | 20 | 321 | 27 | 221 | 73 | 0 | 0 | 0 | 0.0 | 7.8 | .0019 | -12 ▼ |
| sourcecodester | 32 | 269 | 0 | 0 | 162 | 107 | 0 | 0 | 0.0 | 5.5 | .0041 | -15 ▼ |
| openclaw | 1 | 229 | 5 | 117 | 85 | 22 | 0 | 0 | 0.0 | 7.1 | .0031 | -1 ▼ |
| hewlett packard enterprise (hpe) | 38 | 204 | 39 | 92 | 64 | 9 | 1 | 1 | 0.5 | 7.3 | .0042 | -91 ▼ |
| mongodb | 22 | 191 | 6 | 106 | 72 | 7 | 1 | 0 | 0.0 | 7.1 | .0035 | -28 ▼ |
| juniper networks | 153 | 175 | 23 | 130 | 22 | 0 | 7 | 0 | 0.0 | 8.6 | .0035 | +153 ▲ |
| itsourcecode | 18 | 171 | 0 | 0 | 42 | 129 | 0 | 0 | 0.0 | 2.1 | .0033 | -16 ▼ |
| CVE | EPSS | %ile | CVSS |
|---|---|---|---|
| CVE-2026-93616 | .7587 | 99.5 | 9.8 |
| CVE-2026-87902 | .3998 | 98.6 | 8.1 |
| CVE-2026-59774 | .2831 | 98.1 | 9.8 |
| CVE-2026-104935 | .2598 | 98.0 | 8.6 |
| CVE-2026-111214 | .0863 | 95.0 | 8.6 |
| CVE-2026-111218 | .0844 | 94.9 | 8.6 |
| CVE-2026-111215 | .0705 | 94.1 | 8.6 |
| CVE-2026-111217 | .0705 | 94.1 | 8.6 |
| CVE-2026-12269 | .0699 | 94.1 | 8.8 |
| CVE-2026-111216 | .0655 | 93.7 | 8.6 |
| CVE | CVSS | EPSS | Note |
|---|---|---|---|
| CVE-2026-108576 | 10.0 | .0245 | |
| CVE-2026-105484 | 10.0 | .0213 | |
| CVE-2026-73369 | 10.0 | .0125 | |
| CVE-2026-75699 | 10.0 | .0125 | |
| CVE-2026-75703 | 10.0 | .0125 | |
| CVE-2026-75721 | 10.0 | .0125 | |
| CVE-2026-84412 | 10.0 | .0125 | |
| CVE-2026-89275 | 10.0 | .0125 | |
| CVE-2026-86708 | 10.0 | .0124 | |
| CVE-2026-61732 | 10.0 | .0122 |
| Vendor | CVEs |
|---|---|
| microsoft | 1481 |
| linux | 1477 |
| 503 | |
| ibm | 402 |
| red hat | 331 |
| apache | 266 |
| adobe | 230 |
| mozilla | 163 |
| nvidia | 155 |
| juniper networks | 153 |
| Vendor | KEV |
|---|---|
| microsoft | 32 |
| cisco | 18 |
| apple | 9 |
| fortinet | 9 |
| 9 | |
| ivanti | 6 |
| linux | 6 |
| adobe | 5 |
| berriai | 4 |
| checkpoint | 4 |
| Ecosystem | Advisories |
|---|---|
| Maven | 95 |
| npm | 47 |
| PyPI | 37 |
| NuGet | 29 |
| Packagist | 25 |
| Go | 13 |
| crates.io | 10 |
| RubyGems | 4 |
| CVE | Vendor | Days |
|---|---|---|
| CVE-2026-102764 | BeyondTrust | 0 |
| CVE-2026-86950 | Apple | 0 |
| CVE-2026-88779 | NetScaler | 0 |
| CVE-2026-93952 | Arista Networks | 0 |
| CVE-2026-102489 | Zammad GmbH | 1 |
| CVE-2026-102490 | Zammad GmbH | 1 |
| CVE-2026-87902 | WordPress | 2 |
| CVE-2026-21589 | Atlassian | 9 |
| CVE-2026-105133 | Ahsay | 10 |
| CVE-2026-105134 | Ahsay | 10 |
| CVE | Vendor | Due | Days over |
|---|---|---|---|
| CVE-2021-27104 | n/a | 2021-11-17 | 1794 |
| CVE-2021-27102 | n/a | 2021-11-17 | 1794 |
| CVE-2021-27101 | n/a | 2021-11-17 | 1794 |
| CVE-2021-27103 | n/a | 2021-11-17 | 1794 |
| CVE-2021-21017 | Adobe | 2021-11-17 | 1794 |
| CVE-2021-28550 | Adobe | 2021-11-17 | 1794 |
| CVE-2021-42013 | Apache Software Foundation | 2021-11-17 | 1794 |
| CVE-2021-41773 | Apache Software Foundation | 2021-11-17 | 1794 |
| CVE-2021-30858 | Apple | 2021-11-17 | 1794 |
| CVE-2021-30860 | Apple | 2021-11-17 | 1794 |
ADDED TO KEV — CVE-2025-61624 (Fortinet FortiOS). Remediation due October 19, 2026.
ADDED TO KEV — CVE-2026-102764 (BeyondTrust Remote Support). Remediation due October 19, 2026.
EXPLOIT PUBLISHED — rabbitmq-server: 6 CVEs (CVE-2026-67406, CVE-2026-67407, CVE-2026-67413, CVE-2026-67415, CVE-2026-67419, CVE-2026-67420). Public exploit references added.
EXPLOIT PUBLISHED — MicroPyramid BottleCRM: 4 CVEs (CVE-2026-110592, CVE-2026-110593, CVE-2026-110594, CVE-2026-110595). Public exploit references added.
EXPLOIT PUBLISHED — Netgate pfSense CE: 4 CVEs (CVE-2026-111214, CVE-2026-111219, CVE-2026-111224, CVE-2026-111229). Public exploit references added.
EXPLOIT PUBLISHED — CVE-2024-58397 (enzo1982 mp4v2). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-104040 (Red Hat Enterprise Linux 10). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-104085 (odt2spip). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-105751 (docling-project docling). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-105759 (vllm-project vllm). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-10813 (LMCache). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-108376 (marcosschroh dataclasses-avroschema). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-108674 (JeecgBoot). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-108933 (Edimax BR-6208AC). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-108966 (SourceCodester Performance Indicator System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-108970 (itsmeravitejak Online-Examination-System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-108974 (SourceCodester E-Learning System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-109108 (Wavlink WL-WN530BE1-A). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-109115 (AdithyaYelloju Restaurant-Management-System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-109143 (calcom cal.com). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-109522 (girishsaraf Online-Appointment-Booking-System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-109526 (HBAI-Ltd Toonflow-app). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-109607 (SourceCodester Online Exam System). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-109967 (marcopiovanello yt-dlp-web-ui). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-110106 (dromara RuoYi-Vue-Plus). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-110113 (Sanluan PublicCMS). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-110206 (RooCodeInc Roo-Code). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-110775 (ModelEngine-Group nexent). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-110878 (aureuserp). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-111137 (amartin755 libsmi). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-111147 (libyal libesedb). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-111152 (libgme game-music-emu). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-111157 (sox). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-111234 (simplepie). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-111273 (selmf unarr). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-111284 (Webkul Aureus ERP). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-111379 (FreeRDP). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-11819 (Red Hat Enterprise Linux 10). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-18807 (Unknown ECS). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-32316 (jqlang jq). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-43494 (Linux). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-49950 (xorbitsai xoscar). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-64600 (Linux). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-78335 (GitLab). Public exploit reference added.
EXPLOIT PUBLISHED — CVE-2026-82632 (GitLab). Public exploit reference added.
REJECTED — CVE-2026-108749 (docling-project docling-serve). Record withdrawn by the CNA.
REJECTED — CVE-2026-15354 (Mauro Cassani ACPT (Premium)). Record withdrawn by the CNA.
REJECTED — CVE-2026-15398 (arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce). Record withdrawn by the CNA.
REJECTED — CVE-2026-21589 (Atlassian Bamboo Data Center). Record withdrawn by the CNA.
