Security resources
A public mirror of the CVE List published by the CVE Program, refreshed every hour. Search by CVE ID or keyword, or filter by severity and year.
Cybersecurity Weekly News Review by SIEM ConsultingThe past 7 days of CVEs ranked by exploitation and severity, CISA alerts, and top headlinesMITRE ATT&CK MatrixExplore adversary tactics and techniques399,334Published CVEs
82,775Published 2026 CVE IDs
2026-11-03 04:57Latest record update (UTC)
CVE explorer
More than 10,000 CVEs
| CVE ID | Title / summary | ||
|---|---|---|---|
| CVE-2026-77799 | Two-factor authentication bypass | 2026-11-03 | |
| CVE-2026-120578 | AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter | 2026-11-03 | |
| CVE-2026-120577 | FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter | 2026-11-03 | |
| CVE-2026-120575 | Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name | 2026-11-03 | |
| CVE-2026-120538 | Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture | 2026-11-03 | |
| CVE-2026-120574 | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover | 2026-11-03 | |
| CVE-2026-120563 | WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field | 2026-11-03 | |
| CVE-2026-120534 | Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type | 2026-11-03 | |
| CVE-2026-120561 | JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification | 2026-11-03 | |
| CVE-2026-120559 | Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal | 2026-11-03 | |
| CVE-2026-120524 | News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action | 2026-11-03 | |
| CVE-2026-120558 | Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter | 2026-11-03 | |
| CVE-2026-120552 | SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title() | 2026-11-03 | |
| CVE-2026-120551 | WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters | 2026-11-03 | |
| CVE-2026-120544 | Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route | 2026-11-03 | |
| CVE-2026-120518 | BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler | 2026-11-03 | |
| CVE-2026-120971 | Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses | 2026-11-03 | |
| CVE-2026-111464 | WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response | 2026-11-03 | |
| CVE-2026-120831 | Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service | 2026-11-03 | |
| CVE-2026-76955 | A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device. | 2026-11-03 | |
| CVE-2026-107441 | An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. | 2026-11-03 | |
| CVE-2026-105770 | Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages | 2026-11-03 | |
| CVE-2026-120833 | labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch | 2026-11-03 | |
| CVE-2026-120830 | Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure | 2026-11-03 | |
| CVE-2026-71450 | Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3… | 2026-11-02 |