Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-109414 | 6.5 medium | 0.00% | no CPE yet | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with vendor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is an incomplete fix for a previously patched SQL injection (version 3.6.0), which addressed only the gt/lt/le/ge operators while leaving the 'bt' (BETWEEN) operator branch unpatched. | 16 Oct |
| CVE-2026-109382 | 6.5 medium | 0.00% | no CPE yet | The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and the wsp_execute_get_posts() callback honouring a caller-supplied status=all argument that expands into a WP_Query over 'publish', 'draft', 'pending' and 'future' posts with no author or ownership filter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the titles, URLs, authors, categories, tags and 40-word excerpts of every unpublished (draft/pending/scheduled) post on the site. | 16 Oct |
| CVE-2026-103911 | 6.5 medium | 0.00% | no CPE yet | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution. | 16 Oct |
| CVE-2026-101335 | 6.5 medium | 0.00% | no CPE yet | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure. | 16 Oct |
| CVE-2026-19848 | 6.5 medium | 0.00% | no CPE yet | The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date. | 16 Oct |
| CVE-2025-13922 | 6.5 medium | 0.00% | no CPE yet | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_terms_orderby' parameter in the AI preview AJAX endpoint in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of SQL query parameterization. This makes it possible for authenticated attackers, with Contributor-level access and above who have AI metabox permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, cause performance degradation, or enable data inference through time-based techniques. | 15 Oct |
| CVE-2026-86803 | 6.5 medium | 0.00% | no CPE yet | The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | 15 Oct |
| CVE-2026-101926 | 6.5 medium | 0.00% | no CPE yet | The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 15 Oct |
| CVE-2026-106031 | 6.5 medium | 0.00% | no CPE yet | The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones. | 15 Oct |
| CVE-2026-103907 | 6.5 medium | 0.00% | no CPE yet | The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler (registered generically for every element via wp_ajax_{$element_id} in Elements_Option_Abstract::setup_hook) returns the element's full option schema — including a freshly minted wp_create_nonce('jeg_find_author') — to any authenticated caller, and the 'wp_ajax_jeg_find_author' handler then runs a WP_User_Query with the attacker-supplied 'query' wrapped in '*…*' against search_columns that include user_email, echoing the ID and display_name of every matching user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every registered user of the site and to reconstruct arbitrary users' email addresses one character at a time by using the substring search as an oracle. | 14 Oct |
| CVE-2026-108064 | 6.5 medium | 0.00% | no CPE yet | The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance. | 14 Oct |
| CVE-2026-87843 | 6.5 medium | 0.00% | no CPE yet | The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details. | 14 Oct |
| CVE-2026-103308 | 6.5 medium | 0.00% | no CPE yet | The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of payment gateway return requests, relying on a merchant secret that is empty on a store which has not entered its credentials, allowing unauthenticated attackers to mark arbitrary orders as paid and to disclose the name, email address and postal address of any order's customer. | 14 Oct |
| CVE-2026-85571 | 6.5 medium | 0.00% | no CPE yet | The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable. | 13 Oct |
| CVE-2026-89304 | 6.5 medium | 0.00% | no CPE yet | The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks. | 13 Oct |
| CVE-2026-89305 | 6.5 medium | 0.00% | no CPE yet | The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks. | 13 Oct |
| CVE-2026-107791 | 6.5 medium | 0.00% | no CPE yet | The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site. | 13 Oct |
| CVE-2026-104915 | 6.5 medium | 0.00% | no CPE yet | The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. This is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses. | 13 Oct |
| CVE-2026-107712 | 6.5 medium | 0.00% | no CPE yet | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a regression vulnerability — a capability check introduced in versions 2.0.19.11–2.0.19.14 to address CVE-2024-50425 was removed in version 2.1, meaning any authenticated subscriber-level account can reach the vulnerable handler with no nonce validation required. | 13 Oct |
| CVE-2026-105059 | 6.5 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1. | 12 Oct |
| CVE-2025-9199 | 6.5 medium | 0.00% | no CPE yet | The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in all versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 12 Oct |
| CVE-2025-58020 | 6.5 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.18.8. | 11 Oct |
| CVE-2025-9198 | 6.5 medium | 0.00% | no CPE yet | The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 11 Oct |
| CVE-2025-10746 | 6.5 medium | 0.00% | no CPE yet | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters. | 11 Oct |
| CVE-2025-11227 | 6.5 medium | 0.00% | givewp | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' functions due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from private and draft donation forms, as well as archived campaigns. | 11 Oct |
