27 CVEs — updated 2026-11-02 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-61738 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, | CRITICAL | 10.0 | 46%ile | NVD | 2026-10-30 |
| CVE-2026-84999 | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and | CRITICAL | 9.8 | 42%ile | NVD | 2026-10-28 |
| CVE-2026-103688 | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its a | CRITICAL | 9.8 | 49%ile | NVD | 2026-10-28 |
| CVE-2026-109218 | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9. | CRITICAL | 9.8 | 51%ile | NVD | 2026-10-28 |
| CVE-2026-115245 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spo | CRITICAL | 9.8 | 40%ile | NVD | 2026-10-29 |
| CVE-2026-116512 | The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress i | CRITICAL | 9.8 | 48%ile | NVD | 2026-10-31 |
| CVE-2026-118235 | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable | CRITICAL | 9.8 | 55%ile | NVD | 2026-10-31 |
| CVE-2026-90864 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows cou | CRITICAL | 9.1 | 41%ile | NVD | 2026-10-29 |
| CVE-2026-90866 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows cou | CRITICAL | 9.1 | 54%ile | NVD | 2026-10-29 |
| CVE-2026-61645 | Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vul | CRITICAL | 9.1 | 35%ile | NVD | 2026-10-29 |
| CVE-2026-4337 | Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user t | HIGH | 8.8 | 26%ile | NVD | 2026-10-27 |
| CVE-2026-109384 | The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions u | HIGH | 8.8 | 54%ile | NVD | 2026-10-28 |
| CVE-2026-76010 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Exec | HIGH | 8.8 | 56%ile | NVD | 2026-10-31 |
| CVE-2014-125138 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted | HIGH | 8.7 | 37%ile | NVD | 2026-10-28 |
| CVE-2026-117607 | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with | HIGH | 8.6 | 53%ile | NVD | 2026-10-28 |
| CVE-2026-67073 | HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an | HIGH | 8.6 | 13%ile | NVD | 2026-10-28 |
| CVE-2026-115346 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in ve | HIGH | 8.1 | 52%ile | NVD | 2026-10-30 |
| CVE-2026-111255 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary | HIGH | 7.5 | 44%ile | NVD | 2026-10-28 |
| CVE-2026-76012 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Exec | HIGH | 7.5 | 58%ile | NVD | 2026-10-30 |
| CVE-2026-66570 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress | HIGH | 7.1 | 10%ile | NVD | 2026-11-01 |
| CVE-2026-117531 | @fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 th | MEDIUM | 5.9 | — | NVD | 2026-11-02 |
| CVE-2026-117512 | A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee | MEDIUM | 5.5 | 31%ile | NVD | 2026-10-27 |
| CVE-2026-119620 | A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. Thi | MEDIUM | 5.5 | 39%ile | NVD | 2026-10-30 |
| CVE-2025-68391 | ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbi | MEDIUM | 5.3 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-16889 | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not | MEDIUM | 4.8 | 24%ile | NVD | 2026-10-29 |
| CVE-2026-116603 | A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file adm | LOW | 2.0 | 22%ile | NVD | 2026-10-27 |
| CVE-2026-61448 | Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist | LOW | — | 36%ile | GitHub | 2026-10-29 |