Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services

Published 2026-10-30 by GitHub_M

WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability

Published 2026-10-30 by Patchstack

Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()

Published 2026-10-30 by apache

WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability

Published 2026-10-30 by Patchstack

WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability

Published 2026-10-30 by Patchstack

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

Published 2026-10-30 by Patchstack

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

Published 2026-10-30 by AMZN

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

Published 2026-10-30 by redhat

LM Studio before 0.4.22+1 Path Traversal via Model Downloader

Published 2026-10-30 by VulnCheck

37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload

Published 2026-10-30 by VulDB

gettext: Directory traversal via the LANGUAGE environment variable

Published 2026-10-30 by glibc

Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

Published 2026-10-30 by AMZN

Published 2026-10-30 by JetBrains

Published 2026-10-30 by JetBrains

Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore

Published 2026-10-30 by VulnCheck

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Published 2026-10-30 by microsoft

Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview

Published 2026-10-30 by VulnCheck

changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

Published 2026-10-30 by VulnCheck

Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Published 2026-10-30 by VulnCheck

Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name

Published 2026-10-30 by VulnCheck

sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

Published 2026-10-30 by VulnCheck

Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

Published 2026-10-30 by Wordfence

GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter

Published 2026-10-30 by Wordfence

Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update

Published 2026-10-30 by Wordfence

Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field

Published 2026-10-30 by Wordfence

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments

Published 2026-10-30 by Wordfence

Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

Published 2026-10-30 by Wordfence

easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

Published 2026-10-30 by Wordfence

Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field

Published 2026-10-30 by Wordfence

Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter

Published 2026-10-30 by Wordfence

Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision

Published 2026-10-30 by Wordfence

OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements

Published 2026-10-30 by Wordfence

Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id

Published 2026-10-30 by Wordfence

Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter

Published 2026-10-30 by Wordfence

FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes

Published 2026-10-30 by Wordfence

JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter

Published 2026-10-30 by Wordfence

ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body

Published 2026-10-30 by Wordfence

Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

Published 2026-10-30 by Wordfence

GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter

Published 2026-10-30 by Wordfence

Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter

Published 2026-10-30 by Wordfence

Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)

Published 2026-10-30 by Wordfence

Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header

Published 2026-10-30 by Wordfence

Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection

Published 2026-10-30 by Wordfence

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute

Published 2026-10-30 by Wordfence

Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion

Published 2026-10-30 by Wordfence

Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint

Published 2026-10-30 by Wordfence

CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter

Published 2026-10-30 by Wordfence

37954679 cak-filemanagement-system save_student.php mysqli_query sql injection

Published 2026-10-30 by VulDB

Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery

Published 2026-10-30 by GitHub_M

SecureDrop: API session token reuse against the Journalist Interface web UI

Published 2026-10-30 by GitHub_M

myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management

Published 2026-10-30 by GitHub_M

Frappe LMS allows unpublished certificate access

Published 2026-10-30 by GitHub_M

Frappe LMS: Quiz result manipulation and cross-user submission forgery

Published 2026-10-30 by GitHub_M

Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount

Published 2026-10-30 by GitHub_M

ZAC: Missing per-zaaktype authorization on by-ID decision and process reads

Published 2026-10-30 by GitHub_M

Frappe LMS has Stored XSS in Course Meta

Published 2026-10-30 by GitHub_M

Improper certificate validation in the HTTPS listener in LXD

Published 2026-10-30 by canonical

Wekan: ReDoS via Unescaped User Input in RegExp

Published 2026-10-30 by GitHub_M

gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments

Published 2026-10-30 by GitHub_M

Published 2026-10-30 by mitre

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability

Published 2026-10-30 by Patchstack

WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability

Published 2026-10-30 by Patchstack

croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive

Published 2026-10-30 by GitHub_M

Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint

Published 2026-10-30 by AMZN