Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-61514 | 9.3 critical | 1.0% | no CPE yet | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field in the proprietary control protocol header to access live video streams, control pan and tilt motors, activate audio functions, and remotely restart the device. | Fri 23 Oct |
| CVE-2025-10494 | 8.1 high | 1.0% | no CPE yet | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation when deleting profile pictures in all versions up to, and including, 1.4.89. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). | 8 Oct |
| CVE-2026-115964 | 9.3 critical | — | stylemixthemes, motors | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126. | 20 h ago |
| CVE-2026-54812 | 9.3 critical | 0.00% | no CPE yet | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109. | Mon 26 Oct |
| CVE-2026-54814 | 8.1 high | 0.00% | no CPE yet | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109. | Mon 26 Oct |
| CVE-2026-54828 | 7.5 high | 0.00% | no CPE yet | Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. | Sun 25 Oct |
| CVE-2026-93950 | 7.5 high | 0.00% | no CPE yet | Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108. | 13 Oct |
| CVE-2026-27433 | 6.5 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85. | Sun 25 Oct |
| CVE-2026-66693 | 6.5 medium | 0.00% | no CPE yet | Subscriber Broken Access Control in Motors <= 1.4.113 versions. | Sat 24 Oct |
| CVE-2026-39515 | 6.5 medium | 0.00% | no CPE yet | Subscriber Broken Access Control in Motors < 1.4.107 versions. | Fri 23 Oct |
| CVE-2026-96563 | 6.4 medium | 0.00% | no CPE yet | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level. | 22 Oct |
11 of 11
Download these 11 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.