CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,076 CVEs published, 233 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,076
Show in the list
Critical, last 7 days
233
Show in the list
Healthcare-tagged, last 7 days
9
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list
107,612 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-93293Medium 6.4Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
Assigned by Wordfence
Oct 29, 2026
CVE-2026-118905High 7.0nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed
Assigned by harborist
Oct 29, 2026
CVE-2026-93757High 7.5Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite
Assigned by Wordfence
Oct 28, 2026
CVE-2026-96228High 8.1SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover
Assigned by Wordfence
Oct 28, 2026
CVE-2026-96666High 7.2Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
Assigned by Wordfence
Oct 28, 2026
CVE-2026-93904High 7.5Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter
Assigned by Wordfence
Oct 28, 2026
CVE-2026-93855High 7.5SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
Assigned by Wordfence
Oct 28, 2026
CVE-2026-96669High 7.2Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
Assigned by Wordfence
Oct 28, 2026
CVE-2026-96741High 7.2DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
Assigned by Wordfence
Oct 28, 2026
CVE-2026-109516Critical 9.8Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
Assigned by Wordfence
Oct 28, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.