RESCORED — Linux: 10 CVEs (CVE-2026-23004, CVE-2026-23013, CVE-2026-23136, CVE-2026-23148, CVE-2026-23172, CVE-2026-23230, CVE-2026-23428, CVE-2026-23437, CVE-2026-23440, CVE-2026-23445). CVSS rescored — before/after on each CVE page.
RESCORED — backstage: 4 CVEs (CVE-2026-106496, CVE-2026-106559, CVE-2026-106560, CVE-2026-106563). CVSS rescored — before/after on each CVE page.
RESCORED — Microsoft Windows 10 Version 1607: 4 CVEs (CVE-2026-69918, CVE-2026-70025, CVE-2026-85333, CVE-2026-85797). CVSS rescored — before/after on each CVE page.
RESCORED — JetBrains TeamCity: 3 CVEs (CVE-2026-111094, CVE-2026-111095, CVE-2026-111096). CVSS rescored — before/after on each CVE page.
RESCORED — CVE-2026-102560 (Red Hat Enterprise Linux 10). CVSS 8.6 → 9.8 (NVD).
RESCORED — CVE-2026-104040 (Red Hat Enterprise Linux 10). CVSS 4.4 → 6.1 (NVD).
RESCORED — CVE-2026-105759 (vllm-project vllm). CVSS 5.9 → 7.5 (NVD).
RESCORED — CVE-2026-107635 (Aorimn dislocker). CVSS 6.8 → 6.9 (NVD).
RESCORED — CVE-2026-12542 (Red Hat Satellite 6.16 for RHEL 8). CVSS 5.3 → 7.8 (NVD).
RESCORED — CVE-2026-32316 (jqlang jq). CVSS 8.2 → 7.5 (NVD).
RESCORED — CVE-2026-85916 (Microsoft Windows 11 version 23H2). CVSS 6.2 → 5.5 (NVD).
RESCORED — CVE-2026-88073 (Microsoft Windows 10 Version 21H2). CVSS 8.8 → 7.8 (NVD).
PATCH SHIPPED — ZKTeco BioTime: 5 CVEs (CVE-2026-108794, CVE-2026-108795, CVE-2026-108796, CVE-2026-108797, CVE-2026-108798). Fix versions published.
PATCH SHIPPED — CVE-2026-10813 (LMCache). Fixed in LMCache 0.5.5.
PATCH SHIPPED — CVE-2026-27433 (StylemixThemes Motors). Fixed in Motors 5.6.85.
How to read these box scores · glossary
458 CVEs published. 25 box scores and 375 table rows below; the remaining 58 continue on page 2 — every CVE is listed, nothing truncated.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0147 73.4 —
AFFECTED Product Versions Fixed WP Photo Album Plus unspecified —
TIMELINE Sep 15 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C H H H 10.0 .0098 61.7 —
AFFECTED Product Versions Fixed The Grid unspecified 2.8.2
TIMELINE Sep 21 Reserved by CNA Oct 16 Published (CNA: Patchstack)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0089 58.6 —
AFFECTED Product Versions Fixed My Calendar – Accessible Event Manager unspecified —
TIMELINE Oct 2 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U N H H 8.1 .0079 55.4 —
AFFECTED Product Versions Fixed Groundhogg — CRM, Newsletters, and Marketing Automation unspecified —
TIMELINE Oct 12 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U H N N 5.9 .0077 54.7 —
AFFECTED Product Versions Fixed Debloat – Remove Unused CSS, Optimize JS unspecified —
TIMELINE Oct 2 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0069 51.6 —
AFFECTED Product Versions Fixed Mang Board unspecified —
TIMELINE Oct 12 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H N N 6.5 .0058 46.8 —
AFFECTED Product Versions Fixed Tainacan unspecified —
TIMELINE Sep 18 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0058 46.4 —
AFFECTED Product Versions Fixed ELEX WordPress HelpDesk & Customer Ticketing System unspecified —
TIMELINE Oct 1 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0057 46.3 —
AFFECTED Product Versions Fixed YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports unspecified —
TIMELINE Sep 16 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U H H H 8.1 .0052 42.8 —
AFFECTED Product Versions Fixed Customer Email Verification for WooCommerce unspecified —
TIMELINE Oct 2 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0052 42.6 —
AFFECTED Product Versions Fixed DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More unspecified —
TIMELINE Oct 15 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0051 42.3 —
AFFECTED Product Versions Fixed Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers unspecified —
TIMELINE Oct 2 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U H H H 8.1 .0050 41.7 —
AFFECTED Product Versions Fixed Vulnity Security unspecified —
TIMELINE Aug 18 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N H N 7.5 .0046 38.8 —
AFFECTED Product Versions Fixed 10Web Booster – Website speed optimization, Cache & Page Speed optimizer unspecified —
TIMELINE Oct 1 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N R U N H H 6.8 .0046 38.4 —
AFFECTED Product Versions Fixed Photo Engine (Media Organizer & Lightroom) unspecified —
TIMELINE Oct 8 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .0044 36.7 —
AFFECTED Product Versions Fixed MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. unspecified —
TIMELINE Oct 12 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U H H H 8.1 .0043 35.5 —
AFFECTED Product Versions Fixed miniOrange OTP Login, Verification and SMS Notifications unspecified —
TIMELINE Oct 1 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N A H H H 8.6 .0041 33.3 —
AFFECTED Product Versions Fixed Checkmk 2.5.0 – —
TIMELINE Jul 2 Reserved by CNA Oct 16 Published (CNA: Checkmk)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L H N U H N N 4.9 .0038 30.1 —
AFFECTED Product Versions Fixed FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler unspecified —
TIMELINE Sep 30 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H N N 7.5 .0037 29.8 —
AFFECTED Product Versions Fixed FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler unspecified —
TIMELINE Sep 30 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N C L L N 6.4 .0037 29.9 —
AFFECTED Product Versions Fixed GeoDirectory – WP Business Directory Plugin and Classified Listings Directory unspecified —
TIMELINE Oct 14 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L L N U H H H 8.8 .0037 29.0 —
AFFECTED Product Versions Fixed PilotPress unspecified —
TIMELINE Sep 4 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C L L N 7.2 .0036 28.5 —
AFFECTED Product Versions Fixed HivePress – Business Directory, Listings & Classified Ads Plugin unspecified —
TIMELINE Oct 12 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N C L L N 7.2 .0036 27.8 —
AFFECTED Product Versions Fixed Colibri Page Builder unspecified —
TIMELINE Oct 8 Reserved by CNA Oct 16 Published (CNA: Wordfence)
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N C L L N 5.4 .0036 27.8 —
AFFECTED Product Versions Fixed Events Made Easy unspecified —
TIMELINE Oct 8 Reserved by CNA Oct 16 Published (CNA: Wordfence)
| CVE | CVSS | EPSS %ile | Vendor | Product | CWE | Title |
|---|---|---|---|---|---|---|
| CVE-2026-109400 | 7.5 | 27.1 | instawp | InstaWP Connect – 1-click WP Staging & Migration | CWE-269 | InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation… |
| CVE-2026-107646 | 5.3 | 26.8 | realmag777 | HUSKY – Products Filter for WooCommerce Professional | CWE-200 | HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_d… |
| CVE-2026-109382 | 6.5 | 26.6 | bilalnaseer | WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents | CWE-863 | WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosu… |
| CVE-2026-93953 | 8.0 | 25.8 | softaculous | Backuply – Backup, Restore, Migrate and Clone | CWE-89 | Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection vi… |
| CVE-2026-109447 | 8.1 | 25.3 | cozmoslabs | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | CWE-269 | User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role… |
| CVE-2026-109990 | 7.2 | 24.8 | gijo | Flying Scripts: Delay JavaScript to Improve Site Speed & Performance | CWE-79 | Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4… |
| CVE-2026-92766 | 7.5 | 24.5 | appsbd | Vitepos – Point of Sale (POS) for WooCommerce | CWE-89 | Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter |
| CVE-2026-111378 | 8.7 | 24.3 | FreeRDP | FreeRDP | CWE-400 | FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame P… |
| CVE-2026-110590 | 7.5 | 24.0 | klarnaplugin | Klarna for WooCommerce | CWE-862 | Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated S… |
| CVE-2026-109401 | 2.7 | 23.8 | smub | WP Mail Logging | CWE-200 | WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Informat… |
| CVE-2026-107746 | 7.5 | 23.1 | teamfunnelkit | FunnelKit – Funnel Builder Plugin for WooCommerce Checkout | CWE-862 | FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive In… |
