Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

415849 source statements · aliases may refer to the same vulnerability

CVE-2026-114705Published

WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: insta-gallery

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115998Published

IDOR: User reads and modifies findings from other people's projects

cve-program ·

Vendor product: cervantes

CVSS 3.1 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114194Published

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ad-inserter

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115994Published

BOLA Allows Cross-Project Target Tampering

cve-program ·

Vendor product: cervantes

CVSS 3.1 5.4Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115993Published

Stored XSS in the “Notes” field of project checklists

cve-program ·

Vendor product: cervantes

CVSS 3.1 6.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114196Published

WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: paytium

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114695Published

WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: vod-infomaniak

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114694Published

WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: events-manager

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114693Published

WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: all-in-one-video-gallery

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110892Published

WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: suredash

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114697Published

WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: qa-heatmap-analytics

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114178Published

WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: w3-total-cache

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114190Published

WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: litespeed-cache

CVSS 3.1 5.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112866Published

WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woo-product-filter

CVSS 3.1 9.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-94075Published

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: newsletters-lite

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112869Published

WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: opening-hours

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-111402Published

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: newsletters-lite

CVSS 3.1 9.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112844Published

WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wp-event-solution

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114179Published

WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: bp-better-messages

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115975Published

Broken access control in JiraController

cve-program ·

Vendor product: cervantes

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112067Published

Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)

cve-program ·

https://packagist.org/: blueways/bw-captcha

CVSS 4.0 6.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112064Published

SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

cve-program ·

https://packagist.org/: sgalinski/sg-cookie-optin

CVSS 4.0 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115803Published

Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization

cve-program ·

Vendor product: Scada-LTS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115802Published

InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere

cve-program ·

Vendor product: InternAgent

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-108013Published

HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)

cve-program ·

Vendor product: BigFix Platform

CVSS 3.1 6.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114429Published

WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

cve-program ·

Vendor product: WPVR

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113674Published

GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113673Published

GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113493Published

GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113492Published

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113491Published

GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113490Published

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113489Published

GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112207Published

Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link

cve-program ·

Vendor product: Download Monitor

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110956Published

asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

cve-program ·

Vendor product: asVereinbase

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-105199Published

Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID

cve-program ·

Vendor product: Pixel Tag Manager for WooCommerce

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-97353Published

News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form

cve-program ·

Vendor product: News Kit Addons For Elementor

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-97352Published

News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

cve-program ·

Vendor product: News Kit Addons For Elementor

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-107907Published

MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist

cve-program ·

Vendor product: MAS Videos

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-87835Published

Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment

cve-program ·

Vendor product: Front End Users

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-107887Published

Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme

cve-program ·

Vendor product: Advanced Twenty Seventeen

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115806Published

Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

cve-program ·

Vendor product: Prime Mover – Backup and Migration

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115807Published

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute

cve-program ·

Vendor product: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-33818Published

Enforce maximum recursion depth in encoding/asn1

cve-program ·

https://pkg.go.dev: encoding/asn1

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-42504Published

Quadratic complexity in WordDecoder.DecodeHeader in mime

cve-program ·

https://pkg.go.dev: mime

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-79858Published

Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-79857Published

Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-79856Published

Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-79855Published

Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-79854Published

Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved NuGet dependencies or open a Microsoft CVE for fixing KBs, releases and planning.