Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,548
- Last 24h
- 348
- Critical, 7 days
- 303
- Known exploited
- 1,781
26,235 results · Clear filters · Feed
-
Critical 9.8CVE-2026-49104 Public exploit
WordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.
-
Critical 9.8CVE-2026-49085 Public exploit
WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.
-
Critical 9.3
WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability
Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.
-
Critical 9.3
WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability
Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.
-
Critical 9.1
WordPress TrueBooker plugin <= 1.1.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.
-
Critical 10.0
WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.
-
Critical 9.3
WordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.
-
Critical 9.3
WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.
-
Critical 9.3
WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.
-
Critical 9.3
WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.
-
Critical 9.3
WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.
-
Critical 9.3
WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability
Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.
-
Critical 10.0
WordPress GeekyBot plugin <= 1.2.2 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.
-
Critical 9.3
WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability
Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.
-
Critical 9.9
WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.
-
Critical 9.8
WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.
-
Critical 9.3
WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.
-
Critical 9.3
WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.
-
Critical 9.3
WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
-
Critical 9.3
WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.
-
Critical 9.3
WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability
Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.
-
Critical 9.3
WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.
-
Critical 9.3CVE-2026-39492 Public exploit
WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
-
Critical 9.1
WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability
Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.
-
Critical 9.3
WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
-
Critical 9.8
WordPress iControlWP plugin <= 5.5.3 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
-
Critical 9.8
WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
-
Critical 9.8CVE-2026-9691 Public exploit
WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.
-
Critical 9.8
Metacat has an unauthenticated SQL injection vulnerability
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT agai…
-
Critical 9.1
Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key betw…
-
Critical 9.8
Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the serv…
-
Critical 10.0
WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
-
Critical 9.8
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 Arbitrary File Upload
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with…
-
Critical 9.3
Remote Code Execution via Unrestricted File Upload in Responsive FileManager
Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution. This project is unmaintained at the time of CVE assignment. The vulnerabili…
-
Critical 9.2
OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account takeover of local users via OAuth2/OIDC sign-in. AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address (an upsert on the e…
-
Critical 9.8
Advanced Google Maps < 6.1.1 - Unauthenticated Administrator Account Creation
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-logi…
-
Critical 9.8
An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to exe…
-
Critical 9.8
An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supply…
-
Critical 9.8
YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution
An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.
-
Critical 9.1
Project Firefly III has incorrect access control in the webhook management component
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.