| CVE-2026-96768 | 7.2 | 23.1 | softaculous | GoSMTP Pro | CWE-79 | GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment… |
| CVE-2026-96570 | 7.2 | 22.7 | magazine3 | Schema & Structured Data for WP & AMP | CWE-79 | Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-… |
| CVE-2026-104755 | 4.8 | 22.3 | aresit | WP Compress – Instant Performance & Speed Optimization | CWE-269 | WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'set… |
| CVE-2026-105227 | 7.0 | 22.0 | Deltaww | ISPSoft | CWE-125 | ISPSoft Out-of-Bounds Read Vulnerability |
| CVE-2026-105228 | 7.0 | 22.0 | Deltaww | ISPSoft | CWE-125 | ISPSoft Out-of-Bounds Read Vulnerability |
| CVE-2026-109207 | 7.2 | 21.9 | themeisle | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | CWE-79 | RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Script… |
| CVE-2026-107659 | 7.5 | 21.5 | wpchill | Modula Image Gallery – Photo Grid & Video Gallery | CWE-862 | Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sen… |
| CVE-2026-107768 | 7.2 | 20.9 | cozmoslabs | TranslatePress – Translate Multilingual sites with AI Translation | CWE-79 | TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Com… |
| CVE-2026-111383 | 7.1 | 20.7 | nezhahq | nezha | CWE-770 | Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket |
| CVE-2026-111384 | 7.1 | 20.7 | nezhahq | nezha | CWE-770 | Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket |
| CVE-2026-89079 | 9.8 | 20.5 | jfarthing84 | Theme My Login | CWE-269 | Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass… |
| CVE-2026-111178 | 4.9 | 20.6 | murgroland | WP Booking System – Booking Calendar | CWE-89 | WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection v… |
| CVE-2026-111382 | 8.7 | 20.5 | FreeRDP | FreeRDP | CWE-787 | FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine |
| CVE-2026-104932 | 8.0 | 20.2 | johnny5 | Search Regex | CWE-502 | Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User… |
| CVE-2026-111210 | 5.5 | 20.3 | n/a | bitcoinj | CWE-918 | bitcoinj Payment Request PaymentSession.java url.openConnection server-side r… |
| CVE-2026-111114 | 7.5 | 20.1 | posimyththemes | Nexter Extension – Security, Performance, Code Snippets & Site Toolkit | CWE-269 | Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation… |
| CVE-2026-110252 | 5.4 | 20.0 | etruel | WPeMatico RSS Feed Fetcher | CWE-79 | WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripti… |
| CVE-2026-111106 | 6.5 | 19.3 | getwpfunnels | Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance | CWE-89 | Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Par… |
| CVE-2026-109224 | 7.2 | 19.1 | surecart | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments | CWE-79 | SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-l… |
| CVE-2026-16251 | 6.5 | 19.1 | Mattermost | Mattermost | CWE-770 | Mattermost local image proxy allows server memory exhaustion via unbounded im… |
| CVE-2026-96562 | 6.5 | 19.1 | wpmudev | Broken Link Checker | CWE-94 | Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Executi… |
| CVE-2026-101335 | 6.5 | 19.1 | wpmudev | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | CWE-94 | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution vi… |
| CVE-2026-111445 | 8.1 | 18.9 | Wheels | Wheels | CWE-669 | Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions wi… |
| CVE-2026-111447 | 8.1 | 18.9 | Wheels | Wheels | CWE-472 | Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primar… |
| CVE-2026-95686 | 7.2 | 18.9 | optiuser | Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights | CWE-79 | Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Script… |
| CVE-2026-109191 | 4.3 | 18.9 | extendthemes | Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy | CWE-200 | Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposu… |
| CVE-2026-103911 | 6.5 | 18.6 | wpmudev | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | CWE-94 | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution vi… |
| CVE-2026-109414 | 6.5 | 18.6 | appsbd | Vitepos – Point of Sale (POS) for WooCommerce | CWE-89 | Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' P… |
| CVE-2026-109998 | 7.2 | 18.3 | kitae-park | Mang Board | CWE-79 | Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'conten… |
| CVE-2026-111387 | 7.1 | 17.1 | nezhahq | nezha | CWE-212 | Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint |
| CVE-2026-111446 | 8.6 | 16.7 | Wheels | Wheels | CWE-863 | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /whe… |
| CVE-2026-111444 | 9.8 | 16.6 | Wheels | Wheels | CWE-89 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash esc… |
| CVE-2026-103999 | 7.2 | 16.4 | themefic | Ultra Addons for Contact Form 7 | CWE-79 | Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site… |
| CVE-2026-100159 | 4.8 | 16.3 | ays-pro | Popup Box – Create Countdown, Coupon, Video, Contact Form Popups | CWE-94 | Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via C… |
| CVE-2026-97296 | 8.1 | 16.2 | Rocketgenius, Inc | Gravity Forms | CWE-502 | WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability |
| CVE-2026-111380 | 8.7 | 16.2 | FreeRDP | FreeRDP | CWE-190 | FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends |
| CVE-2026-109388 | 6.4 | 16.1 | hivepress | HivePress – Business Directory, Listings & Classified Ads Plugin | CWE-79 | HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting… |
| CVE-2026-97339 | 7.2 | 15.9 | complianz | Complianz GDPR/CCPA Cookie Consent Banner | CWE-79 | Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored C… |
| CVE-2026-111377 | 7.1 | 15.1 | FreeRDP | FreeRDP | CWE-400 | FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly |
| CVE-2026-19621 | 6.5 | 15.1 | Mattermost | Mattermost | CWE-200 | Mattermost leaks interactive-message integration secrets to non-admin users v… |
| CVE-2026-95809 | 7.2 | 14.9 | optiuser | Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights | CWE-79 | Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Script… |
| CVE-2026-109232 | 7.2 | 14.9 | wordpresschef | Salon Booking System – Appointment Booking for Salons, Barbershops & Spas | CWE-79 | Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting… |
| CVE-2026-110701 | 7.2 | 14.9 | codepeople | CP Multi View Events Calendar | CWE-79 | CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site S… |
| CVE-2026-111373 | 6.9 | 14.9 | FreeRDP | FreeRDP | CWE-476 | FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping |
| CVE-2026-14177 | 7.5 | 14.7 | IKAS Technology Inc. | ikas E-Commerce Infrastructure | CWE-204 | User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce… |
| CVE-2026-110721 | 5.3 | 14.7 | wpdevteam | NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | CWE-862 | NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary C… |
| CVE-2026-97640 | 7.2 | 14.4 | smub | WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) | CWE-79 | WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment … |
| CVE-2026-77829 | 6.4 | 14.4 | goratech | Cooked – Recipe Management | CWE-79 | Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting v… |
| CVE-2026-100186 | 7.2 | 14.2 | cozmoslabs | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | CWE-79 | User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting v… |
| CVE-2026-109513 | 7.2 | 14.2 | wpdevteam | NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | CWE-79 | NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'nam… |
| CVE-2026-111374 | 6.0 | 13.8 | FreeRDP | FreeRDP | CWE-20 | FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStream… |
| CVE-2026-94388 | 9.3 | 13.6 | halfdata | Green Popups | CWE-89 | WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability |
| CVE-2026-104000 | 7.2 | 13.6 | croixhaug | Simply Schedule Appointments | CWE-79 | Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site… |
| CVE-2026-107764 | 7.2 | 13.6 | gpriday | SiteOrigin CSS | CWE-79 | SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripti… |
| CVE-2026-111122 | 7.2 | 13.6 | gpriday | SiteOrigin CSS | CWE-79 | SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripti… |
| CVE-2026-19600 | 4.5 | 13.6 | Mattermost | Mattermost | CWE-532 | Mattermost logs plaintext authentication tokens in debug-level server logs on… |
