Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-34224 | 10.0 critical | 1.0% | vasion, virtual_appliance_application, virtual_appliance_host | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose a set of PHP scripts under the `console_release` directory without requiring authentication. An unauthenticated remote attacker can invoke these endpoints to re‑configure networked printers, add or delete RFID badge devices, or otherwise modify device settings. This vulnerability has been identified by the vendor as: V-2024-029 — No Authentication to Modify Devices. | 18 Oct |
| CVE-2026-55572 | 10.0 critical | 1.0% | no CPE yet | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7. | 16 Oct |
| CVE-2026-46512 | 9.9 critical | 1.0% | no CPE yet | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2. | Sat 24 Oct |
| CVE-2025-69691 | 9.9 critical | 1.0% | pfsense | Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code. | 15 Oct |
| CVE-2025-67164 | 9.9 critical | 1.0% | pagekit | An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file. | 13 Oct |
| CVE-2026-103688 | 9.8 critical | 1.0% | no CPE yet | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code execution on servers that execute PHP from the uploads directory. | Wed 28 Oct |
| CVE-2025-56563 | 9.8 critical | 1.0% | no CPE yet | A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation. An unauthenticated remote attacker can leverage this to make arbitrary HTTP and HTTPS requests from the server to internal networks or cloud metadata services, potentially obtaining sensitive information or pivoting to further attacks. | Wed 28 Oct |
| CVE-2026-109218 | 9.8 critical | 1.0% | no CPE yet | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request. | Wed 28 Oct |
| CVE-2024-11080 | 9.8 critical | 1.0% | no CPE yet | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the ~/includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress, granted no other security controls are present in the function. | Tue 27 Oct |
| CVE-2025-63334 | 9.8 critical | 1.0% | magdesign, pocketvj_control_panel_firmware | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execution vulnerability in the submit_opacity.php component. The application fails to sanitize user input in the opacityValue POST parameter before passing it to a shell command, allowing remote attackers to execute arbitrary commands with root privileges on the underlying system. | Tue 27 Oct |
| CVE-2026-30993 | 9.8 critical | 1.0% | no CPE yet | Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input. | Mon 26 Oct |
| CVE-2026-115806 | 9.8 critical | 1.0% | no CPE yet | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself. | Mon 26 Oct |
| CVE-2026-27429 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | Mon 26 Oct |
| CVE-2026-49781 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. | Sun 25 Oct |
| CVE-2026-57621 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. | Sun 25 Oct |
| CVE-2026-57677 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions. | Sun 25 Oct |
| CVE-2026-56032 | 9.8 critical | 1.0% | no CPE yet | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. | Sun 25 Oct |
| CVE-2026-56057 | 9.8 critical | 1.0% | no CPE yet | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. | Sun 25 Oct |
| CVE-2026-12116 | 9.8 critical | 1.0% | no CPE yet | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed. | Sun 25 Oct |
| CVE-2026-32563 | 9.8 critical | 1.0% | no CPE yet | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | Sat 24 Oct |
| CVE-2026-15982 | 9.8 critical | 1.0% | no CPE yet | The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts. | Sat 24 Oct |
| CVE-2026-49827 | 9.8 critical | 1.0% | no CPE yet | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818. | Sat 24 Oct |
| CVE-2026-65552 | 9.8 critical | 1.0% | no CPE yet | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | Sat 24 Oct |
| CVE-2026-65556 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. | Sat 24 Oct |
| CVE-2026-65571 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | Sat 24 Oct |
| CVE-2026-65572 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | Sat 24 Oct |
| CVE-2026-65573 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | Sat 24 Oct |
| CVE-2026-65574 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. | Sat 24 Oct |
| CVE-2026-65575 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. | Sat 24 Oct |
| CVE-2026-65576 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | Sat 24 Oct |
| CVE-2026-65577 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. | Sat 24 Oct |
| CVE-2026-65578 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | Sat 24 Oct |
| CVE-2026-65579 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | Sat 24 Oct |
| CVE-2026-65581 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. | Sat 24 Oct |
| CVE-2026-72592 | 9.8 critical | 1.0% | no CPE yet | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path. | Sat 24 Oct |
| CVE-2026-71207 | 9.8 critical | 1.0% | no CPE yet | The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path. | Sat 24 Oct |
| CVE-2026-71231 | 9.8 critical | 1.0% | no CPE yet | IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. | Sat 24 Oct |
| CVE-2023-25207 | 9.8 critical | 1.0% | prestashop, dpd_france | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. | Sat 24 Oct |
| CVE-2026-42380 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. | Sat 24 Oct |
| CVE-2026-64796 | 9.8 critical | 1.0% | no CPE yet | Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection. | Sat 24 Oct |
| CVE-2026-59544 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. | Sat 24 Oct |
| CVE-2026-73376 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | Fri 23 Oct |
| CVE-2026-28139 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. | Fri 23 Oct |
| CVE-2026-28149 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | Fri 23 Oct |
| CVE-2026-67960 | 9.8 critical | 1.0% | no CPE yet | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components | 22 Oct |
| CVE-2026-32470 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | 22 Oct |
| CVE-2026-73341 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | 22 Oct |
| CVE-2026-73366 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. | 22 Oct |
| CVE-2026-73380 | 9.8 critical | 1.0% | no CPE yet | Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | 22 Oct |
| CVE-2026-111862 | 9.8 critical | 1.0% | no CPE yet | Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement. | 20 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.