Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-65656 | 9.8 critical | 0.00% | dcatadmin, dcat_admin | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php. | Mon 26 Oct |
| CVE-2026-34236 | 9.8 critical | 0.00% | auth0, auth0-php | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0. | Mon 26 Oct |
| CVE-2026-45060 | 9.8 critical | 0.00% | no CPE yet | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129. | Mon 26 Oct |
| CVE-2026-39529 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | Mon 26 Oct |
| CVE-2026-49075 | 9.8 critical | 0.00% | no CPE yet | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | Mon 26 Oct |
| CVE-2026-52706 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | Mon 26 Oct |
| CVE-2026-54194 | 9.8 critical | 0.00% | no CPE yet | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | Mon 26 Oct |
| CVE-2026-54133 | 9.8 critical | 0.00% | jmespath | jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime. | 25 Oct |
| CVE-2026-27053 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. | 25 Oct |
| CVE-2026-49106 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions. | 25 Oct |
| CVE-2026-49109 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions. | 25 Oct |
| CVE-2026-49763 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions. | 25 Oct |
| CVE-2026-49765 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions. | 25 Oct |
| CVE-2026-49769 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | 25 Oct |
| CVE-2026-40725 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. | 24 Oct |
| CVE-2026-49107 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | 23 Oct |
| CVE-2026-49108 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. | 23 Oct |
| CVE-2026-112832 | 9.8 critical | 0.00% | no CPE yet | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6. | 22 Oct |
| CVE-2025-14388 | 9.8 critical | 0.00% | no CPE yet | The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path. | 19 Oct |
| CVE-2025-13675 | 9.8 critical | 0.00% | no CPE yet | The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. | 18 Oct |
| CVE-2025-64081 | 9.8 critical | 0.00% | pamzey, patients_waiting_area_queue_management_system | SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter. | 18 Oct |
| CVE-2026-104798 | 9.8 critical | 0.00% | no CPE yet | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation. | 16 Oct |
| CVE-2026-55684 | 9.8 critical | 0.00% | no CPE yet | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6. | 15 Oct |
| CVE-2026-55680 | 9.8 critical | 0.00% | no CPE yet | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6. | 15 Oct |
| CVE-2025-63742 | 9.8 critical | 0.00% | rockoa | SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters. | 14 Oct |
| CVE-2025-65336 | 9.8 critical | 0.00% | no CPE yet | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. | 14 Oct |
| CVE-2026-66569 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | 13 Oct |
| CVE-2026-78529 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | 13 Oct |
| CVE-2026-78531 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | 13 Oct |
| CVE-2026-78533 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | 13 Oct |
| CVE-2026-78535 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | 13 Oct |
| CVE-2026-81797 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | 13 Oct |
| CVE-2026-42716 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. | 13 Oct |
| CVE-2026-42718 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. | 13 Oct |
| CVE-2026-42723 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. | 13 Oct |
| CVE-2026-62050 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. | 13 Oct |
| CVE-2026-62051 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. | 13 Oct |
| CVE-2026-62052 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. | 13 Oct |
| CVE-2026-62053 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. | 13 Oct |
| CVE-2026-62054 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. | 13 Oct |
| CVE-2026-62076 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions. | 13 Oct |
| CVE-2026-62077 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. | 13 Oct |
| CVE-2026-62086 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Juno <= 2.25 versions. | 13 Oct |
| CVE-2026-62087 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. | 13 Oct |
| CVE-2026-62090 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. | 13 Oct |
| CVE-2026-62120 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. | 13 Oct |
| CVE-2026-62123 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. | 13 Oct |
| CVE-2026-62124 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. | 13 Oct |
| CVE-2026-62125 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. | 13 Oct |
| CVE-2026-66482 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. | 13 Oct |
Download these 367 as CSV · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.