Recent changes
Records added, updated or removed by each sync (kept for 90 days). RSS feed
| Synced (UTC) | Change | CVE | Severity | Summary |
|---|---|---|---|---|
| 2026-10-21 11:02 | updated | CVE-2026-96901 | Low 3.7 | Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token |
| 2026-10-21 11:02 | updated | CVE-2026-92999 | Medium 5.3 | Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action |
| 2026-10-21 11:02 | updated | CVE-2026-92998 | High 8.6 | Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters |
| 2026-10-21 11:02 | updated | CVE-2026-92997 | High 8.6 | Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter |
| 2026-10-21 11:02 | updated | CVE-2026-91665 | Critical 9.8 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable... |
| 2026-10-21 11:02 | updated | CVE-2026-91495 | Critical 9.8 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that... |
| 2026-10-21 11:02 | updated | CVE-2026-91491 | Critical 9.8 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported... |
| 2026-10-21 11:02 | updated | CVE-2026-91408 | Critical 9.8 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions... |
| 2026-10-21 11:02 | updated | CVE-2026-91323 | Critical 9.8 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected... |
| 2026-10-21 11:02 | updated | CVE-2026-91236 | Critical 9.8 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are... |
| 2026-10-21 11:02 | updated | CVE-2026-91235 | Critical 9.8 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are... |
| 2026-10-21 11:02 | updated | CVE-2026-91234 | Critical 9.8 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are... |
| 2026-10-21 11:02 | updated | CVE-2026-91233 | Critical 9.8 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions... |
| 2026-10-21 11:02 | updated | CVE-2026-91220 | Critical 9.8 | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). ... |
| 2026-10-21 11:02 | updated | CVE-2026-91214 | Critical 9.8 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are... |
| 2026-10-21 11:02 | updated | CVE-2026-88784 | High 7.5 | Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting |
| 2026-10-21 11:02 | updated | CVE-2026-87838 | Medium 6.5 | Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook |
| 2026-10-21 11:02 | updated | CVE-2026-87837 | Medium 5.3 | Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook |
| 2026-10-21 11:02 | updated | CVE-2026-87251 | Critical 9.8 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions... |
| 2026-10-21 11:02 | updated | CVE-2026-86611 | Medium 4.3 | Download Manager (Free & Pro) - Privacy Settings Update via CSRF |
| 2026-10-21 11:02 | updated | CVE-2026-85642 | High 7.5 | Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS |
| 2026-10-21 11:02 | updated | CVE-2026-83399 | Critical 9.8 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected... |
| 2026-10-21 11:02 | updated | CVE-2026-83397 | Critical 9.8 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported... |
| 2026-10-21 11:02 | updated | CVE-2026-83396 | Critical 9.8 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported... |
| 2026-10-21 11:02 | updated | CVE-2026-81813 | Medium 6.8 | Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass |
| 2026-10-21 11:02 | updated | CVE-2026-81812 | Medium 6.4 | Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload |
| 2026-10-21 11:02 | updated | CVE-2026-79627 | High 7.1 | Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass |
| 2026-10-21 11:02 | updated | CVE-2026-60432 | Critical 9.8 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are affected... |
| 2026-10-21 11:02 | updated | CVE-2026-28318 | High 7.5 KEV | SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-15261 | Medium 5.3 | TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key |
| 2026-10-21 11:02 | updated | CVE-2026-112861 | Medium 6.3 | WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-112840 | Medium 6.5 | WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-112834 | Medium 5.3 | WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-112829 | Medium 5.3 | WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-112823 | Medium 4.3 | WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-111957 | Medium 5.3 | SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback |
| 2026-10-21 11:02 | updated | CVE-2026-111956 | Medium 5.9 | WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure |
| 2026-10-21 11:02 | updated | CVE-2026-111955 | Medium 6.5 | WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass |
| 2026-10-21 11:02 | updated | CVE-2026-111949 | High 7.5 | miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding |
| 2026-10-21 11:02 | updated | CVE-2026-111948 | High 7.1 | Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions |
| 2026-10-21 11:02 | updated | CVE-2026-111947 | Medium 5.5 | Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication |
| 2026-10-21 11:02 | updated | CVE-2026-111843 | Medium 6.5 | WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-111596 | Medium 5.3 | Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR |
| 2026-10-21 11:02 | updated | CVE-2026-111574 | High 7.5 | Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox |
| 2026-10-21 11:02 | updated | CVE-2026-110982 | Medium 4.9 | AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt |
| 2026-10-21 11:02 | updated | CVE-2026-110899 | High 7.1 | WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-110884 | High 7.1 | WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-110651 | Medium 6.8 | Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer |
