| CVE-2026-120574 | HIGH | 8.1 | The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and… | 2026-11-03 |
| CVE-2026-120575 | MEDIUM | 6.4 | The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripti… | 2026-11-03 |
| CVE-2026-120577 | HIGH | 8.1 | The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arb… | 2026-11-03 |
| CVE-2026-120578 | MEDIUM | 5.3 | The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, an… | 2026-11-03 |
| CVE-2026-120971 | MEDIUM | 5.3 | A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicati… | 2026-11-03 |
| CVE-2026-77799 | HIGH | 7.4 | ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that a… | 2026-11-03 |
| CVE-2026-77800 | HIGH | 7.7 | ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows … | 2026-11-03 |
| CVE-2026-103379 | NA | N/A | The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a … | 2026-11-03 |
| CVE-2026-104647 | NA | N/A | The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permiss… | 2026-11-03 |
| CVE-2026-104648 | NA | N/A | The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to … | 2026-11-03 |
| CVE-2026-105967 | NA | N/A | The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before us… | 2026-11-03 |
| CVE-2026-105993 | NA | N/A | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its se… | 2026-11-03 |
| CVE-2026-106004 | NA | N/A | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX action… | 2026-11-03 |
| CVE-2026-115205 | NA | N/A | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization con… | 2026-11-03 |
| CVE-2025-1397 | MEDIUM | 4.8 | When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity… | 2026-11-03 |
| CVE-2025-5769 | MEDIUM | 6.1 | The authentication endpoint does not properly encode user-supplied input before rendering it within the web pa… | 2026-11-03 |
| CVE-2026-120987 | NA | N/A | Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.… | 2026-11-03 |
| CVE-2026-103653 | NA | N/A | An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of … | 2026-11-03 |
| CVE-2026-120988 | NA | N/A | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of s… | 2026-11-03 |
| CVE-2026-13594 | CRITICAL | 9.1 | Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an iss… | 2026-11-03 |
| CVE-2026-16900 | HIGH | 7.5 | Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authenticatio… | 2026-11-03 |
| CVE-2026-4052 | CRITICAL | 9.8 | This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with da… | 2026-11-03 |
| CVE-2026-74846 | NA | N/A | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via… | 2026-11-03 |
| CVE-2026-103327 | MEDIUM | 5.3 | The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment noti… | 2026-11-03 |
| CVE-2026-105978 | HIGH | 7.2 | Improper input validation in management control functions may allow a remote attacker with high privileges to … | 2026-11-03 |
| CVE-2026-105979 | HIGH | 7.2 | Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inj… | 2026-11-03 |
| CVE-2026-105980 | HIGH | 7.2 | Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to in… | 2026-11-03 |
| CVE-2026-105981 | HIGH | 7.2 | Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inje… | 2026-11-03 |
| CVE-2026-105982 | HIGH | 7.2 | Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject… | 2026-11-03 |
| CVE-2026-109161 | MEDIUM | 4.9 | Insufficient bounds checking in the Digital I/O function may allow a remote attacker with high privileges to c… | 2026-11-03 |
| CVE-2026-113421 | NA | N/A | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffe… | 2026-11-03 |
| CVE-2026-115231 | NA | N/A | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected … | 2026-11-03 |
| CVE-2026-118444 | NA | N/A | Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory duri… | 2026-11-03 |
| CVE-2026-118445 | NA | N/A | A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX o… | 2026-11-03 |
| CVE-2026-118446 | NA | N/A | A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objec… | 2026-11-03 |
| CVE-2026-118447 | NA | N/A | A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when… | 2026-11-03 |
| CVE-2026-118448 | NA | N/A | A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the under… | 2026-11-03 |
| CVE-2026-121020 | MEDIUM | 4.3 | Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in Axxo… | 2026-11-03 |
| CVE-2026-121021 | MEDIUM | 5.5 | Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One b… | 2026-11-03 |
| CVE-2026-121022 | HIGH | 8.1 | Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux … | 2026-11-03 |
| CVE-2026-121023 | MEDIUM | 5.5 | Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet be… | 2026-11-03 |
| CVE-2026-121024 | MEDIUM | 5.4 | Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linu… | 2026-11-03 |
| CVE-2026-91075 | MEDIUM | 5.3 | The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity … | 2026-11-03 |
| CVE-2026-92610 | NA | N/A | In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model … | 2026-11-03 |
| CVE-2026-119641 | NA | N/A | ** UNSUPPORTED WHEN ASSIGNED ** Improper input validation vulnerability in Apache Oozie. An authenticated Oozi… | 2026-11-03 |
| CVE-2026-119724 | NA | N/A | ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expan… | 2026-11-03 |
| CVE-2026-119843 | MEDIUM | 6.5 | A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buf… | 2026-11-03 |
| CVE-2026-120327 | NA | N/A | The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links … | 2026-11-03 |
| CVE-2026-120328 | NA | N/A | The click tracking middleware does not validate the authentication code of a recipient if the code is omitted.… | 2026-11-03 |
| CVE-2026-120329 | NA | N/A | Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without res… | 2026-11-03 |