CyberStack

NIST

CVE intelligence

Cached from NVD. 2026-10-26 00:40 Perth time (AWST). Recent.

1756KEV listed
209Published, last 14 days
654Critical
981High
CVETitleVendorPublishedCVSSKEV listed
CVE-2026-114625Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista2026-10-222026-10-23
CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element VulnerabilitySiemens2026-10-152026-10-20
CVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondtrust2026-10-152026-10-16
CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCisco2026-10-142026-10-14
CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection Vulnerability—2026-10-142026-10-23
CVE-2026-106931EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityE-guardian2026-10-142026-10-20
CVE-2026-0322Palo Alto Networks PAN-OS Code Injection VulnerabilityPaloaltonetworks2026-10-142026-10-14
CVE-2026-96951Microsoft Windows Command Injection VulnerabilityMicrosoft2026-10-132026-10-13
CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityIvanti2026-10-132026-10-13
CVE-2026-97183The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated—2026-10-11—
CVE-2026-96227The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browse—2026-10-11—
CVE-2026-94235The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenti—2026-10-11—
CVE-2026-93550The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validat—2026-10-11—
CVE-2026-91829The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allo—2026-10-11—
CVE-2026-89305The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any aut—2026-10-11—
CVE-2026-89304The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthe—2026-10-11—
CVE-2026-89302The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowi—2026-10-11—
CVE-2026-89299The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing —2026-10-11—
CVE-2026-89297The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowin—2026-10-11—
CVE-2026-89287The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowi—2026-10-11—
CVE-2026-89285The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL quer—2026-10-11—
CVE-2026-89283The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password acti—2026-10-11—
CVE-2026-89234The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthentica—2026-10-11—
CVE-2026-89232The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthent—2026-10-11—
CVE-2026-89214The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, whic—2026-10-11—
CVE-2026-89213The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which al—2026-10-11—
CVE-2026-89195The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, w—2026-10-11—
CVE-2026-88930The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it—2026-10-11—
CVE-2026-88905The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not esc—2026-10-11—
CVE-2026-88903The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before —2026-10-11—
CVE-2026-88827The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the ho—2026-10-11—
CVE-2026-88826The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and d—2026-10-11—
CVE-2026-88785The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL quer—2026-10-11—
CVE-2026-87764The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is —2026-10-11—
CVE-2026-87762The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, an—2026-10-11—
CVE-2026-87761The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authentic—2026-10-11—
CVE-2026-87760The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated vis—2026-10-11—
CVE-2026-86798The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the—2026-10-11—
CVE-2026-86717The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated —2026-10-11—
CVE-2026-86706The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the calle—2026-10-11—

1–40 of 209Next