| 2026-10-21 11:02 | updated | CVE-2026-110523 | High 8.1 | WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect |
| 2026-10-21 11:02 | updated | CVE-2026-110514 | Medium 4.9 | WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR |
| 2026-10-21 11:02 | updated | CVE-2026-110370 | High 8.8 | WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-110369 | High 8.8 | WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-109926 | Medium 4.3 | Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation |
| 2026-10-21 11:02 | updated | CVE-2026-109147 | High 7.1 | WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter |
| 2026-10-21 11:02 | updated | CVE-2026-108073 | Medium 5.3 | SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter |
| 2026-10-21 11:02 | updated | CVE-2026-107790 | Medium 6.8 | WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title |
| 2026-10-21 11:02 | updated | CVE-2026-107789 | Medium 5.3 | SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR |
| 2026-10-21 11:02 | updated | CVE-2026-107788 | Medium 4.3 | SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion |
| 2026-10-21 11:02 | updated | CVE-2026-107506 | High 7.5 | Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting |
| 2026-10-21 11:02 | updated | CVE-2026-107435 | High 7.1 | WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability |
| 2026-10-21 11:02 | updated | CVE-2026-107237 | High 8.2 | Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live |
| 2026-10-21 11:02 | updated | CVE-2026-107128 | Medium 5.0 | Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization |
| 2026-10-21 11:02 | updated | CVE-2026-107127 | High 7.5 | Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF |
| 2026-10-21 11:02 | updated | CVE-2026-106932 | Medium 6.5 | Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice |
| 2026-10-21 11:02 | updated | CVE-2026-105999 | Medium 5.3 | Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure |
| 2026-10-21 11:02 | updated | CVE-2026-105998 | Medium 5.3 | Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization |
| 2026-10-21 11:02 | updated | CVE-2026-105996 | Medium 4.8 | Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token |
| 2026-10-21 11:02 | updated | CVE-2026-105992 | Medium 5.3 | Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass |
| 2026-10-21 11:02 | updated | CVE-2026-105262 | High 8.0 | Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation |
| 2026-10-21 11:02 | updated | CVE-2026-105257 | Low 2.7 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR |
| 2026-10-21 11:02 | updated | CVE-2026-103302 | Medium 5.3 | Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret |
| 2026-10-21 11:02 | updated | CVE-2026-102499 | High 7.7 | Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action |
| 2026-10-21 11:02 | updated | CVE-2026-101767 | Critical 9.8 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that... |
| 2026-10-21 11:02 | updated | CVE-2026-100145 | Medium 6.5 | Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route |
| 2026-10-21 10:32 | updated | CVE-2026-87689 | Critical 9.8 | Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints |
| 2026-10-21 10:32 | updated | CVE-2026-85683 | High 8.8 | Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL |
| 2026-10-21 10:32 | updated | CVE-2026-42504 | High 7.5 | Quadratic complexity in WordDecoder.DecodeHeader in mime |
| 2026-10-21 10:32 | updated | CVE-2026-33818 | High 7.5 | Enforce maximum recursion depth in encoding/asn1 |
| 2026-10-21 10:32 | updated | CVE-2026-14556 | Medium 5.4 | HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer |
| 2026-10-21 10:32 | updated | CVE-2026-108496 | Medium 5.3 | WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability |
| 2026-10-21 10:32 | updated | CVE-2026-107447 | Medium 5.3 | Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity |
| 2026-10-21 10:32 | updated | CVE-2026-105256 | Medium 5.3 | LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter |
| 2026-10-21 10:32 | updated | CVE-2026-104642 | Low 2.7 | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass |
| 2026-10-21 10:32 | updated | CVE-2026-104641 | Medium 5.3 | Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient |
| 2026-10-21 10:32 | updated | CVE-2026-103301 | Medium 5.3 | Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret |
| 2026-10-21 10:32 | updated | CVE-2026-101138 | Medium 5.3 | CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist |
| 2026-10-21 10:32 | updated | CVE-2025-26625 | High 8.6 | Git LFS may write to arbitrary files via crafted symlinks |
| 2026-10-21 10:02 | updated | CVE-2026-6045 | Medium 5.4 | Heap buffer overflow in EMF+ gradient brush import |
| 2026-10-21 10:02 | updated | CVE-2026-15565 | High 7.5 | Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method |
| 2026-10-21 09:32 | updated | CVE-2026-70386 | High 8.5 | OnePlus OxygenOS improper neutralization of special elements vulnerability |
| 2026-10-21 09:32 | updated | CVE-2025-66178 | Medium 6.7 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0... |
| 2026-10-21 09:16 | updated | CVE-2026-8743 | Medium 5.3 | Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization |
| 2026-10-21 09:16 | updated | CVE-2026-58224 | Medium 6.5 | Samba: ctdb fails to do integrity checking of received packets |
| 2026-10-21 09:16 | updated | CVE-2026-14618 | Medium 5.3 | Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service |
| 2026-10-21 09:16 | updated | CVE-2026-10565 | Low 2.3 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition |
| 2026-10-21 09:16 | updated | CVE-2026-10157 | Medium 6.9 | Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication |