Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-62014 | 9.8 critical | 0.00% | themerex, emojination | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | Fri 30 Oct |
| CVE-2026-62015 | 9.8 critical | 0.00% | themerex, gamezone | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | Fri 30 Oct |
| CVE-2026-62016 | 9.8 critical | 0.00% | themerex, gamic | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | Fri 30 Oct |
| CVE-2026-62131 | 9.8 critical | 0.00% | zoho flow | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | Fri 30 Oct |
| CVE-2026-62013 | 9.8 critical | 0.00% | themerex, edge decor | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | Thu 29 Oct |
| CVE-2026-62018 | 9.8 critical | 0.00% | themerex, gunslinger | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | Thu 29 Oct |
| CVE-2026-62008 | 9.8 critical | 0.00% | themerex, orpheus | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | Thu 29 Oct |
| CVE-2026-54858 | 9.8 critical | 0.00% | themerex, printy | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | Thu 29 Oct |
| CVE-2026-62001 | 9.8 critical | 0.00% | themerex, marcell | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | Thu 29 Oct |
| CVE-2026-62006 | 9.8 critical | 0.00% | themerex, nuts | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | Thu 29 Oct |
| CVE-2026-62012 | 9.8 critical | 0.00% | themerex, coinpress | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | Thu 29 Oct |
| CVE-2026-62017 | 9.8 critical | 0.00% | themerex, good homes | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | Thu 29 Oct |
| CVE-2026-84999 | 9.8 critical | 0.00% | no CPE yet | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those validation calls produced errors before move_uploaded_file() is called, combined with no nonce or capability check on the AJAX handler. This makes it possible for unauthenticated attackers to upload files of dangerous types (e.g. PHP scripts) that may be executable, which makes remote code execution possible. The server returns the generated destination filename in the response, giving the attacker the exact path needed to trigger the uploaded file. | Wed 28 Oct |
| CVE-2024-44065 | 9.8 critical | 0.00% | magicbug, cloudlog | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults parameter. | Tue 27 Oct |
| CVE-2024-25182 | 9.8 critical | 0.00% | vvveb, vvvebjs | givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. | Tue 27 Oct |
| CVE-2025-65358 | 9.8 critical | 0.00% | hashenudara, edoc-doctor-appointment-system | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php. | Mon 26 Oct |
| CVE-2025-65656 | 9.8 critical | 0.00% | dcatadmin, dcat_admin | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php. | Mon 26 Oct |
| CVE-2026-34236 | 9.8 critical | 0.00% | auth0, auth0-php | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0. | Mon 26 Oct |
| CVE-2026-45060 | 9.8 critical | 0.00% | no CPE yet | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129. | Mon 26 Oct |
| CVE-2026-39529 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | Mon 26 Oct |
| CVE-2026-49075 | 9.8 critical | 0.00% | no CPE yet | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | Mon 26 Oct |
| CVE-2026-52706 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | Mon 26 Oct |
| CVE-2026-54194 | 9.8 critical | 0.00% | no CPE yet | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | Mon 26 Oct |
| CVE-2026-54133 | 9.8 critical | 0.00% | jmespath | jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression can cause the generated cache file to contain executable attacker-controlled PHP, which is then loaded by the compiler runtime. The issue is patched in `2.9.1` and later. As a workaround, disable `JP_PHP_COMPILE` and do not use `JmesPath\CompilerRuntime` with attacker-controlled expressions. Use the default `AstRuntime` for untrusted expressions. Applications that must continue accepting untrusted JMESPath expressions before upgrading should ensure those expressions are never evaluated by the compiler runtime. | 25 Oct |
| CVE-2026-27053 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. | 25 Oct |
| CVE-2026-49106 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions. | 25 Oct |
| CVE-2026-49109 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions. | 25 Oct |
| CVE-2026-49763 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions. | 25 Oct |
| CVE-2026-49765 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions. | 25 Oct |
| CVE-2026-49769 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | 25 Oct |
| CVE-2026-40725 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. | 24 Oct |
| CVE-2026-49107 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | 23 Oct |
| CVE-2026-49108 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. | 23 Oct |
| CVE-2026-112832 | 9.8 critical | 0.00% | no CPE yet | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6. | 22 Oct |
| CVE-2025-14388 | 9.8 critical | 0.00% | no CPE yet | The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path. | 19 Oct |
| CVE-2025-13675 | 9.8 critical | 0.00% | no CPE yet | The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. | 18 Oct |
| CVE-2025-64081 | 9.8 critical | 0.00% | pamzey, patients_waiting_area_queue_management_system | SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter. | 18 Oct |
| CVE-2026-104798 | 9.8 critical | 0.00% | no CPE yet | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation. | 16 Oct |
| CVE-2026-55684 | 9.8 critical | 0.00% | no CPE yet | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6. | 15 Oct |
| CVE-2026-55680 | 9.8 critical | 0.00% | no CPE yet | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6. | 15 Oct |
| CVE-2025-63742 | 9.8 critical | 0.00% | rockoa | SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information, including administrator accounts, password hashes, database structure, and other critical data via the shouji and userid parameters. | 14 Oct |
| CVE-2025-65336 | 9.8 critical | 0.00% | no CPE yet | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. | 14 Oct |
| CVE-2026-66569 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | 13 Oct |
| CVE-2026-78529 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | 13 Oct |
| CVE-2026-78531 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | 13 Oct |
| CVE-2026-78533 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | 13 Oct |
| CVE-2026-78535 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | 13 Oct |
| CVE-2026-81797 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | 13 Oct |
| CVE-2026-42716 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. | 13 Oct |
| CVE-2026-42718 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. | 13 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.