| CVE-2026-100106 | 6.4 | 13.4 | damian-gora | FiboSearch – Ajax Search for WooCommerce | CWE-79 | FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scriptin… |
| CVE-2026-104001 | 5.4 | 13.2 | rilwis | Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated | CWE-94 | Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Executio… |
| CVE-2026-104003 | 5.4 | 13.2 | properfraction | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | CWE-94 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User P… |
| CVE-2026-111442 | 5.3 | 13.3 | BackdropCMS | Backdrop | CWE-79 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not suff… |
| CVE-2026-19601 | 4.9 | 13.3 | Mattermost | Mattermost | CWE-201 | Disclosure of AD/LDAP bind password via Test Connection |
| CVE-2026-111472 | 9.3 | 12.6 | TSG | Profleet | CWE-89 | SQL injection in TSG Profleet |
| CVE-2026-111389 | 8.3 | 12.1 | frappe | hrms | CWE-89 | Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation |
| CVE-2026-18551 | 6.5 | 11.9 | Mattermost | Mattermost | CWE-863 | Mattermost guest account privilege escalation via member roles API |
| CVE-2026-110019 | 4.3 | 11.8 | niklaslindemann | Bulk Page Generator – LPagery | CWE-862 | Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscr… |
| CVE-2026-111069 | 6.4 | 11.8 | paoltaia | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory | CWE-79 | GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scrip… |
| CVE-2026-19541 | 6.5 | 11.5 | Mattermost | Mattermost | CWE-201 | Outgoing OAuth connection client secret exposure during connection validation |
| CVE-2026-109512 | 6.4 | 11.2 | kitae-park | Mang Board | CWE-79 | Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting… |
| CVE-2026-110664 | 6.4 | 11.2 | codename065 | Premium Packages – Sell Digital Products Securely | CWE-79 | Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scr… |
| CVE-2026-12272 | 5.3 | 11.0 | daext | Lightweight Cookie Notice – Cookie Banner for Cookie Consent | CWE-330 | Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_D… |
| CVE-2026-89280 | 4.3 | 10.9 | dokaninc | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | CWE-639 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Ins… |
| CVE-2026-19867 | 4.3 | 10.8 | Mattermost | Mattermost | CWE-770 | Uncapped mention keys in user notification properties allow CPU exhaustion du… |
| CVE-2026-103481 | 6.1 | 10.6 | mpol | Gwolle Guestbook | CWE-79 | Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Pa… |
| CVE-2026-111449 | 5.9 | 10.6 | Wheels | Wheels | CWE-362 | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBased… |
| CVE-2026-111386 | 5.3 | 10.5 | nezhahq | nezha | CWE-204 | Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig |
| CVE-2026-111448 | 3.7 | 10.2 | Wheels | Wheels | CWE-178 | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containm… |
| CVE-2026-101300 | 7.1 | 10.1 | Wegow Technologies | Wegow | CWE-918 | Server-Side Request Forgery in Wegow PDF export |
| CVE-2026-96870 | 6.4 | 9.9 | brainstormforce | SureDash – Community, Courses & Member Dashboard | CWE-79 | SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting … |
| CVE-2026-110290 | 6.4 | 9.9 | ajay | WebberZone Top 10 — Popular Posts | CWE-79 | WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site S… |
| CVE-2026-19798 | 4.3 | 9.7 | tusharimran | WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters | CWE-862 | WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+)… |
| CVE-2026-111375 | 6.3 | 9.6 | FreeRDP | FreeRDP | CWE-125 | FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title |
| CVE-2026-93681 | 6.4 | 9.3 | themeum | Tutor LMS – eLearning and online course solution | CWE-79 | Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting … |
| CVE-2026-100108 | 6.4 | 9.3 | maxfoundry | Social Share Buttons | CWE-79 | Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site … |
| CVE-2026-100158 | 6.4 | 9.3 | elvinhaci | SQL Chart Builder | CWE-79 | SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Sc… |
| CVE-2026-107748 | 6.4 | 9.3 | cozmoslabs | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | CWE-79 | User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site… |
| CVE-2026-110017 | 6.4 | 9.3 | fullworks | Quick PayPal Payments: Payment Button & Form | CWE-79 | Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contri… |
| CVE-2026-15575 | 5.3 | 8.8 | SFM Software Technologies Inc. | Costifier | CWE-489 | Sensitive Information Disclosure Due to Enabled Debug Mode in Production in S… |
| CVE-2026-19076 | 4.4 | 8.9 | Mattermost | Mattermost | CWE-863 | Mattermost fails to reject OAuth application sessions in account type switch,… |
| CVE-2026-15219 | 6.5 | 8.6 | SFM Software Technologies Inc. | Costifier | CWE-639 | IDOR in SFM Software's Costifier |
| CVE-2026-111385 | 6.3 | 8.5 | nezhahq | nezha | CWE-601 | Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools |
| CVE-2026-88963 | 6.1 | 8.5 | themeum | Tutor LMS – eLearning and online course solution | CWE-79 | Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Si… |
| CVE-2026-103480 | 6.4 | 8.4 | themefic | Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental | CWE-79 | Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting v… |
| CVE-2026-104726 | 6.4 | 8.4 | jeroenpeters1986 | Name Directory | CWE-79 | Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scr… |
| CVE-2026-87111 | 7.2 | 8.1 | WPEverest | User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin | CWE-79 | User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting … |
| CVE-2026-89051 | 7.2 | 8.1 | johndarrel | Hide My WP Ghost – Security & Firewall | CWE-79 | Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via … |
| CVE-2026-103696 | 6.8 | 8.1 | Unknown | Mobile builder | CWE-89 | Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter |
| CVE-2026-16453 | 7.1 | 7.7 | Mattermost | Mattermost | CWE-472 | Mattermost SAML RelayState forgery allows unauthorized team membership |
| CVE-2026-15222 | 5.4 | 7.5 | wpeverest | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | CWE-94 | User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitra… |
| CVE-2026-91833 | 6.8 | 6.8 | Unknown | WX Subscribe 微信支付付费订阅 | CWE-89 | WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter |
| CVE-2026-110366 | 5.3 | 6.7 | Gemini Labs | Site Reviews | CWE-862 | WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability |
| CVE-2026-18560 | 4.3 | 6.7 | Mattermost | Mattermost | CWE-203 | Improper order of authorisations in Mattermost GetFile API leads to an authen… |
| CVE-2026-19603 | 4.3 | 6.7 | Mattermost | Mattermost | CWE-201 | Private channel ID disclosure via user status endpoints |
| CVE-2026-111388 | 5.3 | 6.4 | frappe | frappe | CWE-284 | Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authent… |
| CVE-2026-110179 | 6.8 | 5.6 | Unknown | affiliate-toolkit | CWE-89 | affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter |
| CVE-2026-18256 | 4.3 | 4.9 | Mattermost | Mattermost | CWE-863 | Private team metadata disclosure via the team search API |
| CVE-2026-18223 | 5.0 | 4.8 | Mattermost | Mattermost | CWE-863 | Mattermost invitation tokens not bound to invited email address allowing unau… |
| CVE-2026-111443 | 6.5 | 4.8 | Wheels | Wheels | CWE-348 | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request in… |
| CVE-2026-93535 | 6.4 | 4.3 | wppool | Dark Mode – Improve Accessibility with AI Powered Dark Theme | CWE-79 | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - A… |
| CVE-2026-110135 | 7.4 | 4.2 | Unknown | OTP Login & Register Woocommerce | CWE-287 | OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover v… |
| CVE-2026-109813 | 8.6 | 4.0 | Moxa | AIG-302 Series | CWE-321 | Shared Hard-coded Root CA Private Key |
| CVE-2026-18799 | 4.3 | 3.9 | Mattermost | Mattermost | CWE-862 | Mattermost Server fails to restrict Slack import account binding, allowing te… |
| CVE-2026-18795 | 6.4 | 3.8 | Mattermost | Mattermost | CWE-862 | Missing server side validation allowed user to quarantine a DM and GM post |
| CVE-2026-105974 | 4.3 | 3.7 | Unknown | Visual Form Builder | CWE-200 | Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashbo… |
