CVE Lookup

Search Common Vulnerabilities and Exposures (CVE) by number.

Latest CVEs


PublishedCVETitleDomains
Oct 15, 2026CVE-2026-15180Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'13,909
Oct 15, 2026CVE-2026-9703Viewer role can create, modify and delete Loki alerting rules497
Oct 15, 2026CVE-2026-110891WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability231
Oct 15, 2026CVE-2026-18586Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'123
Oct 15, 2026CVE-2026-17031Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID5,783
Oct 15, 2026CVE-2026-18659Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring4,164
Oct 15, 2026CVE-2026-11905Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters2,119,062
Oct 15, 2026CVE-2026-18548Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter323
Oct 15, 2026CVE-2026-3712PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter2,084
Oct 15, 2026CVE-2026-18557Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter58,876
See complete list of latest CVEs

List of the most common Common Vulnerabilities and Exposures (CVEs)


PublishedCVETitleDomains
Sep 22, 2026CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen...7,108,424
Sep 18, 2026CVE-2026-93485WordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerability6,173,811
Apr 29, 2020CVE-2020-11023Potential XSS vulnerability in jQuery6,088,996
Apr 19, 2019CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(t...5,842,225
Oct 6, 2026CVE-2026-66666WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability5,675,680
Jul 10, 2019CVE-2017-7189main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpre...5,393,341
Jan 18, 2018CVE-2015-9251jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax req...5,076,571
Aug 7, 2026CVE-2026-64638WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a spec...5,043,273
Aug 17, 2026CVE-2026-65640WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file uploa...5,043,273
Apr 29, 2020CVE-2020-11022jQuery has a potential XSS vulnerability3,008,697
See complete CVE list