Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-104070 | 9.3 critical | 1.0% | no CPE yet | The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user. | 9 Oct |
| CVE-2026-79774 | 9.3 critical | 1.0% | no CPE yet | Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections. | 8 Oct |
| CVE-2026-114403 | 9.2 critical | 1.0% | no CPE yet | PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service. | Wed 28 Oct |
| CVE-2026-6257 | 9.2 critical | 1.0% | no CPE yet | Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user. | Mon 26 Oct |
| CVE-2026-39918 | 9.2 critical | 1.0% | no CPE yet | Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user. | Mon 26 Oct |
| CVE-2026-67285 | 9.2 critical | 1.0% | no CPE yet | Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system. | 24 Oct |
| CVE-2026-109357 | 9.2 critical | 1.0% | no CPE yet | LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access. | 15 Oct |
| CVE-2026-59989 | 9.2 critical | 1.0% | no CPE yet | Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0. | 12 Oct |
| CVE-2026-103882 | 9.1 critical | 1.0% | acadlix, acadlix lms – ai quiz maker, online exam & course plugin for wordpress | The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated. | 23 h ago |
| CVE-2026-58256 | 9.1 critical | 1.0% | no CPE yet | GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and permitting remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page. The advisory reports this issue as fixed in version 4.5.0. | Wed 28 Oct |
| CVE-2026-35573 | 9.1 critical | 1.0% | churchcrm | ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3. | Mon 26 Oct |
| CVE-2026-40484 | 9.1 critical | 1.0% | no CPE yet | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0. | Mon 26 Oct |
| CVE-2026-39339 | 9.1 critical | 1.0% | churchcrm | ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0. | Mon 26 Oct |
| CVE-2026-58409 | 9.1 critical | 1.0% | no CPE yet | ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block standard .php files. Because `php` is explicitly included in the allowed extension list for plugin archives, and extracted files are placed directly under the web root, any PHP file inside the ZIP becomes immediately executable via HTTP — without even needing to "enable" the plugin through the application UI. The /plugins/install-url API route (management.php) allows an administrator to source the malicious ZIP from any attacker-controlled HTTPS URL, validating it only against an attacker-supplied SHA-256 hash. This issue has been fixed in version 7.4.0. | 24 Oct |
| CVE-2025-61318 | 9.1 critical | 1.0% | emlog | Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php component. They fail to perform path verification and dangerous code filtering for deletion parameters, allowing attackers to exploit this feature for directory traversal. | 15 Oct |
| CVE-2025-65473 | 9.1 critical | 1.0% | easyimages2.0_project, easyimages2.0 | An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to execute arbitrary code via injecting a crafted payload into an uploaded file name. | 14 Oct |
| CVE-2026-104801 | 9.1 critical | 1.0% | no CPE yet | The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the rename_files function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The relocated file is moved byte-identically into the publicly accessible wp-content/uploads/ppom_files/confirmed/ directory, meaning the attack also results in arbitrary file read for any web-readable file on the server. | 13 Oct |
| CVE-2026-49849 | 9.1 critical | 1.0% | no CPE yet | xShop is an open-source shop developed in Laravel. An Unrestricted File Upload vulnerability in xShop version 3.0.3 allows an authenticated administrator to upload executable files (e.g., .php). By uploading a specially crafted php file, an attacker can achieve Remote Code Execution (RCE) on the server, leading to a full system compromise. Version 3.0.4 fixes the issue. | 12 Oct |
| CVE-2026-12260 | 10.0 critical | 0.00% | no CPE yet | SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment. | 8 Oct |
| CVE-2026-34037 | 9.9 critical | 0.00% | no CPE yet | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscoped Eloquent lookups, allowing an authenticated user to clone resources into destinations owned by other teams and access cross-tenant resources. This issue is fixed in version 4.0.0-beta.464. | Sun 25 Oct |
