Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.1 HIGH
CVE-2026-39786 — WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

ba_book_everything | Remote | Cross-Site Scripting
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
6.5 MEDIUM
CVE-2026-39739 — WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XS…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.T…

Remote | Cross-Site Scripting
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
9.8 CRITICAL
CVE-2026-39738 — WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.

Remote | Injection
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
7.5 HIGH
CVE-2026-39734 — WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability

Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

Remote | Path Traversal
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
9.3 CRITICAL
CVE-2026-39732 — WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

Remote | Injection
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
7.1 HIGH
CVE-2026-28160 — WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.

Remote | Cross-Site Scripting
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
6.5 MEDIUM
CVE-2026-27061 — WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

user_registration | Remote | Cross-Site Scripting
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
6.0 MEDIUM
CVE-2026-120046 — Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers ca…

Remote | Denial of Service
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
6.9 MEDIUM
CVE-2026-120007 — NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submi…

nodebb | Remote | Authorization
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
6.5 MEDIUM
CVE-2026-119842 — Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser v…

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to cra…

enterprise_linux enterprise_linux | Remote | Memory Corruption
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
6.5 MEDIUM
CVE-2026-119729 — Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in …

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media cont…

enterprise_linux enterprise_linux | Remote | Denial of Service
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
5.5 MEDIUM
CVE-2026-119728 — Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup durin…

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can derefere…

enterprise_linux enterprise_linux | Denial of Service
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
6.5 MEDIUM
CVE-2026-119727 — Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via inte…

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor …

enterprise_linux enterprise_linux | Remote | Memory Corruption
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
9.8 CRITICAL
CVE-2026-119526 — WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

Remote | Injection
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
8.2 HIGH
CVE-2026-119117 — Insertion of sensitive information into a log file and process argument list in the Amazo…

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obt…

amazon-kinesis-producer | Information Disclosure
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
8.8 HIGH
CVE-2026-118090 — WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

masterstudy_lms | Remote | Injection
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
7.2 HIGH
CVE-2026-118089 — WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.

Remote | Injection
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
8.8 HIGH
CVE-2026-118086 — WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.

Remote | Authorization
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
7.5 HIGH
CVE-2026-116862 — WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.

Remote | Authorization
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
7.5 HIGH
CVE-2026-116861 — WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.

Remote | Authentication
Oct 30, 2026 Oct 30, 2026
Oct 30, 2026
Oct 30, 2026
Showing 20 of 17037 Results