Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 419new in the last 7 days
- 8added as actively exploited
- 37critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-107653 | High CVSS 7.2 |
- Applications & supply chain |
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &… | 31 Oct 2026 |
| CVE-2026-94361 | Medium CVSS 5.3 |
- Network & security devices |
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an… | 31 Oct 2026 |
| CVE-2026-92294 | Medium CVSS 6.5 |
- Applications & supply chain |
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file… | 31 Oct 2026 |
| CVE-2026-82214 | Medium CVSS 5.3 |
- Applications & supply chain |
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before… | 31 Oct 2026 |
| CVE-2026-119977 | High CVSS 8.1 |
- Applications & supply chain |
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable,… | 31 Oct 2026 |
| CVE-2026-118638 | High CVSS 7.5 |
- Applications & supply chain |
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that… | 31 Oct 2026 |
| CVE-2026-118629 | Medium CVSS 5.3 |
- Applications & supply chain |
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before… | 31 Oct 2026 |
| CVE-2026-118438 | Medium CVSS 6.8 |
- Applications & supply chain |
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before… | 31 Oct 2026 |
| CVE-2026-118437 | Low CVSS 3.7 |
- Applications & supply chain |
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded… | 31 Oct 2026 |
| CVE-2026-118185 | High CVSS 7.5 |
- Applications & supply chain |
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that… | 31 Oct 2026 |
| CVE-2026-118184 | Medium CVSS 5.3 |
- Applications & supply chain |
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the… | 31 Oct 2026 |
| CVE-2026-118043 | High CVSS 7.2 |
- Applications & supply chain |
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a… | 31 Oct 2026 |
| CVE-2026-116563 | Medium CVSS 5.4 |
- Applications & supply chain |
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored… | 31 Oct 2026 |
| CVE-2026-116520 | High CVSS 7.2 |
- Applications & supply chain |
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment /… | 31 Oct 2026 |
| CVE-2026-110808 | Medium CVSS 4.2 |
- Applications & supply chain |
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role… | 31 Oct 2026 |
| CVE-2026-110042 | Medium CVSS 4.9 |
- Network & security devices |
The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays… | 31 Oct 2026 |
| CVE-2026-109997 | High CVSS 7.2 |
- Applications & supply chain |
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-109234 | High CVSS 7.2 |
- Applications & supply chain |
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress… | 31 Oct 2026 |
| CVE-2026-101326 | Medium CVSS 5.4 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-100155 | Medium CVSS 6.5 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-116755 | High CVSS 7.4 |
- Operating systems & software |
Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of… | 31 Oct 2026 |
| CVE-2026-110176 | High CVSS 8.7 |
- Operating systems & software |
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a… | 31 Oct 2026 |
| CVE-2026-77152 | Medium CVSS 5.3 |
- Operating systems & software |
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field… | 31 Oct 2026 |
| CVE-2026-117656 | Critical CVSS 9.3 |
- Operating systems & software |
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth… | 31 Oct 2026 |
| CVE-2026-63414 | High CVSS 7.6 |
- Identity & access |
Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange`… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.