CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 2:50 PM ET)

What this means for you

This week: 3,366 CVEs published, 272 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,366; Show in the list
Critical, last 7 days: 272; Show in the list
Healthcare-tagged, last 7 days: 6; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product themeum:kirki_freeform_page_builder_website_builder_and_customizer. Show all products

19 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-75891	High 8.8	Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint Assigned by Wordfence	Oct 27, 2026
CVE-2026-104734	High 7.2	Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import Assigned by Wordfence	Oct 16, 2026
CVE-2026-107762	High 7.5	Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter Assigned by Wordfence	Oct 16, 2026
CVE-2026-14572	Medium 6.4	Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content Assigned by Wordfence	Oct 15, 2026
CVE-2026-102291	Medium 5.4	Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' Assigned by Wordfence	Oct 10, 2026
CVE-2026-102173	High 7.2	Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata Assigned by Wordfence	Oct 7, 2026
CVE-2026-18335	Medium 5.4	Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter Assigned by Wordfence	Sep 24, 2026
CVE-2026-17037	High 7.2	Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter Assigned by Wordfence	Sep 11, 2026
CVE-2026-18347	Medium 4.3	Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter Assigned by Wordfence	Aug 16, 2026
CVE-2026-17604	Medium 4.9	Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter Assigned by Wordfence	Aug 16, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.