Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- High7.5sync 2026-10-16T15:41:51ZVuln · CVE-2026-102941 · FIRST EPSS · GitHub Advisory Database · GitLab Advisory Database · GoEPSS 0.3%Oct 16, 2026
- UnknownxSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' ParameterVuln · CVE-2026-109985 · WordPress · xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN · FIRST EPSS · Wordfence Intelligence · WordPressEPSS 0.2%Oct 16, 2026
- UnknownUser Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart TagVuln · CVE-2026-92798 · WordPress · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · Wordfence Intelligence · WordPressOct 16, 2026
- UnknownUser Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()Vuln · CVE-2026-92978 · WordPress · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · Wordfence Intelligence · WordPressOct 16, 2026
- UnknownUser Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field ValueVuln · CVE-2026-96660 · WordPress · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · Wordfence Intelligence · WordPressOct 16, 2026
- UnknownWP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' ActionVuln · CVE-2026-108123 · WordPress · WP Booking System – Booking Calendar · FIRST EPSS · Wordfence Intelligence · WordPressEPSS 0.3%Oct 16, 2026
- UnknownThemify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode AttributeVuln · CVE-2026-111726 · WordPress · Themify Builder · FIRST EPSS · Wordfence Intelligence · WordPressEPSS 0.2%Oct 16, 2026
- Critical9.8LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' ParameterVuln · CVE-2026-104736 · thimpress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · FIRST EPSS · EUVD · Wordfence Intelligence · PHP, WordPressEPSS 0.0%Oct 16, 2026
- UnknownLearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionVuln · CVE-2026-107744 · WordPress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · FIRST EPSS · Wordfence Intelligence · WordPressEPSS 0.3%Oct 16, 2026
- UnknownAppointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' ParameterVuln · CVE-2026-111602 · WordPress · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · FIRST EPSS · Wordfence Intelligence · WordPressEPSS 0.3%Oct 16, 2026
- UnknownKirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' ParameterVuln · CVE-2026-107762 · WordPress · Kirki – Freeform Page Builder, Website Builder & Customizer · FIRST EPSS · Wordfence Intelligence · WordPressEPSS 0.4%Oct 16, 2026
- UnknownHippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' ParameterVuln · CVE-2026-111601 · WordPress · Hippoo Mobile App for WooCommerce · FIRST EPSS · Wordfence Intelligence · WordPressEPSS 0.2%Oct 16, 2026
- UnknownKirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template ImportVuln · CVE-2026-104734 · WordPress · Kirki – Freeform Page Builder, Website Builder & Customizer · FIRST EPSS · Wordfence Intelligence · PHP, WordPressEPSS 0.5%Oct 16, 2026
- UnknownSecurity update for the Linux KernelVuln · SUSE-SU-2026:4706-1 · OpenSSF OSV / OSV Scanner · Linux, SUSE Linux Enterprise 15Oct 16, 2026
- UnknownSecurity update for libsoup2Vuln · SUSE-SU-2026:4703-1 · OpenSSF OSV / OSV Scanner · Linux, SUSE Linux Enterprise 15Oct 16, 2026
- UnknownMalicious code in @xatancchii/natabaileys (npm)Vuln · MAL-2026-17901 · GitHub Advisory Database · OpenSSF OSV / OSV Scanner · npmOct 16, 2026
- UnknownMalicious code in parxleys (npm)Vuln · MAL-2026-17902 · GitHub Advisory Database · OpenSSF OSV / OSV Scanner · npmOct 16, 2026
- High7.5Important: rpcbind security updateVuln · RLSA-2026:83561 · OpenSSF OSV / OSV Scanner · Linux, Rocky LinuxOct 16, 2026
- High7.8Important: ghostscript security updateVuln · RLSA-2026:83551 · OpenSSF OSV / OSV Scanner · Linux, Rocky LinuxOct 16, 2026
- High8.1Important: kernel security, bug fix, and enhancement updateVuln · RLSA-2026:83207 · OpenSSF OSV / OSV Scanner · Atlassian, JiraOct 16, 2026
- High7.5Important: rpcbind security updateVuln · RLSA-2026:83562 · OpenSSF OSV / OSV Scanner · Linux, Rocky LinuxOct 16, 2026
- High7.8Important: ghostscript security updateVuln · RLSA-2026:83553 · OpenSSF OSV / OSV Scanner · Linux, Rocky LinuxOct 16, 2026
- High8.6Important: libsoup security updateVuln · RLSA-2026:83384 · OpenSSF OSV / OSV Scanner · Linux, Rocky LinuxOct 16, 2026
- High8.8Important: kernel security updateVuln · RLSA-2026:83156 · OpenSSF OSV / OSV Scanner · Linux, Rocky LinuxOct 16, 2026
- High8.8Important: hplip security, bug fix, and enhancement updateVuln · RLSA-2026:82882 · OpenSSF OSV / OSV Scanner · Atlassian, JiraOct 16, 2026
