按严重度 / 渠道 / 厂商 / 时间筛选公开漏洞条目。
CVE-2026-104730 · 2026-10-16 · auto
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted in…
CVE-2026-89079 · 2026-10-16 · auto
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to upd…
CVE-2026-103768 · 2026-10-16 · auto
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient f…
CVE-2026-109515 · 2026-10-16 · auto
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `sub…
CVE-2026-109219 · 2026-10-16 · auto
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-su…
CVE-2026-104798 · 2026-10-16 · auto
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized…
CVE-2018-8014 · 2026-10-15 · auto
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected …
CVE-2018-7489 · 2026-10-15 · auto
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploi…
CVE-2017-5648 · 2026-10-15 · auto
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade …
CVE-2026-97229 · 2026-10-14 · auto
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to exec…
CVE-2025-9321 · 2026-10-11 · auto
The WPCasa plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.4.1. This is due to insufficient input validation and restriction on the 'api_requests' function. This makes it poss…
CVE-2026-107645 · 2026-10-11 · auto
The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-…
CVE-2026-104732 · 2026-10-11 · auto
The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability exists because `handle_login_action()` performs no server-side check — v…
CVE-2026-102628 · 2026-10-11 · auto
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger…
CVE-2026-81797 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
CVE-2026-78535 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
CVE-2026-78533 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
CVE-2026-78531 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
CVE-2026-78529 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
CVE-2026-66569 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
CVE-2026-66568 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
CVE-2026-66567 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
CVE-2026-66565 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
CVE-2026-66564 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
CVE-2026-66563 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
CVE-2026-66483 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
CVE-2026-66482 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
CVE-2026-62125 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
CVE-2026-62124 · 2026-10-10 · auto
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
CVE-2026-62123 · 2026-10-10 · auto
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
CVE-2026-62120 · 2026-10-10 · auto
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
CVE-2026-62090 · 2026-10-10 · auto
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
CVE-2026-62087 · 2026-10-10 · auto
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
CVE-2026-62086 · 2026-10-10 · auto
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
CVE-2026-62077 · 2026-10-10 · auto
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
CVE-2026-62076 · 2026-10-10 · auto
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
CVE-2026-62054 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
CVE-2026-62053 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
CVE-2026-62052 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
CVE-2026-62051 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
CVE-2026-62050 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
CVE-2026-42723 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
CVE-2026-42719 · 2026-10-10 · auto
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
CVE-2026-42718 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
CVE-2026-42716 · 2026-10-11 · auto
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
CVE-2026-105892 · 2026-10-10 · auto
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia …
CVE-2026-104803 · 2026-10-10 · auto
The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init`…
CVE-2026-104801 · 2026-10-10 · auto
The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and inc…
CVE-2026-97670 · 2026-10-11 · auto
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a Word…
CVE-2026-103889 · 2026-10-11 · auto
The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authent…