Vulnerabilities

Summary — last 7 days

New vulnerabilities4,658▼ 709 vs. last week
Critical / high1,752▼ 1,301 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)973▲ 874 vs. last week
More filters
–

413,893 results, sorted by published date (most recent first)

CVEStatusSeverityEPSS Active exploitationAffected technologiesPublished ▼Modified Description
DeferredHigh (7.1)0.18%—Before After Image ComparisonAI10/10/202610/13/2026
Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
DeferredHigh (7.6)0.30%—Stylemixthemes UlistingAI10/10/202610/13/2026
Subscriber Settings Change in uListing <= 2.2.0 versions.
DeferredCritical (9.8)0.35%—Designinvento DirectorypressAI10/10/202610/13/2026
Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
DeferredCritical (9.3)0.29%—Stylemixthemes UlistingAI10/10/202610/13/2026
Unauthenticated SQL Injection in uListing <= 2.2.0 versions.
DeferredHigh (7.2)0.19%—StreamcastAI10/10/202610/13/2026
Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.
DeferredHigh (7.1)0.18%—Team Section BlockAI10/10/202610/13/2026
Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
DeferredCritical (9)0.29%—Tailored ToolsAI10/10/202610/13/2026
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.
DeferredCritical (9.9)0.45%—Codebard Help DeskAI10/10/202610/13/2026
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
DeferredCritical (9.8)0.33%—Tonda MembershipAI10/10/202610/13/2026
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
DeferredHigh (8.8)0.48%—AngioAI10/10/202610/13/2026
Subscriber PHP Object Injection in Angio <= 1.1.1 versions.
DeferredHigh (8.1)0.35%—TouchupAI10/10/202610/13/2026
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
DeferredHigh (7.1)0.15%—Themetrex Kids PlanetAI10/10/202610/13/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.
DeferredHigh (8.1)0.35%—DukamarketAI10/10/202610/13/2026
Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.
DeferredHigh (8.1)0.35%—UminexAI10/10/202610/13/2026
Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.
DeferredHigh (7.6)0.28%—Smackcoders WP Ultimate CSV ImporterAI10/10/202610/13/2026
Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
DeferredHigh (8.1)0.35%—AaltoAI10/10/202610/13/2026
Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
DeferredHigh (8.1)0.35%—CleanskinAI10/10/202610/13/2026
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
DeferredCritical (9.8)0.39%—CleanskinAI10/10/202610/13/2026
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
DeferredHigh (7.6)0.28%—Dynamiapps Frontend AdminAI10/10/202610/13/2026
Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
DeferredCritical (9.8)0.53%—Dynamic User DirectoryAI10/10/202610/13/2026
Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
DeferredCritical (9.8)0.39%—Booster FOR WoocommerceAI10/10/202610/13/2026
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
DeferredHigh (7.6)0.28%—LeykaAI10/10/202610/13/2026
Administrator SQL Injection in Leyka <= 3.32.3 versions.
DeferredCritical (9.8)0.39%—Payever Woocommerce GatewayAI10/10/202610/13/2026
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
DeferredHigh (7.1)0.18%—10web Photo GalleryAI10/10/202610/13/2026
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
DeferredHigh (8.5)0.34%—Qode ToursAI10/10/202610/13/2026
Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
Orbitaley — Vulnerabilities