CVE-2026-61998CRITICAL · 9.8
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
Vulnerability intelligence platform
Know your exposure.
Stay ahead of threats.
Threat intelligence, made actionable Get actionable vulnerability briefings: affected platforms, exploit intelligence, severity, vendor advisories and remediation guidance. Subscribe to the technologies that matter to your environment.
72,124CVEs in selected period
7,889Critical
29,387High
25,483Medium
Explore vulnerabilities
72,124 matching records · 2026-11-09 18:32 ISTCVE-2026-61997CRITICAL · 9.8
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
CVE-2026-61996HIGH · 8.5
Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.
CVE-2026-61995HIGH · 7.1
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
CVE-2026-61993HIGH · 7.1
Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.
CVE-2026-61992CRITICAL · 9.8
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
CVE-2026-61991CRITICAL · 10.0
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
CVE-2026-61989HIGH · 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
CVE-2026-61988HIGH · 7.1
Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.
CVE-2026-54866HIGH · 7.1
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.
CVE-2026-54865MEDIUM · 6.5
Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.
CVE-2026-54864HIGH · 7.1
Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.
CVE-2026-54860CRITICAL · 9.8
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
CVE-2026-54859CRITICAL · 9.8
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
CVE-2026-54858CRITICAL · 9.8
Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
CVE-2026-54857CRITICAL · 9.8
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
CVE-2026-54856CRITICAL · 9.8
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
CVE-2026-48200MEDIUM · 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.
CVE-2026-42701HIGH · 7.2
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
CVE-2026-42694MEDIUM · 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.
CVE-2026-42692HIGH · 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.
CVE-2026-42690MEDIUM · 5.4
Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.
CVE-2026-27394HIGH · 7.1
Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.
CVE-2026-20942MEDIUM · 4.3
Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-18894MEDIUM · 6.5
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.
Page 193 of 2,885← Previous Next →