CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
228318 CVEs matched. Showing 401–450 (page 9 of 4567).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-91789 |
Foxit PDF Editor/Reader U3D File Parsing Integer Overflow Remote Code Execution Vulnerability | HIGH | 7.8 | 7.8 | — | Foxit | 2026-09-23 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-91809 |
Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability | HIGH | 7.8 | 7.8 | — | Foxit | 2026-09-23 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-92378 |
uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login | MEDIUM | 4.1 | — | — | Canon_EMEA | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-50228 |
Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense | MEDIUM | 6.1 | — | — | Acer | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-50227 |
MQTT WebSocket Command Execution Vulnerability in NitroSense | MEDIUM | 6.1 | — | — | Acer | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-82331 |
Apache BuildStream: tar source extraction escape | — | — | 9.8 | — | apache | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-6831 |
Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via '… | MEDIUM | 6.5 | 6.5 | — | Wordfence | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-5924 |
Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle' | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-93528 |
NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page | — | — | 3.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-93511 |
Premium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification Bypass | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-93510 |
Points and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_cl… | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-93508 |
WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX | — | — | 8.1 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-93507 |
WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure | — | — | 3.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91077 |
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_lis… | — | — | 2.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91073 |
Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91025 |
Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91024 |
Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid) | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-90985 |
WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_… | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-90951 |
Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment | — | — | 3.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-89331 |
FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints | — | — | — | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-88997 |
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-88929 |
Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-87981 |
Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX… | — | — | — | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-87979 |
Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-87074 |
Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link | — | — | 3.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-87069 |
Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe | — | — | 3.1 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86842 |
Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86783 |
PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86608 |
WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion | — | — | 8.2 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86603 |
WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86602 |
WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-85006 |
Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84743 |
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via b… | — | — | 3.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84742 |
The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API | — | — | 2.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84741 |
The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84168 |
Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84150 |
Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint | — | — | 5.4 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84098 |
Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing | — | — | 6.5 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84046 |
Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL | — | — | 5.0 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84027 |
Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84026 |
Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-83555 |
Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verificatio… | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-82843 |
WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution | — | — | 9.0 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-81339 |
MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-81338 |
MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions | — | — | 4.6 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-80342 |
Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID | — | — | 6.5 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-77766 |
Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-77765 |
Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-75799 |
YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache | — | — | 9.0 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-18365 |
Zportals < 6.4.2 - Subscriber+ User Email Disclosure | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |