Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-120114 | High CVSS 7.2 |
- Applications & supply chain |
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored… | 31 Oct 2026 |
| CVE-2026-109197 | High CVSS 7.5 |
- Applications & supply chain |
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all… | 31 Oct 2026 |
| CVE-2026-120075 | High CVSS 7.2 |
- Applications & supply chain |
The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and… | 31 Oct 2026 |
| CVE-2026-117681 | High CVSS 8.0 |
- Operating systems & software |
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy… | 31 Oct 2026 |
| CVE-2026-116964 | High CVSS 8.4 |
- Operating systems & software |
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within… | 31 Oct 2026 |
| CVE-2026-116086 | High CVSS 8.8 |
- Applications & supply chain |
A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an… | 31 Oct 2026 |
| CVE-2026-114217 | High CVSS 8.6 |
- Applications & supply chain |
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in… | 31 Oct 2026 |
| CVE-2026-110530 | High CVSS 7.2 |
- Applications & supply chain |
The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,… | 31 Oct 2026 |
| CVE-2026-120070 | High CVSS 8.8 |
- Cloud & SaaS |
The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend… | 31 Oct 2026 |
| CVE-2026-118057 | High CVSS 7.2 |
- Applications & supply chain |
The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-107759 | High CVSS 7.2 |
- Identity & access |
The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-104012 | High CVSS 8.8 |
- Identity & access |
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege… | 31 Oct 2026 |
| CVE-2026-103898 | High CVSS 8.1 |
- Identity & access |
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all… | 31 Oct 2026 |
| CVE-2026-120040 | High CVSS 7.5 |
- Applications & supply chain |
The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,… | 31 Oct 2026 |
| CVE-2026-119163 | High CVSS 7.5 |
- Applications & supply chain |
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-119162 | High CVSS 7.2 |
- Applications & supply chain |
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to… | 31 Oct 2026 |
| CVE-2026-119089 | High CVSS 7.2 |
- Applications & supply chain |
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-119065 | High CVSS 7.2 |
- Applications & supply chain |
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-118070 | High CVSS 7.2 |
- Applications & supply chain |
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in… | 31 Oct 2026 |
| CVE-2026-116548 | High CVSS 7.2 |
- Applications & supply chain |
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-116522 | High CVSS 7.2 |
- Applications & supply chain |
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'… | 31 Oct 2026 |
| CVE-2026-115840 | High CVSS 7.2 |
- Applications & supply chain |
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-111254 | High CVSS 7.2 |
- Identity & access |
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in… | 31 Oct 2026 |
| CVE-2026-107750 | High CVSS 7.2 |
- Applications & supply chain |
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-107653 | High CVSS 7.2 |
- Applications & supply chain |
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &… | 31 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.