| CVE-2026-110012 | 4.3 | 3.7 | Unknown | Salon Booking System | CWE-200 | Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST … |
| CVE-2026-110191 | 2.7 | 3.7 | Unknown | Product Delivery Date for WooCommerce | CWE-200 | Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Inf… |
| CVE-2026-96339 | 7.1 | 3.5 | Houzez.co | Houzez | CWE-79 | WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-110014 | 5.3 | 3.5 | Unknown | Salon Booking System | CWE-862 | Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitr… |
| CVE-2026-91830 | 6.5 | 3.4 | Unknown | Subscribe to Comments | CWE-200 | Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key D… |
| CVE-2026-74923 | 5.3 | 3.4 | Unknown | Document Gallery | CWE-200 | Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure … |
| CVE-2026-92427 | 5.3 | 3.4 | Unknown | Coinsnap Bitcoin Crowdfunding | CWE-200 | Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forge… |
| CVE-2026-110013 | 4.8 | 3.1 | Unknown | Salon Booking System | CWE-287 | Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Pr… |
| CVE-2026-105973 | 4.3 | 3.1 | Unknown | Visual Form Builder | CWE-862 | Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via … |
| CVE-2026-109982 | 4.2 | 3.1 | Unknown | MB Custom Post Types & Custom Taxonomies | CWE-862 | MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Autho… |
| CVE-2026-110039 | 2.7 | 3.1 | Unknown | Smush | CWE-863 | Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite |
| CVE-2026-111451 | 7.8 | 3.1 | Wheels | Wheels CLI | CWE-78 | Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-sup… |
| CVE-2026-104715 | 7.8 | 2.9 | Red Hat | Red Hat Enterprise Linux 10 | CWE-88 | Cifs-utils: mount.cifs credential-file option injection allows local privileg… |
| CVE-2026-111450 | 5.9 | 2.7 | Wheels | Wheels | CWE-348 | Wheels through 4.1.1 derives its default production error-email address from … |
| CVE-2026-111376 | 2.3 | 2.7 | FreeRDP | FreeRDP | CWE-125 | FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_… |
| CVE-2026-106030 | 6.8 | 2.6 | Nord Security | NordVPN | CWE-863 | Missing Authorization in NordVPN for Windows |
| CVE-2026-109812 | 6.9 | 2.0 | Moxa | AIG-302 Series | CWE-862 | Missing Authorization on Secret Endpoints |
| CVE-2026-111379 | 7.0 | 1.9 | FreeRDP | FreeRDP | CWE-122 | FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3 |
| CVE-2026-111381 | 7.0 | 1.9 | FreeRDP | FreeRDP | CWE-122 | FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser |
| CVE-2026-111237 | 4.8 | 1.8 | Ultralytics | FastSAM | CWE-94 | Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_mode… |
| CVE-2026-111212 | 0.9 | 1.5 | ImprintLab | Medical-SAM-Adapter | CWE-94 | ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py sessi… |
| CVE-2026-110015 | 8.8 | 1.0 | Unknown | Salon Booking System | CWE-352 | Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF |
| CVE-2026-111458 | 6.8 | 0.6 | adulau | ssldump | CWE-122 | ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting |
| CVE-2026-95182 | 10.0 | — | n/a | n/a | CWE-426 | An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows att… |
| CVE-2026-85746 | 9.9 | — | MariaDB | server | CWE-787 | MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollec… |
| CVE-2026-85748 | 9.9 | — | MariaDB | server | CWE-416 | MariaDB: Use-after-free with a large number of SYS_REFCURSOR's |
| CVE-2026-92262 | 9.9 | — | MariaDB | server | CWE-706 | MariaDB: Numerous issues caused by historical #mysql50# tablename encoding by… |
| CVE-2026-49868 | 9.8 | — | RIOT-OS | RIOT | CWE-125 | RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to s… |
| CVE-2026-111823 | 9.8 | — | Mage | mage-ai | CWE-390 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon… |
| CVE-2026-18516 | 9.6 | — | Arcadia Technology, LLC | Crafty Controller | CWE-116 | Improper Encoding or Escaping of Output in Crafty Controller |
| CVE-2026-57169 | 9.6 | — | Finsys | dockhand | CWE-306 | Dockhand: Unauthenticated container exec via WebSocket upgrade |
| CVE-2026-102693 | 9.6 | — | RIOT-OS | RIOT | CWE-120 | RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID |
| CVE-2026-105279 | 9.3 | — | J4Care | dcm4chee-arc-light | CWE-306 | J4Care dcm4che Missing Authentication for Critical Function |
| CVE-2026-107617 | 9.3 | — | Guangzhou Juan IoT Technology Co., Ltd. | EseeCloud App | CWE-798 | Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials |
| CVE-2026-109587 | 9.3 | — | FreeRTOS | FreeRTOS-Kernel | CWE-863 | Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel |
| CVE-2026-109588 | 9.3 | — | FreeRTOS | FreeRTOS-Kernel | CWE-125 | Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel |
| CVE-2026-111626 | 9.3 | — | Webreaper | Damselfly | CWE-306 | Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers |
| CVE-2026-111641 | 9.3 | — | fastapiadmin | FastapiAdmin | CWE-306 | FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints |
| CVE-2026-111643 | 9.3 | — | l429609201 | misaka_danmu_server | CWE-306 | Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Ro… |
| CVE-2026-111673 | 9.3 | — | Thecosy | IceCMS | CWE-306 | IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints |
| CVE-2026-111687 | 9.3 | — | rachelos | we-mp-rss | CWE-95 | WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint |
| CVE-2026-111690 | 9.3 | — | suyuan32 | simple-admin-core | CWE-321 | Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass |
| CVE-2026-111692 | 9.3 | — | databufflabs | databuff | CWE-321 | DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC S… |
| CVE-2026-111693 | 9.3 | — | databufflabs | databuff | CWE-1392 | DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials |
| CVE-2026-111704 | 9.3 | — | LangChat | langchat | CWE-306 | LangChat through commit 2a6285a Missing Authentication on REST API Controllers |
| CVE-2026-111708 | 9.3 | — | canove | whaticket-community | CWE-269 | WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/… |
| CVE-2026-111711 | 9.3 | — | Netcore | NR256CN | CWE-121 | Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok() |
| CVE-2026-96620 | 9.2 | — | anthropics | claude-agent-sdk-python | CWE-20 | Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Comma… |
| CVE-2026-102551 | 9.2 | — | FreeRTOS | FreeRTOS-Plus-TCP | CWE-940 | Improper verification of the source of a communication channel in FreeRTOS-Pl… |
| CVE-2026-111391 | 9.2 | — | sgl-project | sglang | CWE-95 | SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter |
| CVE-2026-111636 | 9.2 | — | OpenBMB | StaffDeck | CWE-321 | OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session … |
| CVE-2026-111663 | 9.2 | — | chaskiq | chaskiq | CWE-918 | Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation |
| CVE-2026-102692 | 9.1 | — | RIOT-OS | RIOT | CWE-190 | RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-o… |
| CVE-2026-111675 | 9.1 | — | xiaochong0302 | course-tencent-cloud | CWE-307 | Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Take… |
| CVE-2026-111691 | 9.1 | — | wimoor-erp | wimoor | CWE-290 | WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header |
| CVE-2026-44977 | 9.0 | — | Countly | countly-server | CWE-79 | countly-server: Stored XSS in feedback upload enables app-admin to compromise… |
| CVE-2026-102608 | 9.0 | — | ZoneMinder | zoneminder | CWE-78 | ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name i… |
| CVE-2026-30971 | 8.8 | — | ZoneMinder | zoneminder | CWE-78 | ZoneMinder: Authenticated RCE via command injection in monitor Device Path |
| CVE-2026-96627 | 8.8 | — | getarcaneapp | arcane | CWE-266 | Arcane: Delegated users:update permission allows admin account takeover via p… |
| CVE-2026-97380 | 8.8 | — | MariaDB | server | CWE-620 | MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges |
| CVE-2026-97851 | 8.8 | — | J4Care | dcm4chee-arc-light | CWE-862 | J4Care dcm4che Missing Authorization |
| CVE-2026-102607 | 8.8 | — | ZoneMinder | zoneminder | CWE-78 | ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature |
| CVE-2026-106705 | 8.8 | — | n/a | n/a | CWE-284 | ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerabil… |
| CVE-2026-109119 | 8.8 | — | ikus-soft | rdiffweb | CWE-862 | Missing Authorization in rdiffweb |
| CVE-2026-111413 | 8.8 | — | aThemeArt | aThemeArt Theme Helper | CWE-352 | WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery… |
