Skip to content
OpenAdvisories

Archive

10 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /10 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

136 results · Clear filters · Feed

  • High 8.1
    CVE-2026-108657

    JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPack…

    jeecgboot JeecgBoot
  • High 8.1
    CVE-2026-108628

    JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId…

    jeecgboot JeecgBoot
  • High 7.1
    CVE-2026-108623

    JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allcle…

    jeecgboot JeecgBoot
  • High 7.2
    CVE-2026-27350

    WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

    Builderius.io Builderius
  • High 7.1
    CVE-2026-57742

    WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

    ThemeREX Kids Planet
  • High 7.1
    CVE-2026-78534

    WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

    Keen IT Solutions Educavo
  • High 7.1
    CVE-2026-78532

    WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

    Design themes LMS
  • High 7.7
    CVE-2026-78530

    WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability

    Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

    Chimpstudio FoodBakery
  • High 8.1
    CVE-2026-66566

    WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

    Elated-Themes Ambient
  • High 7.2
    CVE-2026-62130

    WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

    Amir Helzer WooCommerce Multilingual & Multicurrency Web / CMS
  • High 7.5
    CVE-2026-65459

    WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

    WPMU DEV Forminator
  • High 7.3
    CVE-2026-62118

    WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

    Dmitry V. Barcode Scanner with Inventory & Order Manager
  • High 8.5
    CVE-2026-62117

    WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability

    Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

    Dmitry V. Barcode Scanner with Inventory & Order Manager
  • High 7.1
    CVE-2026-62116

    WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

    Dmitry V. Barcode Scanner with Inventory & Order Manager
  • High 7.1
    CVE-2026-62100

    WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

    kutethemes KuteShop
  • High 8.1
    CVE-2026-62115

    WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

    kutethemes KuteShop
  • High 8.1
    CVE-2026-62099

    WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

    kutethemes Boutique
  • High 7.1
    CVE-2026-62095

    WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

    kutethemes Biolife
  • High 8.1
    CVE-2026-62096

    WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

    kutethemes Biolife
  • High 8.1
    CVE-2026-62094

    WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

    kutethemes TechOne
  • High 7.1
    CVE-2026-62093

    WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

    kutethemes TechOne
  • High 7.1
    CVE-2026-62091

    WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

    kutethemes Armania
  • High 8.1
    CVE-2026-62092

    WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

    kutethemes Armania
  • High 7.1
    CVE-2026-62082

    WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

    An-Themes Pin WP
  • High 8.1
    CVE-2026-62075

    WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

    Mymoun Backhoe
  • High 8.1
    CVE-2026-62074

    WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

    ThemeREX Ozeum
  • High 8.1
    CVE-2026-62070

    WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

    CKThemes Flipmart
  • High 8.1
    CVE-2026-62068

    WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

    CocoBasic Teoro
  • High 8.1
    CVE-2026-62069

    WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

    CocoBasic Fabius
  • High 8.1
    CVE-2026-62067

    WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

    CocoBasic Kaven
  • High 8.1
    CVE-2026-62066

    WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

    CocoBasic Volos
  • High 8.1
    CVE-2026-62065

    WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

    CocoBasic Cardea
  • High 7.1
    CVE-2026-62064

    WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

    bracketweb Ambed
  • High 7.5
    CVE-2026-62043

    WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

    sevenspark Contact Form 7 – Dynamic Text Extension
  • High 7.3
    CVE-2026-62038

    WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

    DigitalME eRoom
  • High 7.1
    CVE-2026-62037

    WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

    bPlugins Document Embedder
  • High 7.1
    CVE-2026-62034

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

    bPlugins Before After Image Comparison – Image comparison for WP
  • High 7.6
    CVE-2026-62033

    WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

    Subscriber Settings Change in uListing <= 2.2.0 versions.

    stylemix uListing
  • High 7.2
    CVE-2026-62030

    WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

    bPlugins StreamCast
  • High 7.1
    CVE-2026-62027

    WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

    bPlugins Team Section Block