CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2026 |
| CVE-2026-54855 | ALTO7.1 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | 30/10/2026 |
| CVE-2026-54854 | MEDIO6.3 | Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | 30/10/2026 |
| CVE-2026-54850 | MEDIO6.5 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. | 30/10/2026 |
| CVE-2026-52710 | MEDIO5.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5. | 30/10/2026 |
| CVE-2026-48201 | ALTO7.1 | Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. | 30/10/2026 |
| CVE-2026-46560 | ALTO7.5 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the o | 30/10/2026 |
| CVE-2026-39786 | ALTO7.1 | Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. | 30/10/2026 |
| CVE-2026-39739 | MEDIO6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5. | 30/10/2026 |
| CVE-2026-39738 | CRITICO9.8 | Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1. | 30/10/2026 |
| CVE-2026-39734 | ALTO7.5 | Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. | 30/10/2026 |
| CVE-2026-39732 | CRITICO9.3 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | 30/10/2026 |
| CVE-2026-28160 | ALTO7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10. | 30/10/2026 |
| CVE-2026-27061 | MEDIO6.5 | Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | 30/10/2026 |
| CVE-2026-120046 | MEDIO5.3 | Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the | 30/10/2026 |
| CVE-2026-120007 | MEDIO6.5 | NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all t | 30/10/2026 |
| CVE-2026-119842 | MEDIO6.5 | A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file. | 30/10/2026 |
| CVE-2026-119729 | MEDIO6.5 | A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer over | 30/10/2026 |