| CVE-2026-111633 | 8.8 | — | SeriaWei | ZKEACMS | CWE-321 | ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key |
| CVE-2026-111650 | 8.8 | — | HoshinoSuzumi | chronoframe | CWE-306 | ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API |
| CVE-2026-68906 | 8.7 | — | mz-automation | libiec61850 | CWE-125 | libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformatio… |
| CVE-2026-95859 | 8.7 | — | libp2p | rust-libp2p | CWE-770 | libp2p-rust: Gossipsub GRAFT topics unbounded growth |
| CVE-2026-101021 | 8.7 | — | J4Care | dcm4chee-arc-light | CWE-407 | J4Care dcm4che Inefficient Algorithmic Complexity |
| CVE-2026-105273 | 8.7 | — | J4Care | dcm4chee-arc-light | CWE-835 | J4Care dcm4che Loop with Unreachable Exit Condition |
| CVE-2026-105667 | 8.7 | — | J4Care | dcm4chee-arc-light | CWE-306 | J4Care dcm4che Missing Authentication for Critical Function |
| CVE-2026-107564 | 8.7 | — | gocsaf Development Community | csaf_provider | CWE-770 | gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption |
| CVE-2026-107621 | 8.7 | — | J4Care | dcm4chee-arc-light | CWE-835 | J4Care dcm4che Loop with Unreachable Exit Condition |
| CVE-2026-111612 | 8.7 | — | qaiu | netdisk-fast-download | CWE-321 | netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth |
| CVE-2026-111613 | 8.7 | — | alldatacenter | alldata | CWE-306 | AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test |
| CVE-2026-111642 | 8.7 | — | fastapiadmin | FastapiAdmin | CWE-321 | FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation |
| CVE-2026-111681 | 8.7 | — | smartloli | EFAK | CWE-862 | EFAK through 5.1.0 Privilege Escalation via /api/users REST API |
| CVE-2026-111685 | 8.7 | — | Thecosy | IceCMS | CWE-89 | IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum |
| CVE-2026-111686 | 8.7 | — | Thecosy | IceCMS | CWE-89 | IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum |
| CVE-2026-111702 | 8.7 | — | sugarforever | chat-ollama | CWE-639 | ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases |
| CVE-2026-111706 | 8.7 | — | vastxie | 99AI | CWE-306 | 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportE… |
| CVE-2026-111710 | 8.7 | — | Netcore | NR256CN | CWE-476 | Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS |
| CVE-2026-111723 | 8.7 | — | LingGuoAI | LingGuo-Drama | CWE-862 | LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admi… |
| CVE-2026-111605 | 8.6 | — | dromara | Jpom | CWE-639 | Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController |
| CVE-2026-111606 | 8.6 | — | hcengineering | Huly Platform | CWE-862 | Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC |
| CVE-2026-111627 | 8.6 | — | hestiacp | hestiacp | CWE-863 | HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation |
| CVE-2026-111634 | 8.6 | — | helicalinsight | helicalinsight | CWE-89 | Helical Insight through 7.0.0 SQL Injection via /executeDatasource |
| CVE-2026-111639 | 8.6 | — | mlogclub | bbs-go | CWE-287 | bbs-go through 4.4.6 Account Takeover via Google One Tap Login |
| CVE-2026-111722 | 8.6 | — | LingGuoAI | LingGuo-Drama | CWE-639 | LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API |
| CVE-2026-55543 | 8.5 | — | helge17 | tuxguitar | CWE-94 | TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file |
| CVE-2026-96626 | 8.5 | — | getarcaneapp | arcane | CWE-200 | Arcane: Container-registry credential exfiltration via URL repoint + test to … |
| CVE-2026-111399 | 8.5 | — | PT Norther Lights Production | MapSVG | CWE-89 | WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability |
| CVE-2026-111638 | 8.3 | — | moul | sshportal | CWE-862 | sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes … |
| CVE-2026-111701 | 8.3 | — | OtterMind | Nubase | CWE-306 | OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API |
| CVE-2026-68907 | 8.2 | — | mz-automation | libiec61850 | CWE-125 | libIEC61850: Server-side out-of-bounds stack read in association-specific dyn… |
| CVE-2026-86009 | 8.2 | — | Mailu | Mailu | CWE-285 | Mailu: Domain managers can allow themselves to spoof on other hosted domains … |
| CVE-2026-102552 | 8.2 | — | FreeRTOS | FreeRTOS-Plus-TCP | CWE-940 | Improper verification of the source of a communication channel in FreeRTOS-Pl… |
| CVE-2026-111646 | 8.2 | — | javahuang | SurveyKing | CWE-862 | SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview |
| CVE-2026-111719 | 8.2 | — | roncoo | roncoo-pay | CWE-306 | Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query |
| CVE-2026-42269 | 8.1 | — | Countly | countly-server | CWE-22 | countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary Fil… |
| CVE-2026-49410 | 8.1 | — | tinyhumansai | openhuman | CWE-352 | OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation |
| CVE-2026-61726 | 8.1 | — | TandoorRecipes | recipes | CWE-284 | Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read an… |
| CVE-2026-88755 | 7.8 | — | n/a | n/a | CWE-78 | Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections… |
| CVE-2026-96424 | 7.8 | — | UBports | lomiri-download-manager | CWE-732 | Incorrect Permission Assignment for Critical Resource in lomiri-download-manager |
| CVE-2026-102917 | 7.8 | — | IBM | i | CWE-269 | IBM i is Affected By An Improper Privilege Management Vulnerability |
| CVE-2026-59970 | 7.7 | — | TandoorRecipes | recipes | CWE-918 | Tandoor Recipes: Blind SSRF via AI provider URL (api_base) |
| CVE-2026-86047 | 7.7 | — | MariaDB | server | CWE-89 | MariaDB: Insufficient quoting in mariadb-dump and SHOW commands |
| CVE-2026-108374 | 7.7 | — | frappe | erpnext | CWE-862 | ERPNext: Unauthorised status modification due to missing validation |
| CVE-2026-111044 | 7.6 | — | LizardByte | Sunshine | CWE-863 | Disabled Sunshine clients can bypass revocation with a derived client certifi… |
| CVE-2026-111622 | 7.6 | — | a466350665 | smart-sso | CWE-601 | smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redir… |
| CVE-2026-41582 | 7.5 | — | Countly | countly-server | CWE-22 | countly-server: Unauthenticated Path Traversal via Public Image and Screensho… |
| CVE-2026-42270 | 7.5 | — | Countly | countly-server | CWE-248 | countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream … |
| CVE-2026-46472 | 7.5 | — | n/a | n/a | CWE-125 | An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While pa… |
| CVE-2026-48503 | 7.5 | — | mz-automation | libiec61850 | CWE-191 | libIEC61850: Remote information disclosure in MMS file service via out-of-ran… |
| CVE-2026-48741 | 7.5 | — | mz-automation | libiec61850 | CWE-129 | libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array p… |
| CVE-2026-57486 | 7.5 | — | pupnp | pupnp | CWE-476 | pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced… |
| CVE-2026-57487 | 7.5 | — | pupnp | pupnp | CWE-770 | libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered |
| CVE-2026-63618 | 7.5 | — | Apache Software Foundation | Apache Kylin | CWE-200 | Apache Kylin: Low-Privilege Config Exposure |
| CVE-2026-68498 | 7.5 | — | FasterXML | jackson-core | CWE-400 | jackson-core: Delayed maxNameLength enforcement for char-backed input (Reader… |
| CVE-2026-77630 | 7.5 | — | pupnp | pupnp | CWE-400 | pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA call… |
| CVE-2026-102834 | 7.5 | — | bytedeco | javacv | CWE-190 | JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS |
| CVE-2026-102941 | 7.5 | — | gomarkdown | markdown | CWE-125 | gomarkdown/markdown IsSafeURL panics on short URLs |
| CVE-2026-105958 | 7.5 | — | Red Hat | Red Hat Enterprise Linux 6 | CWE-787 | Spice-server: spice: heap oob read/write via unchecked migration data offsets |
| CVE-2026-105959 | 7.5 | — | Red Hat | Red Hat Enterprise Linux 6 | CWE-190 | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders int… |
| CVE-2026-86008 | 7.2 | — | Mailu | Mailu | CWE-269 | Mailu domain managers can take over higher-privileged accounts |
| CVE-2026-92263 | 7.2 | — | CodeWithCJ | SparkyFitness | CWE-78 | SparkyFitness: Authenticated OS command injection (host RCE) via backup-resto… |
| CVE-2026-107648 | 7.2 | — | switcorp | WP Sessions Time Monitoring Full Automatic | CWE-79 | WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored … |
