Skip to content
OpenAdvisories

Archive

31 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /31 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-120209 Public exploit

    AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

    AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoad…

    anji-plus AJ-Report
  • Critical 9.8
    CVE-2026-116512 Public exploit

    Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

    The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsaniti…

    wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker Web / CMS
  • Medium 5.4
    CVE-2026-120019 Public exploit

    W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder

    The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.10.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…

    Bold Grid W3 Total Cache Web / CMS
  • High 8.1
    CVE-2026-119977 Exploited Public exploit

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…

    WordPress WordPress wordpress Web / CMS Debian
    KEV Nov 3, 2026