Sat, Oct 10 · 08:16 PM CDTCVE-2026-42696
10.0/10 · Must read/watchNVDvuln
Summary
Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions.
CVECVE-2026-42696
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 08:16 PM CDT
ModifiedSat, Oct 10 · 08:16 PM CDT
CVE-2026-104398
9.8/10 · Must read/watchNVDvuln
Summary
Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.
CVECVE-2026-104398
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 05:16 PM CDT
ModifiedSat, Oct 10 · 05:16 PM CDT
CVE-2026-105892
9.8/10 · Must read/watchNVDvuln
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.
CVECVE-2026-105892
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 07:16 PM CDT
ModifiedSat, Oct 10 · 07:16 PM CDT
CVE-2026-106610
9.8/10 · Must read/watchNVDvuln
Summary
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
CVECVE-2026-106610
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 07:16 PM CDT
ModifiedSat, Oct 10 · 07:16 PM CDT
CVE-2026-108551
9.8/10 · Must read/watchNVDvuln
Summary
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or
CVECVE-2026-108551
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 03:16 PM CDT
ModifiedSat, Oct 10 · 03:16 PM CDT
CVE-2026-108598
9.8/10 · Must read/watchNVDvuln
Summary
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, ex
CVECVE-2026-108598
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 07:16 PM CDT
ModifiedSat, Oct 10 · 07:16 PM CDT
CVE-2026-14991
9.8/10 · Must read/watchNVDvuln
Summary
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
CVECVE-2026-14991
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 08 · 02:16 PM CDT
ModifiedSat, Oct 10 · 01:17 PM CDT
CVE-2026-39801
9.8/10 · Must read/watchNVDvuln
Summary
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
CVECVE-2026-39801
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 08:16 PM CDT
ModifiedSat, Oct 10 · 08:16 PM CDT
CVE-2026-78401
9.8/10 · Must read/watchNVDvuln
Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVECVE-2026-78401
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 08 · 09:18 PM CDT
ModifiedSat, Oct 10 · 01:17 PM CDT
CVE-2026-84272
9.8/10 · Must read/watchNVDvuln
Summary
IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.
CVECVE-2026-84272
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 08 · 08:17 PM CDT
ModifiedSat, Oct 10 · 01:17 PM CDT
CVE-2026-105889
9.3/10 · Must read/watchNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.
CVECVE-2026-105889
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 05:17 PM CDT
ModifiedSat, Oct 10 · 05:17 PM CDT
CVE-2026-40800
9.3/10 · Must read/watchNVDvuln
Summary
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.
CVECVE-2026-40800
SeverityCRITICAL
TypeNEW
PublishedSat, Oct 10 · 08:16 PM CDT
ModifiedSat, Oct 10 · 08:16 PM CDT
CVE-2026-16916
9.1/10 · Must read/watchNVDvuln
Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.
CVECVE-2026-16916
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 08 · 09:17 PM CDT
ModifiedSat, Oct 10 · 01:17 PM CDT
CVE-2026-19491
9.1/10 · Must read/watchNVDvuln
Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.
CVECVE-2026-19491
SeverityCRITICAL
TypeUPDATED
PublishedThu, Oct 08 · 09:17 PM CDT
ModifiedSat, Oct 10 · 01:17 PM CDT
CVE-2026-105885
8.8/10 · Worth your timeNVDvuln
Summary
Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.
CVECVE-2026-105885
SeverityHIGH
TypeNEW
PublishedSat, Oct 10 · 02:16 PM CDT
ModifiedSat, Oct 10 · 02:16 PM CDT
CVE-2026-108550
8.8/10 · Worth your timeNVDvuln
Summary
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verif
CVECVE-2026-108550
SeverityHIGH
TypeNEW
PublishedSat, Oct 10 · 03:16 PM CDT
ModifiedSat, Oct 10 · 03:16 PM CDT
CVE-2026-87780
8.8/10 · Worth your timeNVDvuln
Summary
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.
CVECVE-2026-87780
SeverityHIGH
TypeUPDATED
PublishedSat, Oct 10 · 06:16 AM CDT
ModifiedSat, Oct 10 · 12:16 PM CDT
CVE-2026-87781
8.6/10 · Worth your timeNVDvuln
Summary
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
CVECVE-2026-87781
SeverityHIGH
TypeUPDATED
PublishedSat, Oct 10 · 06:16 AM CDT
ModifiedSat, Oct 10 · 12:16 PM CDT
CVE-2026-42633
8.5/10 · Worth your timeNVDvuln
Summary
Subscriber SQL Injection in Events Manager <= 7.4.6 versions.
CVECVE-2026-42633
SeverityHIGH
TypeNEW
PublishedSat, Oct 10 · 08:16 PM CDT
ModifiedSat, Oct 10 · 08:16 PM CDT
CVE-2026-96341
8.2/10 · Worth your timeNVDvuln
Summary
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.
CVECVE-2026-96341
SeverityHIGH
TypeNEW
PublishedSat, Oct 10 · 07:16 PM CDT
ModifiedSat, Oct 10 · 07:16 PM CDT
CVE-2026-108549
8.1/10 · Worth your timeNVDvuln
Summary
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_
CVECVE-2026-108549
SeverityHIGH
TypeNEW
PublishedSat, Oct 10 · 03:16 PM CDT
ModifiedSat, Oct 10 · 03:16 PM CDT
CVE-2026-19494
8.1/10 · Worth your timeNVDvuln
Summary
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CVECVE-2026-19494
SeverityHIGH
TypeUPDATED
PublishedThu, Oct 08 · 09:17 PM CDT
ModifiedSat, Oct 10 · 01:17 PM CDT
CVE-2026-39802
8.1/10 · Worth your timeNVDvuln
Summary
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
CVECVE-2026-39802
SeverityHIGH
TypeNEW
PublishedSat, Oct 10 · 08:16 PM CDT
ModifiedSat, Oct 10 · 08:16 PM CDT
CVE-2026-40777
8.1/10 · Worth your timeNVDvuln
Summary
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
CVECVE-2026-40777
SeverityHIGH
TypeNEW
PublishedSat, Oct 10 · 08:16 PM CDT
ModifiedSat, Oct 10 · 08:16 PM CDT
CVE-2026-40801
8.1/10 · Worth your timeNVDvuln
Summary
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
CVECVE-2026-40801
SeverityHIGH
TypeNEW
PublishedSat, Oct 10 · 08:16 PM CDT
ModifiedSat, Oct 10 · 08:16 PM CDT