| CVE-2026-111680 | 7.2 | — | APIParkLab | APIPark | CWE-639 | APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Par… |
| CVE-2026-111684 | 7.2 | — | absmach | magistrala | CWE-639 | Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service |
| CVE-2026-57488 | 7.1 | — | pupnp | pupnp | CWE-190 | pupnp: Integer truncation in HTTP Content-Length parsing enables request smug… |
| CVE-2026-59963 | 7.1 | — | TandoorRecipes | recipes | CWE-639 | Tandoor Recipes: Private recipe file and share-link authorization bypass in r… |
| CVE-2026-77474 | 7.1 | — | Dicklesworthstone | destructive_command_guard | CWE-400 | dcg: Exponential-time command-substitution preprocessing lets a crafted comma… |
| CVE-2026-107777 | 7.1 | — | Thermo Fisher | Torrent Suite Software | CWE-22 | Thermo Fisher Torrent Suite Software Path Traversal |
| CVE-2026-108372 | 7.1 | — | huangruiteng | loopx | CWE-346 | LoopX serve-status permissive CORS policy exposes control-plane state and pri… |
| CVE-2026-111396 | 7.1 | — | Liquid Web / StellarWP | Advanced Post Manager | CWE-862 | WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulne… |
| CVE-2026-111607 | 7.1 | — | jeequan | jeepay | CWE-639 | Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs |
| CVE-2026-111614 | 7.1 | — | devlive-community | DataCap | CWE-639 | DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Crede… |
| CVE-2026-111615 | 7.1 | — | gz-yami | mall4cloud | CWE-639 | Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint |
| CVE-2026-111619 | 7.1 | — | zyx0814 | FilePress | CWE-89 | FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php |
| CVE-2026-111649 | 7.1 | — | rocboss | paopao-ce | CWE-639 | Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint |
| CVE-2026-111651 | 7.1 | — | risesoft-y9 | Digital-Infrastructure | CWE-639 | Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via… |
| CVE-2026-111669 | 7.1 | — | izhaorui | Zr.Admin.NET | CWE-89 | ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY |
| CVE-2026-111671 | 7.1 | — | data-infra | cube-studio | CWE-639 | Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints |
| CVE-2026-111682 | 7.1 | — | smartloli | EFAK | CWE-862 | EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes … |
| CVE-2026-111695 | 7.1 | — | shaiwz | data-platform-open | CWE-639 | Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API |
| CVE-2026-111696 | 7.1 | — | shaiwz | data-platform-open | CWE-321 | data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Pa… |
| CVE-2026-111697 | 7.1 | — | roinli | HUIZHI-ChargeOS-cloud | CWE-639 | HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs |
| CVE-2026-111698 | 7.1 | — | roinli | HUIZHI-ChargeOS-cloud | CWE-639 | HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge |
| CVE-2026-111700 | 7.1 | — | WebVella | WebVella-ERP | CWE-89 | WebVella ERP through 1.8.8 SQL Injection via EQL Query API |
| CVE-2026-111718 | 7.1 | — | kuafuai | aipexbase | CWE-89 | AipexBase through commit 690adb9 SQL Injection via /api/data/invoke |
| CVE-2026-62439 | 7.0 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-190 | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buf… |
| CVE-2026-81452 | 7.0 | — | Dell | Alienware Command Center (AWCC) | CWE-272 | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a … |
| CVE-2026-97858 | 6.9 | — | Guangzhou Juan IoT Technology Co., Ltd. | EseeCloud App | CWE-915 | Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of… |
| CVE-2026-105664 | 6.9 | — | Guangzhou Juan IoT Technology Co., Ltd. | EseeCloud App | CWE-204 | Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy |
| CVE-2026-111616 | 6.9 | — | Oqtane | Oqtane Framework | CWE-639 | Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API |
| CVE-2026-111617 | 6.9 | — | MGdaasLab | WHartTest | CWE-306 | WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket End… |
| CVE-2026-111618 | 6.9 | — | coaidev | CoAI | CWE-22 | CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints |
| CVE-2026-111637 | 6.9 | — | Blair2004 | NexoPOS | CWE-306 | NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields … |
| CVE-2026-111644 | 6.9 | — | l429609201 | misaka_danmu_server | CWE-306 | Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes |
| CVE-2026-111652 | 6.9 | — | 3xxx | engineercms | CWE-862 | Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment |
| CVE-2026-111653 | 6.9 | — | 53AI | 53AIHub | CWE-306 | 53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id |
| CVE-2026-111659 | 6.9 | — | wayn111 | waynboot-mall | CWE-306 | Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order… |
| CVE-2026-111660 | 6.9 | — | wayn111 | waynboot-mall | CWE-306 | waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid |
| CVE-2026-111661 | 6.9 | — | wayn111 | waynboot-mall | CWE-306 | waynboot-mall through 2.0.0 Missing Authentication via /callback/email Mail E… |
| CVE-2026-111662 | 6.9 | — | chaskiq | chaskiq | CWE-918 | Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint |
| CVE-2026-111694 | 6.9 | — | qiantongtech | qKnow | CWE-306 | qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints |
| CVE-2026-111707 | 6.9 | — | vastxie | 99AI | CWE-639 | 99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure |
| CVE-2026-111712 | 6.9 | — | Netcore | NR256CN | CWE-288 | Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix |
| CVE-2026-111720 | 6.9 | — | lhccong | fish-island-backend | CWE-918 | fish-island-backend through commit 7c61b78 SSRF via /api/web/parse |
| CVE-2026-55836 | 6.8 | — | open-zaak | open-zaak | CWE-200 | Open Zaak: Path traversal / arbitrary server-file read via Documenten API doc… |
| CVE-2026-111677 | 6.8 | — | Adri van Os | antiword | CWE-125 | Antiword through 0.37 Heap Out-of-Bounds Read via vGet8LstInfo in prop8.c |
| CVE-2026-89085 | 6.6 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-787 | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image |
| CVE-2026-111802 | 6.6 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-59 | Nautilus: nautilus: arbitrary file deletion via trash symlink |
| CVE-2026-54657 | 6.5 | — | open-zaak | open-zaak | CWE-285 | Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do… |
| CVE-2026-55796 | 6.5 | — | frappe | hrms | CWE-89 | Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report |
| CVE-2026-55862 | 6.5 | — | pupnp | pupnp | CWE-674 | pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack… |
| CVE-2026-59962 | 6.5 | — | TandoorRecipes | recipes | CWE-943 | Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes |
| CVE-2026-64862 | 6.5 | — | frappe | hrms | CWE-862 | Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee … |
| CVE-2026-85231 | 6.5 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-770 | Libtirpc: libtirpc: denial of service via unbounded memory allocation during … |
| CVE-2026-108373 | 6.5 | — | frappe | erpnext | CWE-862 | ERPNext: Unauthorised access to financial data due to missing validation |
| CVE-2026-110806 | 6.5 | — | Devolutions | Server | CWE-863 | Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0… |
| CVE-2026-110903 | 6.5 | — | Liquid Web / StellarWP | The Events Calendar | CWE-79 | WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) v… |
| CVE-2026-111400 | 6.5 | — | IdeaBox Creations | PowerPack Addons for Elementor | CWE-79 | WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripti… |
| CVE-2026-111405 | 6.5 | — | PT Norther Lights Production | MapSVG | CWE-79 | WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97470 | 6.4 | — | themefic | Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental | CWE-79 | Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vi… |
| CVE-2026-111392 | 6.3 | — | sgl-project | sglang | CWE-345 | SGLang through 0.5.21 KV Cache Poisoning via mm_hashes in /generate |
| CVE-2026-111623 | 6.3 | — | joey-zhou | xiaozhi-esp32-server-java | CWE-290 | Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoin… |
| CVE-2026-111624 | 6.3 | — | umbraco | Umbraco-CMS | CWE-306 | Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs |
| CVE-2026-111699 | 6.3 | — | niefy | wx-api | CWE-306 | Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie |
| CVE-2026-62438 | 6.1 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-190 | Gimp: gimp: paa integer overflow out-of-bounds read |
