| CVE-2026-54191 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions. | 81d ago |
| CVE-2026-39437 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versio | 81d ago |
| CVE-2026-52702 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions. | 82d ago |
| CVE-2026-49055 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versi | 82d ago |
| CVE-2026-48966 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions. | 82d ago |
| CVE-2026-48885 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions. | 82d ago |
| CVE-2026-48876 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions. | 82d ago |
| CVE-2026-48871 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions. | 82d ago |
| CVE-2026-48867 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions. | 82d ago |
| CVE-2026-48838 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions. | 82d ago |
| CVE-2026-45437 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions. | 82d ago |
| CVE-2026-42775 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions. | 82d ago |
| CVE-2026-42686 | 7.1 | — | — | — | — | Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions. | 82d ago |
| CVE-2026-42658 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions. | 82d ago |
| CVE-2026-42649 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions. | 82d ago |
| CVE-2026-40791 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions. | 82d ago |
| CVE-2026-40788 | 7.1 | — | — | — | — | Subscriber Broken Access Control in ChatBot <= 7.9.7 versions. | 82d ago |
| CVE-2026-40787 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions. | 82d ago |
| CVE-2026-40785 | 7.1 | — | — | — | — | Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions. | 82d ago |
| CVE-2026-40770 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions. | 82d ago |
| CVE-2026-40732 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions. | 82d ago |
| CVE-2026-39518 | 7.1 | — | — | — | — | Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions. | 82d ago |
| CVE-2026-39514 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions. | 82d ago |
| CVE-2026-39507 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions. | 82d ago |
| CVE-2026-39463 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions. | 82d ago |
| CVE-2026-39450 | 7.1 | — | — | — | — | Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions. | 82d ago |
| CVE-2026-39449 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions. | 82d ago |
| CVE-2026-39447 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions. | 82d ago |
| CVE-2026-39435 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions. | 82d ago |
| CVE-2026-34902 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions. | 82d ago |
| CVE-2026-34900 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions. | 82d ago |
| CVE-2026-23970 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions. | 82d ago |
| CVE-2025-68872 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 vers | 82d ago |
| CVE-2025-68851 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions. | 82d ago |
| CVE-2025-68840 | 7.1 | — | — | — | — | Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions. | 82d ago |
| CVE-2026-53704 | 7.1 | — | — | — | — | A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. | 82d ago |
| CVE-2026-53703 | 7.1 | — | — | — | — | A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). | 82d ago |
| CVE-2026-52722 | 7.1 | — | — | — | — | A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. | 82d ago |
| CVE-2026-52719 | 7.1 | — | — | — | — | An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. | 82d ago |
| CVE-2026-5233 | 7.1 | — | — | — | — | Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. | 82d ago |
| CVE-2026-5230 | 7.1 | — | — | — | — | Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. | 82d ago |
| CVE-2019-25746 | 7.1 | — | — | — | — | WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated at | 82d ago |
| CVE-2026-49396 | 7.1 | — | — | — | — | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. | 85d ago |
| CVE-2026-48119 | 7.1 | — | — | — | — | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. | 85d ago |
| CVE-2026-47120 | 7.1 | — | — | — | — | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. | 85d ago |
| CVE-2026-3840 | 7.1 | — | — | — | linuxfoundation / kedro | A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version | 85d ago |
| CVE-2026-42653zero day | 7.1 | 0.14% | 1/3 | same day | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai S | 86d ago |
| CVE-2023-33999zero day | 7.1 | 0.27% | 1/3 | 1059d before | — | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP M | 86d ago |
| CVE-2026-40987 | 7.1 | — | — | — | vmware / spring integration | A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outsid | 87d ago |
| CVE-2022-26758 | 7.1 | — | — | — | apple / macos | A malicious application may cause unexpected changes in memory shared between processes. | 87d ago |
| CVE-2026-20258 | 7.1 | — | — | — | splunk / splunk | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 1 | 87d ago |
| CVE-2026-53689 | 7.1 | — | — | — | — | libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a conne | 87d ago |
| CVE-2026-49069 | 7.1 | — | — | — | — | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portf | 87d ago |
| CVE-2026-45542 | 7.1 | — | — | — | espressif / esp-idf | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. | 88d ago |
| CVE-2026-45329 | 7.1 | — | — | — | espressif / esp-idf | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. | 88d ago |
| CVE-2026-53674 | 7.1 | — | — | — | — | BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, whe | 88d ago |
| CVE-2026-48569 | 7.1 | — | — | — | microsoft / visual studio code | Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature local | 88d ago |
| CVE-2026-47288 | 7.1 | — | — | — | microsoft / windows server 2012 | Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent | 88d ago |
| CVE-2026-45649 | 7.1 | — | — | — | microsoft / excel | Improper access control in Office for Android allows an unauthorized attacker to perform spoofing locally. | 88d ago |
| CVE-2026-46322 | 7.1 | — | — | — | linux / linux kernel | In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp | 88d ago |
