All CVEs — page 352 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

MEDIUM 6.8CVE-2026-850162026-10-02
MEDIUM 4.3CVE-2026-850042026-10-02
MEDIUM 6.1CVE-2026-849252026-10-02
MEDIUM 5.3CVE-2026-817402026-10-02
MEDIUM 5.4CVE-2026-784712026-10-02
HIGH 8.8CVE-2026-15897public exploit available2026-10-02
The Super Forms – Drag & Drop Form Builder plugin for WordPress allows attackers to escalate privileges by exploiting the Register & Login add-on, leading to account takeover and full site compromise.
CRITICAL 9.1CVE-2026-15896public exploit available2026-10-02
The Super Forms – Drag & Drop Form Builder plugin for WordPress allows unauthenticated attackers to read server files via directory traversal, posing a critical security risk.
MEDIUM 6.8CVE-2026-137182026-10-02
CRITICAL 9.8CVE-2026-196602026-10-02
The Divi Membership plugin for WordPress allows unauthenticated attackers to bypass authentication by manipulating the `paypal_param` GET parameter, leading to full site takeover.
HIGH 7.2CVE-2026-100262026-10-02
HIGH 7.2CVE-2026-933672026-10-02
CRITICAL 9.8CVE-2026-143782026-10-02
The DevKit Pro plugin for WordPress allows unauthenticated attackers to take over an administrator account by exploiting a vulnerability in the `revert_switch` handler, leading to full site takeover.
HIGH 7.3CVE-2026-104123public exploit available2026-10-02
HIGH 7.3CVE-2026-104120public exploit available2026-10-02
UNSCOREDCVE-2026-211402026-10-02
UNSCOREDCVE-2026-104480public exploit available2026-10-02
MEDIUM 6.3CVE-2026-104054public exploit available2026-10-02
MEDIUM 6.3CVE-2026-104053public exploit available2026-10-02
MEDIUM 6.3CVE-2026-104052public exploit available2026-10-02
HIGH 7.5CVE-2026-1030982026-10-02
The flaw allows sensitive keys to be transmitted in plaintext over unencrypted HTTP connections, making them vulnerable to interception by network monitoring attackers. This creates a significant risk of credential exposure and potential unauthorized access.
HIGH 7.5CVE-2026-1030972026-10-02
An Android application contains a hardcoded API key that can be extracted by reverse engineering the app package, potentially allowing unauthorized access to backend services. This represents a significant security risk as the key can be misused without authentication.
HIGH 7.5CVE-2026-1030962026-10-02
An Android application contains a hardcoded API key that can be extracted by reverse engineering the app package, allowing unauthorized access to backend services. This represents a significant security risk as the key can be misused without authentication.
CRITICAL 9CVE-2026-863452026-10-02
The flaw in 389-ds-base allows an on-path attacker to inject a crafted LDAP message that can be processed after the TLS upgrade, potentially causing a client application to treat a failed authentication attempt as successful.
HIGH 7.2CVE-2026-103766public exploit available2026-10-02
CRITICAL 9.4CVE-2026-103765public exploit available2026-10-02
Mooncake through 0.3.13.post1 has a missing authentication vulnerability that allows unauthenticated attackers to manipulate metadata, potentially leading to data poisoning or server memory exhaustion.