Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

Critical9.8The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and includin…CVE-2026-97668 · Tyche Softwares · Abandoned Cart Pro for WooCommerce · CVE.org · NIST NVDOct 13, 2026
Critical9.8The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to,…CVE-2026-97657 · Tyche Softwares · Abandoned Cart Pro for WooCommerce · CVE.org · NIST NVDOct 13, 2026
High7.7Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL).CVE-2026-14765 · Epic Games · Unreal Engine · CVE.org · NIST NVDOct 13, 2026
Critical9.2Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and Oct…CVE-2026-110447 · Collabora · Collabora Online - Built-in CODE Server · CVE.org · NIST NVDOct 13, 2026
High8.6TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.CVE-2026-110445 · TEAMPLUS TECHNOLOGY · TeamPlus Messenger · CIRCL Vulnerability Lookup · CVE.org · NIST NVDOct 13, 2026
High8.6TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability.CVE-2026-110444 · TEAMPLUS TECHNOLOGY · TeamPlus Messenger · CIRCL Vulnerability Lookup · CVE.org · NIST NVDOct 13, 2026
Critical9.8The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function.CVE-2026-110002 · CVE.org · NIST NVDOct 13, 2026
High7.2The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6.CVE-2026-103422 · CVE.org · NIST NVDOct 13, 2026
High7.5The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 1…CVE-2026-102251 · CVE.org · NIST NVDOct 13, 2026
Critical9.8The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all ve…CVE-2026-93388 · CVE.org · NIST NVDOct 13, 2026
Critical9.1The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_…CVE-2026-92097 · CVE.org · NIST NVDOct 13, 2026
Medium4.3Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator.CVE-2026-86607 · CVE.org · NIST NVDOct 13, 2026
Medium5.1Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.CVE-2026-86573 · CVE.org · NIST NVDOct 13, 2026
High7.9Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.CVE-2026-82715 · CVE.org · NIST NVDOct 13, 2026
High8.1The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1.CVE-2026-17092 · CVE.org · NIST NVDOct 13, 2026
Critical9.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.CVE-2026-110392 · CVE.org · NIST NVDOct 13, 2026
Medium5.3The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1.CVE-2026-107652 · CVE.org · NIST NVDOct 13, 2026
High8.1The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the cl…CVE-2026-104995 · CVE.org · NIST NVDOct 13, 2026
High7.5The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828.CVE-2026-104767 · CVE.org · NIST NVDOct 13, 2026
High7.5The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execu…CVE-2026-104749 · CVE.org · NIST NVDOct 13, 2026
Medium6.4The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insuff…CVE-2026-103425 · CVE.org · NIST NVDOct 13, 2026
High7.5The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly veri…CVE-2026-103423 · CVE.org · NIST NVDOct 13, 2026
High8.7A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute…CVE-2026-110385 · CVE.org · NIST NVDOct 13, 2026
High7.8Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation.CVE-2026-110359 · CVE.org · NIST NVDOct 13, 2026
High8.7Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol.CVE-2026-108473 · CVE.org · NIST NVDOct 13, 2026