| CVE-2026-111390 | 6.0 | — | erupts | erupt | CWE-564 | Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API |
| CVE-2026-111555 | 6.0 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-1285 | Luksmeta: missing slot-range validation permits out-of-gap device i/o |
| CVE-2026-111620 | 6.0 | — | O2OA | O2OA | CWE-639 | O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download End… |
| CVE-2026-89096 | 5.9 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-772 | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd |
| CVE-2026-109461 | 5.9 | — | Microsoft | Microsoft Identity Client for NodeJS | CWE-346 | Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vu… |
| CVE-2026-59966 | 5.7 | — | TandoorRecipes | recipes | CWE-1333 | Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Contro… |
| CVE-2026-89088 | 5.5 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-787 | Parted: parted: denial of service via heap buffer overflow during fat16 resize |
| CVE-2026-89098 | 5.5 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-617 | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd |
| CVE-2026-96425 | 5.5 | — | UBports | lomiri-download-manager | CWE-732 | Incorrect Permission Assignment for Critical Resource in lomiri-download-manager |
| CVE-2026-17068 | 5.4 | — | IBM | i | CWE-285 | IBM i is Affected By Improper Authorization and Access Control Vulnerabilitie… |
| CVE-2026-17073 | 5.4 | — | IBM | i | CWE-284 | IBM i is Affected By Improper Authorization and Access Control Vulnerabilitie… |
| CVE-2026-17491 | 5.4 | — | IBM | i | CWE-269 | IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH |
| CVE-2026-59967 | 5.4 | — | TandoorRecipes | recipes | CWE-639 | Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet impo… |
| CVE-2026-85985 | 5.4 | — | MariaDB | server | CWE-862 | MariaDB: Unauthorized file access via CONNECT engine UDFs |
| CVE-2026-90821 | 5.4 | — | Arcadia Technology, LLC | Crafty Controller | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scri… |
| CVE-2026-102923 | 5.4 | — | CodeWithCJ | SparkyFitness | CWE-918 | SparkyFitness: SSRF via unvalidated custom_url in AI service settings |
| CVE-2026-110029 | 5.4 | — | Unknown | Squeeze | CWE-862 | Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attac… |
| CVE-2026-110901 | 5.4 | — | WPMU DEV | SmartCrawl | CWE-639 | WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (ID… |
| CVE-2026-57446 | 5.3 | — | mz-automation | libiec61850 | CWE-415 | libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stal… |
| CVE-2026-68908 | 5.3 | — | mz-automation | libiec61850 | CWE-590 | libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visib… |
| CVE-2026-80092 | 5.3 | — | Microsoft | microsoft-identity-web | CWE-302 | Microsoft Identity Web Elevation of Privilege Vulnerability |
| CVE-2026-85977 | 5.3 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-1050 | Libtirpc: libtirpc: denial of service via unbounded memory allocation during … |
| CVE-2026-109930 | 5.3 | — | Unknown | MAIO | CWE-200 | MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key |
| CVE-2026-110380 | 5.3 | — | Arraytics | WP Event Solution | CWE-862 | WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerab… |
| CVE-2026-110896 | 5.3 | — | WP Chill | Passster | CWE-862 | WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability |
| CVE-2026-110900 | 5.3 | — | Liquid Web / StellarWP | BookIt | CWE-862 | WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability |
| CVE-2026-111397 | 5.3 | — | PT Norther Lights Production | MapSVG | CWE-862 | WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability |
| CVE-2026-111409 | 5.3 | — | YITH | YITH PayPal Express Checkout for WooCommerce | CWE-862 | WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Bro… |
| CVE-2026-111603 | 5.3 | — | PlayEdu | PlayEdu | CWE-639 | PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints |
| CVE-2026-111610 | 5.3 | — | b3log | Solo | CWE-639 | B3log Solo through 4.4.0 Missing Authorization in ArticleConsole |
| CVE-2026-111611 | 5.3 | — | roncoo | roncoo-education | CWE-639 | roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continu… |
| CVE-2026-111621 | 5.3 | — | TDuckCloud | tduck-survey-form | CWE-639 | TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key} |
| CVE-2026-111625 | 5.3 | — | 10up | Distributor | CWE-862 | 10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action |
| CVE-2026-111629 | 5.3 | — | IoTSharp | IoTSharp | CWE-639 | IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs |
| CVE-2026-111630 | 5.3 | — | colinin | abp-next-admin | CWE-639 | abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations |
| CVE-2026-111631 | 5.3 | — | 10up | Distributor | CWE-862 | Distributor before 2.3.2 Missing Authorization in External Connection AJAX Ac… |
| CVE-2026-111632 | 5.3 | — | aureuserp | aureuserp | CWE-639 | Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id |
| CVE-2026-111635 | 5.3 | — | helicalinsight | helicalinsight | CWE-22 | Helical Insight through 7.0.0 Path Traversal via /getExternalResource |
| CVE-2026-111640 | 5.3 | — | kuaifan | dootask | CWE-639 | DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs |
| CVE-2026-111645 | 5.3 | — | zmister2016 | MrDoc | CWE-639 | MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint |
| CVE-2026-111647 | 5.3 | — | PickMall | lilishop | CWE-639 | PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id} |
| CVE-2026-111654 | 5.3 | — | kerwincui | FastBee | CWE-639 | FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints |
| CVE-2026-111656 | 5.3 | — | zhimaAi | chatwiki | CWE-639 | ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints |
| CVE-2026-111657 | 5.3 | — | beikeshop | beikeshop | CWE-639 | BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint |
| CVE-2026-111665 | 5.3 | — | PiranhaCMS | Piranha CMS | CWE-862 | Piranha CMS through 12.2 Missing Authorization in Manager Language API |
| CVE-2026-111666 | 5.3 | — | steedos | steedos-platform | CWE-863 | Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure v… |
| CVE-2026-111667 | 5.3 | — | getrebuild | rebuild | CWE-639 | REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint |
| CVE-2026-111668 | 5.3 | — | beizhu-1209 | AIHelms | CWE-862 | AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API |
| CVE-2026-111670 | 5.3 | — | clickvisual | clickvisual | CWE-862 | ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module |
| CVE-2026-111672 | 5.3 | — | data-infra | cube-studio | CWE-639 | Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints |
| CVE-2026-111674 | 5.3 | — | Hello-hao | Tbed | CWE-639 | Tbed through 20240319 Missing Authorization via setImgFileName Endpoint |
| CVE-2026-111676 | 5.3 | — | faveosuite | faveo-helpdesk | CWE-639 | Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint |
| CVE-2026-111679 | 5.3 | — | EKKOLearnAI | ekko-studio | CWE-862 | Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips |
| CVE-2026-111683 | 5.3 | — | allegro | ralph | CWE-862 | Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API |
| CVE-2026-111688 | 5.3 | — | Exrick | xboot | CWE-863 | Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter |
| CVE-2026-111689 | 5.3 | — | Exrick | xboot | CWE-639 | XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint |
| CVE-2026-111703 | 5.3 | — | guchengwuyue | yshop-crm | CWE-639 | yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints |
| CVE-2026-111705 | 5.3 | — | fushengqian | fuint | CWE-639 | Fuint through commit 57ec018 IDOR via bookId in myBookDetail |
| CVE-2026-111709 | 5.3 | — | canove | whaticket-community | CWE-639 | WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /m… |
| CVE-2026-111715 | 5.3 | — | nduckmink | arkon | CWE-639 | Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API |
Results continue: ranks 401–458.
Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.
Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.
Day boundary. A day is a UTC calendar day. This page covers 2026-10-16 00:00:00–23:59:59 UTC. All times shown are UTC.
Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.
Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.
Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.
