CVE Database
8818 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-105997 | MEDIUM | 5.3 | The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking ver… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-104694 | MEDIUM | 6.8 | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter'… |
T1190
T1005
+1
|
|
2026-10-28 |
| CVE-2026-103382 | MEDIUM | 5.3 | The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer … |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-103372 | MEDIUM | 5.3 | The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order… |
T1078
T1548
|
|
2026-10-28 |
| CVE-2026-103331 | MEDIUM | 5.3 | The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-118275 | MEDIUM | 5.3 | A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.r… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-111727 | MEDIUM | 6.4 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118384 | MEDIUM | 6.1 | GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c. |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118376 | MEDIUM | 5.3 | WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that m… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118374 | MEDIUM | 5.9 | LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OC… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-118370 | MEDIUM | 5.9 | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlpar… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-118274 | MEDIUM | 4.3 | A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unk… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-118273 | MEDIUM | 4.3 | A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the funct… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-117610 | MEDIUM | 5.9 | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProces… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-117608 | MEDIUM | 6.1 | Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() tha… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-117606 | MEDIUM | 5.4 | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashi… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-117605 | MEDIUM | 4.3 | nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductControl… |
T1190
T1059
+1
|
|
2026-10-28 |
| CVE-2026-115624 | MEDIUM | 5.3 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By … |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-109974 | MEDIUM | 6.4 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plug… |
T1190
T1203
|
|
2026-10-28 |
| CVE-2026-109848 | MEDIUM | 4.2 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API d… |
T1190
T1203
|
|
2026-10-28 |