CVE Watch401,106 in full archive

Vulnerabilities exploitable today

16,417in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,665

Distribution · last window

Critical
3,438
High
15,697
Medium
14,715
Low
1,446

Filters

Window

Severity

Flags

Vulnerabilities5,081–5,120 · 16,417

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1071585.3 MED

19.5%

——6The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes WordPress plugin before 4.2.19's stored settings.8d CVE-2026-1071268.8 HIG

38.8%

——12The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.8d CVE-2026-1066465.9 MED

15.6%

——5The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators.8d CVE-2026-1064696.8 MED

23.6%

——7The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the browser, allowing authenticated users with Contributor-level access and above to store malicious SVG that executes JavaScript in the session of any user who views or previews the affected form, such as an administrator reviewing a pending post.7d CVE-2026-1061665.3 MED

13.2%

——4The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing its sequential identifier.8d CVE-2026-1060995.3 MED

18.2%

——5The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data Access WordPress plugin before 5.5.84 itself prints into the public pages on which it displays a table, allowing unauthenticated attackers to export the complete contents of any publicly displayed table, including columns and rows withheld from the display shown to visitors.8d CVE-2026-1060985.3 MED

14.0%

——4The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access even when update actions have been disabled by the administrator.8d CVE-2026-1059755.3 MED

14.0%

——4The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment records, and write CamPay Shortcode Payment Gateway WordPress plugin before 1.7 meta onto arbitrary posts.8d CVE-2026-1059695.3 MED

18.2%

——5The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's quote, including the buyer's name, email address and requested line items, by supplying an enumerable identifier.8d CVE-2026-1052616.8 MED

23.6%

——7The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting element, allowing users with the Contributor role and above to store JavaScript that executes in the session of any higher-privileged user who views the content.8d CVE-2026-1047515.3 MED

14.0%

——4The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.8d CVE-2026-1046446.8 MED

23.6%

——7The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes in the browser of anyone who views the gallery, including administrators.8d CVE-2026-1033078.6 HIG

26.6%

——8The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.8d CVE-2026-94370—

25.0%

——8A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.7d CVE-2026-502188.5 HIG

24.5%

——7Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. This attack can also be targeted against an already seeded client if the attacker knows the URL of the IDP that the client used for enrollment.2d CVE-2026-502174.7 MED

1.1%

——0A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv6 Hop-by-Hop extension header. When the IPv6 ICMP redirect policy is active, the packet is copied into a buffer that is freed but subsequently passed to a downstream filter. The size of the freed allocation is attacker-controlled (via packet length), enabling kernel pool grooming. Exploitation requires that the non-default IPv6 ICMP capture/redirect policy is enabled for the endpoint.5d CVE-2026-502165.3 MED

24.1%

——7An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby if a UDP datagram shorter than 96 bytes that begins with a specific value is received, a subsequent size computation underflows to a near-SIZE_MAX value, causing an allocation failure and uncaught Objective-C exception that aborts the root system extension.5d CVE-2026-1104598.6 HIG

16.8%

——5A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.6d CVE-2026-1104583.7 LOW

16.8%

——5A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.6d CVE-2026-1104573.7 LOW

17.7%

——5A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.6d CVE-2026-1071536.6 MED

8.7%

——3Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.6d CVE-2026-502154.4 MED

2.7%

——1A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6_HDRINCL socket to trigger this at DISPATCH_LEVEL, resulting in an immediate system crash.5d CVE-2026-464496.7 MED

76.5%

——23The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting in command injection. An unprivileged local user with permissions to modify network interface names can exploit this by renaming a network interface to include a malicious shell payload via System Settings. When the "Log out from your IdP" action is subsequently triggered, the wapptunneld service processes the poisoned interface name, leading to the execution of arbitrary commands with root privileges.5d CVE-2026-1104565.3 MED

16.9%

——5A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.6d CVE-2026-1104558.1 HIG

67.9%

——20A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.6d CVE-2026-1104545.3 MED

15.5%

——5A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.6d CVE-2026-1104534.3 MED

2.4%

——1Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.2d CVE-2026-1104524.0 MED

2.4%

——1The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.5d CVE-2026-1104514.3 MED

2.4%

——1Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.5d CVE-2026-1104508.0 HIG

3.8%

——1Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.2d CVE-2026-1069317.8 HIG

50.8%

KEV—65EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability1d CVE-2026-1054298.0 HIG

46.9%

——14Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide OpenSSH drop-in file (/etc/ssh/ssh_config.d/99-netbird.conf, or the equivalent under %PROGRAMDATA%\ssh\ssh_config.d on Windows) that embeds each peer FQDN or hostname inside a double-quoted Match host directive without escaping. A peer name containing a double quote breaks out of the quoted context and injects arbitrary SSH configuration directives, including exec commands, which run locally as any user on the host the next time that user runs ssh. Desktop clients on Linux, macOS, Windows and FreeBSD are affected; the Android and iOS apps are not. The issue is fixed in version 0.74.7, which accepts a peer FQDN or hostname only if it is a valid DNS name.5d CVE-2026-1033696.4 MED

15.7%

——5The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the gs-alert-msg, gs-alert-utm, and gs-alert-cta WordPress options and executes in an administrator's browser when the GetSocial settings page is visited.8d CVE-2026-1019266.5 MED

23.6%

——7The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.7d CVE-2026-1019247.2 HIG

22.3%

——7The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin records in its statistics table: the newstatpress_generate_overview_lastreferrers() function concatenates the stored urlrequested value into a single-quoted href attribute after only FILTER_SANITIZE_URL, which does not encode the apostrophe. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a high-privileged user, such as an administrator, accesses the Overview page and hovers the injected link.7d CVE-2026-974715.3 MED

19.5%

——6The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion_instagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.7d CVE-2026-973987.2 HIG

22.3%

——7The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' (parse_comments) option to be enabled and the liststyle attribute set to "season" for the vulnerable code path to be reached.8d CVE-2026-970206.4 MED

17.0%

——5The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is loaded as a replacement .po/.mo translation file via the plugin's own load_textdomain_mofile filter, causing WordPress to serve the attacker-written translation in place of the original core strings.7d CVE-2026-966617.5 HIG

38.1%

——11The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability.7d CVE-2026-958167.2 HIG

28.9%

——9The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.7d