| CVE-2025-66255 | 9.9 critical | 0.00% | dbbroadcast, mozart_next_3000_firmware, mozart_next_3500_firmware, mozart_next_50_firmware | Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages. The firmware upgrade endpoint in `upgrade_contents.php` accepts arbitrary file uploads without validating file headers, cryptographic signatures, or enforcing .tgz format requirements, allowing malicious firmware injection. This endpoint also subsequently provides ways for arbitrary file uploads and subsequent remote code execution | 18 Oct |
| CVE-2025-66256 | 9.9 critical | 0.00% | dbbroadcast, mozart_next_100_firmware, mozart_next_1000_firmware, mozart_next_2000_firmware | Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Unrestricted file upload in patch_contents.php allows uploading malicious files. The `/var/tdf/patch_contents.php` endpoint allows unauthenticated arbitrary file uploads without file type validation, MIME checking, or size restrictions beyond 16MB, enabling attackers to upload malicious files. | 18 Oct |
| CVE-2026-39738 | 9.8 critical | 0.00% | funnelkit, funnelkit automations | Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions. | Fri 30 Oct |
| CVE-2026-90888 | 9.8 critical | 0.00% | leadsnap | Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | Fri 30 Oct |
| CVE-2026-54856 | 9.8 critical | 0.00% | themerex, rexcoin | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | Fri 30 Oct |
| CVE-2026-54857 | 9.8 critical | 0.00% | themerex, quirky | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | Fri 30 Oct |
| CVE-2026-54860 | 9.8 critical | 0.00% | themerex, ozisti | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | Fri 30 Oct |
| CVE-2026-61992 | 9.8 critical | 0.00% | von eyal fitoussi, geo my wordpress | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | Fri 30 Oct |
| CVE-2026-61998 | 9.8 critical | 0.00% | themerex, le truffe | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | Fri 30 Oct |
| CVE-2026-62003 | 9.8 critical | 0.00% | themerex, mission | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | Fri 30 Oct |
| CVE-2026-62004 | 9.8 critical | 0.00% | themerex, motorix | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | Fri 30 Oct |
| CVE-2026-62005 | 9.8 critical | 0.00% | themerex, muzicon | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | Fri 30 Oct |
| CVE-2026-62009 | 9.8 critical | 0.00% | themerex, filmax | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | Fri 30 Oct |
| CVE-2026-62010 | 9.8 critical | 0.00% | themerex, avventure | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | Fri 30 Oct |
| CVE-2026-62011 | 9.8 critical | 0.00% | themerex, bonbon | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | Fri 30 Oct |
| CVE-2026-62014 | 9.8 critical | 0.00% | themerex, emojination | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | Fri 30 Oct |
| CVE-2026-62015 | 9.8 critical | 0.00% | themerex, gamezone | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | Fri 30 Oct |
| CVE-2026-62016 | 9.8 critical | 0.00% | themerex, gamic | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | Fri 30 Oct |
| CVE-2026-62131 | 9.8 critical | 0.00% | zoho flow | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | Fri 30 Oct |
| CVE-2026-62013 | 9.8 critical | 0.00% | themerex, edge decor | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | Thu 29 Oct |
| CVE-2026-62018 | 9.8 critical | 0.00% | themerex, gunslinger | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | Thu 29 Oct |
| CVE-2026-62008 | 9.8 critical | 0.00% | themerex, orpheus | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | Thu 29 Oct |
| CVE-2026-54858 | 9.8 critical | 0.00% | themerex, printy | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | Thu 29 Oct |
| CVE-2026-62001 | 9.8 critical | 0.00% | themerex, marcell | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | Thu 29 Oct |
| CVE-2026-62006 | 9.8 critical | 0.00% | themerex, nuts | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | Thu 29 Oct |
| CVE-2026-62012 | 9.8 critical | 0.00% | themerex, coinpress | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | Thu 29 Oct |
| CVE-2026-62017 | 9.8 critical | 0.00% | themerex, good homes | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | Thu 29 Oct |
| CVE-2026-84999 | 9.8 critical | 0.00% | no CPE yet | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file. | Wed 28 Oct |
| CVE-2024-44065 | 9.8 critical | 0.00% | magicbug, cloudlog | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults parameter. | Tue 27 Oct |
| CVE-2024-25182 | 9.8 critical | 0.00% | vvveb, vvvebjs | givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. | Tue 27 Oct |
Download these 368 as CSV · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.