Last fetch 2026-09-24 04:48 UTC How it works Stats API

Contact

Discussion signal

Trending on social networks

Daily public mentions from Bluesky, Hacker News and Mastodon

7 days

1 CVE-2026-87902 wordpress WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal CVSS 8.1 EPSS 0.4% BlueskyMastodon
2 CVE-2026-94127 F5 BIG-IP Access Policy Manager When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). Th… CVSS 9.3 EPSS 1.4% CISA KEV BlueskyMastodon
3 CVE-2026-93616 Check Point Multi-domain Security Management R77.30 A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. CVSS 9.8 EPSS 2.4% CISA KEV BlueskyMastodon
4 CVE-2026-93952 Arista Networks VeloCloud Orchestrator (VCO) On-Prem VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… CVSS 9.5 EPSS 0.7% CISA KEV BlueskyMastodon
5 CVE-2026-85102 Check Point Gaia Embedded (Quantum Spark Firmware) R80.20.00 Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute ar… CVSS 9.8 EPSS 0.7% CISA KEV BlueskyMastodonHacker News
6 CVE-2026-7273 GS1900-10HP firmware A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthe… CVSS 8.8 EPSS 2.4% CISA KEV BlueskyMastodon
7 CVE-2026-65660 Microsoft Microsoft SharePoint Enterprise Server 2016 Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. CVSS 8.8 EPSS 0.8% BlueskyMastodon
8 CVE-2026-48842 Bulwarkmail Webmail Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash e… CVSS 8.1 EPSS 0.8% BlueskyMastodon
9 CVE-2026-76460 Cisco Cisco Identity Services Engine Software 3.1.0 A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability … CVSS 10.0 EPSS 0.8% CISA KEV BlueskyMastodon
10 CVE-2026-86296 A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udh… CVSS 10.0 EPSS 1.3% BlueskyMastodon

Search vulnerabilities

Target product, package version or vulnerability /

up to 100 lines · comments with # are ignored

Try a search

More query types

Software & coordinates

Vulnerability & advisory IDs

Plugin & theme exposure

New in WordPress

Newest disclosures first

30 days

AV:N PR:N UI:N Crit High+Med+All

1 CVE-2026-4806 Custom Thank You Page for WooCommerce ≤ 1.1.2 Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset Unauth Missing authorization CVSS 9.1 2026-09-23
2 CVE-2026-13355 Meta Box AIO ≤ 3.11.0 Meta Box AIO <= 3.7.2 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter Unauth Privilege escalation CVSS 9.8 2026-09-21
3 CVE-2026-19658 Give Tributes ≤ 2.3.1 Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter Unauth Unsafe deserialization CVSS 9.8 2026-09-21
4 CVE-2026-82187 Unknown Web to Print Online Designer WooCommerce Online Product Designer <= 2.14.0 - Unauthenticated Arbitrary File Upload Unauth Unrestricted file upload CVSS 9.8 2026-09-19
5 CVE-2026-89274 Bootstrapped Ventures WP Recipe Maker 1.0.0 Free Edition for WordPress WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content Unauth Code injection CVSS 9.1 2026-09-18
6 CVE-2026-84434 Gravity Forms ≤ 3.1.0.4 Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field Unauth Unrestricted file upload CVSS 9.8 2026-09-18
7 CVE-2026-92229 Forminator Forms – Contact Form, Payment Form & Custom Form Builder ≤ 1.57.2 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter Unauth Code injection CVSS 9.1 2026-09-18
8 CVE-2026-84750 Themefic Ultra Addons for Contact Form 7 Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload Unauth Unrestricted file upload CVSS 9.8 2026-09-17
9 WORDFENCE-c41aadb1-e1a6-4bda-ac94-c461c320e78f WordPress WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break Level unstated CWE-116 No CVE CVSS 9.1 2026-09-17
10 CVE-2026-87796 Multi Uploader for Gravity Forms ≤ 1.1.9 Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload Unauth Unrestricted file upload No patch CVSS 9.8 2026-09-16

OSV580,408CVE List396,909NVD396,909EUVD395,988EPSS378,156Vulnrichment187,476NVD CPE184,307Debian61,136Wordfence40,607Red Hat VEX30,679Exploit-DB30,403Oracle Linux19,726Chainguard19,576Red Hat17,705PoC-in-GitHub16,621Ubuntu14,642Wolfi13,865Alpine9,283AlmaLinux7,327Nuclei4,439Metasploit3,514CISA KEV1,721endoflife.date348curl215EU KEV60