Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.1 HIGH
CVE-2026-61988 — WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (…

Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-54866 — WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting…

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

razorpay_payment_button | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
6.5 MEDIUM
CVE-2026-54865 — WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vuln…

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-54864 — WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54860 — WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54859 — WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54858 — WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54857 — WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54856 — WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
5.3 MEDIUM
CVE-2026-48200 — WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Librar…

Remote | Information Disclosure
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.2 HIGH
CVE-2026-42701 — WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
4.3 MEDIUM
CVE-2026-42694 — WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-42692 — WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

wp_crowdfunding | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
5.4 MEDIUM
CVE-2026-42690 — WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

learnpress | Remote | Authorization
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-27394 — WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

eventer | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
4.3 MEDIUM
CVE-2026-20942 — Microsoft Edge (Chromium-based) Spoofing Vulnerability

Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

edge edge_chromium | Remote
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
6.5 MEDIUM
CVE-2026-18894 — Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context with…

langflow_oss | Remote | Authentication
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.9 CRITICAL
CVE-2026-119145 — Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticate…

frappe | Remote | Path Traversal
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
8.8 HIGH
CVE-2026-119144 — Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection v…

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralizatio…

frappe | Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
5.9 MEDIUM
CVE-2026-119143 — Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writes

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. M…

wasmtime | Remote | Denial of Service
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
Showing 20 of 17179 Results