CVE Database
29323 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-110956 | CRITICAL | 9.8 | The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine secon… |
T1078
T1548
|
|
2026-10-24 |
| CVE-2026-107907 | MEDIUM | 6.5 | The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check whe… |
T1190
T1203
|
|
2026-10-24 |
| CVE-2026-107887 | MEDIUM | 5.4 | The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonc… |
T1190
T1203
|
|
2026-10-24 |
| CVE-2026-105199 | MEDIUM | 6.8 | The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability c… |
T1190
T1059
+1
|
|
2026-10-24 |
| CVE-2026-115807 | HIGH | 7.1 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi… |
T1068
T1134
|
|
2026-10-24 |
| CVE-2026-115806 | CRITICAL | 9.8 | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in… |
T1078
T1548
|
|
2026-10-24 |
| CVE-2026-115929 | MEDIUM | 6.8 | MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate … |
T1190
T1203
|
|
2026-10-24 |
| CVE-2026-115931 | CRITICAL | 9.9 | Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. T… |
T1190
T1203
|
|
2026-10-23 |
| CVE-2026-110814 | NONE | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
T1190
T1203
|
|
2026-10-23 |
| CVE-2026-108793 | NONE | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
T1190
T1203
|
|
2026-10-23 |
| CVE-2026-108537 | NONE | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. |
T1190
T1203
|
|
2026-10-23 |
| CVE-2026-115938 | HIGH | 8.8 | Craft CMS allows any authenticated control panel user to submit an element-search condition whose el… |
T1190
T1203
|
|
2026-10-23 |
| CVE-2026-115937 | HIGH | 7.5 | The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifi… |
T1190
T1059
+1
|
|
2026-10-23 |
| CVE-2026-115935 | HIGH | 8.8 | The app/process-api-response-headers action accepts fake Craft API response headers from any authent… |
T1190
T1059
+1
|
|
2026-10-23 |
| CVE-2026-115897 | NONE | — | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expres… |
T1190
T1059
+1
|
|
2026-10-23 |
| CVE-2026-115895 | HIGH | 8.8 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From… |
T1190
T1059
+1
|
|
2026-10-23 |
| CVE-2026-115893 | CRITICAL | 9.9 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler … |
T1190
T1203
|
|
2026-10-23 |
| CVE-2026-115892 | NONE | — | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created … |
T1190
T1203
|
|
2026-10-23 |
| CVE-2026-115889 | CRITICAL | 9.9 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend b… |
T1190
T1203
|
|
2026-10-23 |
| CVE-2026-115887 | HIGH | 7.5 | GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schema… |
T1078
T1548
|
|
2026-10-23 |