CVE Database
1963 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-93927 | CRITICAL | 9.8 | Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.Thi… |
T1190
T1203
|
|
2026-10-10 |
| CVE-2026-62046 | CRITICAL | 9.8 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object … | — |
|
2026-10-10 |
| CVE-2026-62045 | CRITICAL | 9.8 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Objec… | — |
|
2026-10-10 |
| CVE-2026-104803 | CRITICAL | 9.8 | The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, … | — |
|
2026-10-10 |
| CVE-2026-104801 | CRITICAL | 9.1 | The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbi… | — |
|
2026-10-10 |
| CVE-2026-97670 | CRITICAL | 9.1 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all version… | — |
|
2026-10-10 |
| CVE-2026-103889 | CRITICAL | 9.8 | The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execut… | — |
|
2026-10-10 |
| CVE-2026-94589 | CRITICAL | 9.8 | The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for Word… | — |
|
2026-10-10 |
| CVE-2026-107645 | CRITICAL | 9.1 | The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, … | — |
|
2026-10-10 |
| CVE-2026-104732 | CRITICAL | 9.8 | The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions … | — |
|
2026-10-10 |
| CVE-2026-108474 | CRITICAL | 9.8 | In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of sever… |
T1190
T1005
+1
|
|
2026-10-10 |
| CVE-2026-108264 | CRITICAL | 9.1 | Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other medi… | — |
|
2026-10-09 |
| CVE-2026-108263 | CRITICAL | 9.9 | Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the… | — |
|
2026-10-09 |
| CVE-2026-108261 | CRITICAL | 9.3 | Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /… | — |
|
2026-10-09 |
| CVE-2026-107845 | CRITICAL | 9.3 | Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor… | — |
|
2026-10-09 |
| CVE-2026-15340 | CRITICAL | 9.8 | lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. | — |
|
2026-10-09 |
| CVE-2026-108109 | CRITICAL | 9.1 | PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password res… | — |
|
2026-10-09 |
| CVE-2026-108107 | CRITICAL | 9.8 | PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.p… | — |
|
2026-10-09 |
| CVE-2026-105278 | CRITICAL | 9.8 | The published Docker image for openPDC includes a fixed administrative credential with no forced cha… | — |
|
2026-10-09 |
| CVE-2026-100730 | CRITICAL | 9.8 | A service console interface on openPDC and openHistorian deserializes a client-supplied data structu… | — |
|
2026-10-09 |