Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 330new in the last 7 days
- 8added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-119089 | High CVSS 7.2 |
- Applications & supply chain |
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-119065 | High CVSS 7.2 |
- Applications & supply chain |
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-118070 | High CVSS 7.2 |
- Applications & supply chain |
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in… | 31 Oct 2026 |
| CVE-2026-116548 | High CVSS 7.2 |
- Applications & supply chain |
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-116522 | High CVSS 7.2 |
- Applications & supply chain |
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'… | 31 Oct 2026 |
| CVE-2026-115840 | High CVSS 7.2 |
- Applications & supply chain |
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-111254 | High CVSS 7.2 |
- Identity & access |
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in… | 31 Oct 2026 |
| CVE-2026-107750 | High CVSS 7.2 |
- Applications & supply chain |
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-107653 | High CVSS 7.2 |
- Applications & supply chain |
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &… | 31 Oct 2026 |
| CVE-2026-119977 | High CVSS 8.1 |
- Applications & supply chain |
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable,… | 31 Oct 2026 |
| CVE-2026-118638 | High CVSS 7.5 |
- Applications & supply chain |
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that… | 31 Oct 2026 |
| CVE-2026-118185 | High CVSS 7.5 |
- Applications & supply chain |
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that… | 31 Oct 2026 |
| CVE-2026-118043 | High CVSS 7.2 |
- Applications & supply chain |
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a… | 31 Oct 2026 |
| CVE-2026-116520 | High CVSS 7.2 |
- Applications & supply chain |
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment /… | 31 Oct 2026 |
| CVE-2026-109997 | High CVSS 7.2 |
- Applications & supply chain |
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-109234 | High CVSS 7.2 |
- Applications & supply chain |
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress… | 31 Oct 2026 |
| CVE-2026-116755 | High CVSS 7.4 |
- Operating systems & software |
Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of… | 31 Oct 2026 |
| CVE-2026-110176 | High CVSS 8.7 |
- Operating systems & software |
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a… | 31 Oct 2026 |
| CVE-2026-63414 | High CVSS 7.6 |
- Identity & access |
Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange`… | 30 Oct 2026 |
| CVE-2026-63398 | High CVSS 7.4 |
- Identity & access |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback… | 30 Oct 2026 |
| CVE-2026-63396 | High CVSS 8.7 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query… | 30 Oct 2026 |
| CVE-2026-63393 | High CVSS 8.7 |
- Applications & supply chain |
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0… | 30 Oct 2026 |
| CVE-2026-63378 | High CVSS 8.8 |
- Identity & access |
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural… | 30 Oct 2026 |
| CVE-2026-63346 | High CVSS 8.6 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter… | 30 Oct 2026 |
| CVE-2026-63345 | High CVSS 8.6 |
- Applications & supply chain |
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.