CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| CVE-2026-116410 |
| 中6.5 |
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. |
| 30/10/2026 |
| CVE-2026-116405 | 高7.1 | Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. | 30/10/2026 |
| CVE-2026-116401 | 高7.5 | Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. | 30/10/2026 |
| CVE-2026-116386 | 緊急9.8 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. | 30/10/2026 |
| CVE-2026-115947 | 中6.5 | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | 30/10/2026 |
| CVE-2026-115604 | 中5.0 | Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. | 30/10/2026 |
| CVE-2026-114711 | 中6.5 | Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. | 30/10/2026 |
| CVE-2026-107868 | 中5.3 | Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions. | 30/10/2026 |
| CVE-2026-105077 | 高7.1 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. | 30/10/2026 |
| CVE-2026-104674 | 中4.3 | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31. | 30/10/2026 |
| CVE-2026-9239 | 中6.4 | The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above | 30/10/2026 |
| CVE-2026-97638 | 高7.5 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticat | 30/10/2026 |
| CVE-2026-96894 | 高7.2 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to in | 30/10/2026 |
| CVE-2026-84243 | 高7.0 | The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a m | 30/10/2026 |
| CVE-2026-76012 | 高7.5 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery pa | 30/10/2026 |