Baza CVE
Obserwowane · cały katalog
| Oprogramowanie | Podatność i krótki opis | CVSS | EPSS | KEV | Zapisz |
|---|---|---|---|---|---|
| Royal Event | CVE-2026-119526 Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0. |
CVSS9,8 | EPSS0,41 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| WP BASE Booking | CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. |
CVSS8,8 | EPSS0,36 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Product Feed Manager | CVE-2026-118089 Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. |
CVSS7,2 | EPSS0,39 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| MasterStudy LMS | CVE-2026-118090 Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. |
CVSS8,8 | EPSS0,45 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Widget Options | CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. |
CVSS9,1 | EPSS0,6 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| GiveWP | CVE-2026-116853 Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. |
CVSS6,5 | EPSS0,21 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| WP Customer Area | CVE-2026-116854 Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. |
CVSS6,5 | EPSS0,2 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Flexible Chat | CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
CVSS7,5 | EPSS0,34 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| WP REST Cache | CVE-2026-116862 Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. |
CVSS7,5 | EPSS0,32 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| VikRentCar | CVE-2026-116405 Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. |
CVSS7,1 | EPSS0,19 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Masteriyo - LMS | CVE-2026-116410 Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. |
CVSS6,5 | EPSS0,21 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Mang Board WP | CVE-2026-116847 Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. |
CVSS7,1 | EPSS0,19 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| eCommerce Product Catalog | CVE-2026-116851 Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. |
CVSS7,1 | EPSS0,19 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| HUSKY | CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. |
CVSS6,5 | EPSS0,22 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| SMS Alert Order Notifications | CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. |
CVSS9,8 | EPSS0,35 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| HUSKY | CVE-2026-116401 Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. |
CVSS7,5 | EPSS0,32 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| MultiVendorX | CVE-2026-114711 Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. |
CVSS6,5 | EPSS0,24 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| SureDash | CVE-2026-115604 Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. |
CVSS5,0 | EPSS0,43 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| YITH WooCommerce Product Add-Ons | CVE-2026-107868 Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions. |
CVSS5,3 | EPSS0,3 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Ad Inserter | CVE-2026-105077 Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. |
CVSS7,1 | EPSS0,23 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Booktics | CVE-2026-104674 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31. |
CVSS4,3 | EPSS0,25 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Meow Gallery | CVE-2026-9239 The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… |
CVSS6,4 | EPSS0,32 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | CVE-2026-96894 The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for… |
CVSS7,2 | EPSS0,38 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | CVE-2026-97638 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it… |
CVSS7,5 | EPSS0,56 % | KEVBrak wpisu w KEV nie wyklucza ataków | |
| glibc | CVE-2026-84243 The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses… |
CVSS7,0 | EPSS0,3 % | KEVBrak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 13.11.2026, 15:09 UTC – 13.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.