CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 10:00 PM ET)

What this means for you

This week: 3,263 CVEs published, 235 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,263; Show in the list
Critical, last 7 days: 235; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product codename065:download_manager. Show all products

16 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2025-12177	Medium 5.3	Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key Assigned by Wordfence	Nov 7, 2025
CVE-2025-13498	Medium 4.3	Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure Assigned by Wordfence	Dec 18, 2025
CVE-2025-15364	High 7.3	Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword Assigned by Wordfence	Jan 5, 2026
CVE-2026-1666	Medium 6.1	Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter Assigned by Wordfence	Feb 18, 2026
CVE-2026-2571	Medium 4.3	Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter Assigned by Wordfence	Mar 19, 2026
CVE-2026-5357	Medium 6.4	Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Assigned by Wordfence	Apr 8, 2026
CVE-2026-4057	Medium 4.3	Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal Assigned by Wordfence	Apr 9, 2026
CVE-2026-13733	Medium 6.4	Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute Assigned by Wordfence	Jul 1, 2026
CVE-2026-14343	Medium 6.4	Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes Assigned by Wordfence	Jul 9, 2026
CVE-2026-16685	Medium 6.4	Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute Assigned by Wordfence	Aug 1, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.