| CVE-2026-96653 | 6.5 medium | 0.00% | no CPE yet | The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::update_listings_user_editor() re-reads that stored value and passes it unsanitized to the SQL sink. | 11 Oct |
| CVE-2026-42695 | 6.5 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.54.7212. | 11 Oct |
| CVE-2026-86851 | 6.5 medium | 0.00% | no CPE yet | The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys. | 9 Oct |
| CVE-2026-86850 | 6.5 medium | 0.00% | no CPE yet | The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind. | 9 Oct |
| CVE-2025-11372 | 6.5 medium | 0.00% | no CPE yet | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permission_callback set to __return_true. This makes it possible for unauthenticated attackers to perform destructive database operations including dropping indexes on any table (including WordPress core tables like wp_options), creating duplicate configuration entries, and degrading site performance via the /wp-json/lp/v1/admin/tools/create-indexs endpoint granted they can provide table names. | 9 Oct |
| CVE-2025-49960 | 6.5 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leadbi LeadBI Plugin for WordPress leadbi allows Stored XSS.This issue affects LeadBI Plugin for WordPress: from n/a through <= 1.7. | 8 Oct |
| CVE-2026-94245 | 6.5 medium | 0.00% | no CPE yet | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control. | 8 Oct |
| CVE-2026-93509 | 6.5 medium | 0.00% | no CPE yet | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account. | 8 Oct |
| CVE-2025-10649 | 6.5 medium | 0.00% | no CPE yet | The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 8 Oct |
| CVE-2025-10038 | 6.5 medium | 0.00% | no CPE yet | The Binary MLM Plan plugin for WordPress is vulnerable to limited Privilege Escalation in all versions up to, and including, 3.0. This is due to bmp_user role granting all users with the manage_bmp capability by default upon registration through the plugin's form. This makes it possible for unauthenticated attackers to register and manage the plugin's settings. | 8 Oct |
| CVE-2025-10575 | 6.5 medium | 0.00% | no CPE yet | The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_page_imgs() function in all versions up to, and including, 1.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 8 Oct |
| CVE-2025-10660 | 6.5 medium | 0.00% | no CPE yet | The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 8 Oct |
| CVE-2025-10730 | 6.5 medium | 0.00% | no CPE yet | The Wp tabber widget plugin for WordPress is vulnerable to SQL Injection via the 'wp-tabber-widget' shortcode in all versions up to, and including, 4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 8 Oct |
| CVE-2025-11365 | 6.5 medium | 0.00% | no CPE yet | The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'google_map' shortcode in all versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 8 Oct |
| CVE-2025-5983 | 6.5 medium | 0.00% | no CPE yet | The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags. | 8 Oct |
| CVE-2025-10748 | 6.5 medium | 0.00% | no CPE yet | The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level permissions and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 8 Oct |
| CVE-2025-11879 | 6.5 medium | 0.00% | no CPE yet | The GenerateBlocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_option_rest' function in all versions up to, and including, 2.1.1. This makes it possible for authenticated attackers, with contributor level access and above, to read arbitrary WordPress options, including sensitive information such as SMTP credentials, API keys, and other data stored by other plugins. | 8 Oct |
| CVE-2025-11893 | 6.5 medium | 0.00% | no CPE yet | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donation_ids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation of the vulnerability requires a paid donation. | 8 Oct |
| CVE-2025-62987 | 6.5 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Builderall Builderall Builder for WordPress builderall-cheetah-for-wp allows Stored XSS.This issue affects Builderall Builder for WordPress: from n/a through <= 3.0.1. | 8 Oct |
| CVE-2025-11705 | 6.5 medium | 0.00% | no CPE yet | The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. | 8 Oct |
| CVE-2025-9544 | 6.5 medium | 0.00% | no CPE yet | The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin through 2.5.1 (limited to those whitelisted by the main Doppler Forms WordPress plugin through 2.5.1). | 8 Oct |
| CVE-2025-10144 | 6.5 medium | 0.00% | no CPE yet | The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 8 Oct |
| CVE-2025-10163 | 6.5 medium | 0.00% | no CPE yet | The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versions up to, and including, 0.91.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | 8 Oct |
| CVE-2026-116546 | 6.4 medium | 0.00% | wpjobportal, wp job portal – ai-powered recruitment system for company or job board website | The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's self-registration flow allows any visitor to create a Subscriber-backed Employer account, meaning this vulnerability is effectively exploitable by any user who can register on the site. | 3 h ago |
| CVE-2026-107765 | 6.4 medium | 0.00% | marketingfire, discussion board – wordpress forum plugin | The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. This is due to insufficient output escaping in the ctdb_filter_comment_author_name() callback hooked to get_comment_author_link, which interpolates the raw user_url value into a single-quoted href attribute without esc_url() or esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a Discussion Board topic containing the attacker's reply. | 3 h ago |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.