CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 9:40 PM ET)

What this means for you

This week: 3,260 CVEs published, 235 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,260; Show in the list
Critical, last 7 days: 235; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product themeum:kirki_freeform_page_builder_website_builder_and_customizer. Show all products

19 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-8096	Medium 6.5	Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action Assigned by Wordfence	May 19, 2026
CVE-2026-8073	High 7.5	Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP Assigned by Wordfence	May 19, 2026
CVE-2026-8206	Critical 9.8	Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' Assigned by Wordfence	Jun 1, 2026
CVE-2026-12122	Medium 5.3	Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action Assigned by Wordfence	Jul 2, 2026
CVE-2026-12472	Medium 5.3	Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters Assigned by Wordfence	Jul 2, 2026
CVE-2026-15457	Medium 4.9	Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter Assigned by Wordfence	Jul 16, 2026
CVE-2026-13464	Medium 5.3	Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter Assigned by Wordfence	Jul 23, 2026
CVE-2026-15601	Medium 4.9	Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) Assigned by Wordfence	Aug 1, 2026
CVE-2026-16974	Medium 6.4	Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode Assigned by Wordfence	Aug 11, 2026
CVE-2026-17604	Medium 4.9	Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter Assigned by Wordfence	Aug 16, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.