CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 3:30 PM ET)

What this means for you

This week: 3,228 CVEs published, 237 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,228; Show in the list
Critical, last 7 days: 237; Show in the list
Healthcare-tagged, last 7 days: 6; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product codename065:download_manager. Show all products

16 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-12054	Medium 6.1	Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter Assigned by Wordfence	Oct 10, 2026
CVE-2026-9696	Medium 6.4	Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode Assigned by Wordfence	Oct 10, 2026
CVE-2026-103964	Medium 4.3	Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email Assigned by Wordfence	Oct 10, 2026
CVE-2026-102401	Medium 6.4	Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute Assigned by Wordfence	Oct 10, 2026
CVE-2026-97338	Medium 6.4	Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name Assigned by Wordfence	Oct 2, 2026
CVE-2026-92714	Medium 6.5	Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter Assigned by Wordfence	Sep 18, 2026
CVE-2026-16685	Medium 6.4	Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute Assigned by Wordfence	Aug 1, 2026
CVE-2026-14343	Medium 6.4	Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes Assigned by Wordfence	Jul 9, 2026
CVE-2026-13733	Medium 6.4	Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute Assigned by Wordfence	Jul 1, 2026
CVE-2026-4057	Medium 4.3	Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removal Assigned by Wordfence	Apr 9, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.