cve.li

Recent

CVE-2026-61840CWE-918

Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services

Published 2026-10-30 by GitHub_M

CVE-2026-62056CWE-862

WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-62023CWE-862

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-62019CWE-862

WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-104674CWE-862

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-62047CWE-862

WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-39739CWE-79

WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-73322CWE-863

Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()

Published 2026-10-30 by apache

CVE-2026-52710CWE-80

WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-62057CWE-80

WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-62121CWE-98

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-62122CWE-862

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

CVE-2026-119117CWE-532CWE-214

Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

Published 2026-10-30 by AMZN

CVE-2026-119777CWE-787

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

Published 2026-10-30 by redhat

CVE-2026-119979CWE-22

LM Studio before 0.4.22+1 Path Traversal via Model Downloader

Published 2026-10-30 by VulnCheck

CVE-2026-119620CWE-434CWE-284

37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload

Published 2026-10-30 by VulDB

CVE-2026-84243CWE-22

gettext: Directory traversal via the LANGUAGE environment variable

Published 2026-10-30 by glibc

CVE-2026-119086CWE-843CWE-121

Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

Published 2026-10-30 by AMZN

CVE-2026-118697CWE-295

Published 2026-10-30 by JetBrains

CVE-2026-118696CWE-299

Published 2026-10-30 by JetBrains

CVE-2026-119978CWE-749

Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore

Published 2026-10-30 by VulnCheck

CVE-2026-69446CWE-863

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Published 2026-10-30 by microsoft

CVE-2026-119764CWE-79

Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview

Published 2026-10-30 by VulnCheck

CVE-2026-119763CWE-862

changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

Published 2026-10-30 by VulnCheck

CVE-2026-119762CWE-674

Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Published 2026-10-30 by VulnCheck

CVE-2026-119761CWE-79

Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name

Published 2026-10-30 by VulnCheck

CVE-2026-119760CWE-476

sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

Published 2026-10-30 by VulnCheck

CVE-2026-76012CWE-434

Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

Published 2026-10-30 by Wordfence

CVE-2026-119113CWE-79

GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter

Published 2026-10-30 by Wordfence

CVE-2026-105894CWE-269

Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update

Published 2026-10-30 by Wordfence

CVE-2026-115869CWE-79

Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field

Published 2026-10-30 by Wordfence

CVE-2026-109984CWE-79

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments

Published 2026-10-30 by Wordfence

CVE-2026-104744CWE-79

Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

Published 2026-10-30 by Wordfence

CVE-2026-112365CWE-79

easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

Published 2026-10-30 by Wordfence

CVE-2026-115346CWE-434

Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field

Published 2026-10-30 by Wordfence

CVE-2026-115820CWE-89

Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter

Published 2026-10-30 by Wordfence

CVE-2026-118205CWE-269

Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision

Published 2026-10-30 by Wordfence

CVE-2026-109592CWE-862

OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements

Published 2026-10-30 by Wordfence

CVE-2026-102918CWE-79

Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id

Published 2026-10-30 by Wordfence

CVE-2026-102905CWE-94

Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter

Published 2026-10-30 by Wordfence

CVE-2026-110533CWE-79

FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes

Published 2026-10-30 by Wordfence

CVE-2026-104739CWE-22

JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter

Published 2026-10-30 by Wordfence

CVE-2026-96894CWE-79

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body

Published 2026-10-30 by Wordfence

CVE-2026-97638CWE-639

Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

Published 2026-10-30 by Wordfence

CVE-2026-118635CWE-94

GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter

Published 2026-10-30 by Wordfence

CVE-2026-107630CWE-862

Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter

Published 2026-10-30 by Wordfence

CVE-2026-9239CWE-79

Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)

Published 2026-10-30 by Wordfence

CVE-2026-116552CWE-79

Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header

Published 2026-10-30 by Wordfence

CVE-2026-110305CWE-200

Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection

Published 2026-10-30 by Wordfence

CVE-2026-110001CWE-79

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute

Published 2026-10-30 by Wordfence

Load more ↓