CVE Prioritization
Triage CVEs by EPSS, CISA KEV, PoC availability, attack complexity, and in-feed incidents.
50
Total CVEs
7
Critical
0
KEV / Exploited
0
PoC Exists
0
Zero Day
0
Patch Available
| CVE ID | Published | Severity | EPSS Score | Complexity | Status | PoC | Patch | Due Date | Feed Hits | Description | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 02 Oct 2026 | MEDIUM 6.1 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's paren | Details | |
| 02 Oct 2026 | MEDIUM 5.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from | Details | |
| 02 Oct 2026 | MEDIUM 6.2 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level u | Details | |
| 02 Oct 2026 | HIGH 8.1 |
0.0%
|
HIGH |
—
|
— | — | — | 0 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, an | Details | |
| 02 Oct 2026 | HIGH 7.5 |
0.0%
|
HIGH |
—
|
— | — | — | 0 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl | Details | |
| 02 Oct 2026 | HIGH 7.5 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authenticati | Details | |
| 02 Oct 2026 | LOW 3.1 |
0.0%
|
HIGH |
—
|
— | — | — | 0 | The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing befor | Details | |
| 02 Oct 2026 | MEDIUM 6.8 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it in | Details | |
| 02 Oct 2026 | MEDIUM 5.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticate | Details | |
| 02 Oct 2026 | HIGH 7.2 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site S | Details | |
| 02 Oct 2026 | MEDIUM 6.8 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating i | Details | |
| 02 Oct 2026 | MEDIUM 4.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection act | Details | |
| 02 Oct 2026 | MEDIUM 6.1 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Script | Details | |
| 02 Oct 2026 | MEDIUM 5.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from | Details | |
| 02 Oct 2026 | MEDIUM 5.4 |
0.0%
|
HIGH |
—
|
— | — | — | 0 | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all version | Details | |
| 02 Oct 2026 | HIGH 8.8 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up | Details | |
| 02 Oct 2026 | CRITICAL 9.1 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up | Details | |
| 02 Oct 2026 | MEDIUM 6.8 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before stori | Details | |
| 02 Oct 2026 | CRITICAL 9.8 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2. | Details | |
| 02 Oct 2026 | HIGH 7.2 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This | Details | |
| 02 Oct 2026 | HIGH 7.2 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Sc | Details | |
| 02 Oct 2026 | CRITICAL 9.8 |
0.0%
|
LOW |
—
|
— | — | — | 0 | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in | Details | |
| 02 Oct 2026 | HIGH 7.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is | Details | |
| 02 Oct 2026 | HIGH 7.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026 | Details | |
| 02 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitra | Details | |
| 02 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecogn | Details | |
| 02 Oct 2026 | MEDIUM 6.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooki | Details | |
| 02 Oct 2026 | MEDIUM 6.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown functi | Details | |
| 02 Oct 2026 | MEDIUM 6.3 |
0.0%
|
LOW |
—
|
— | — | — | 0 | A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown functi | Details | |
| 02 Oct 2026 | HIGH 7.5 |
0.0%
|
LOW |
—
|
— | — | — | 0 | Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather th | Details | |
| 02 Oct 2026 | HIGH 7.5 |
0.0%
|
LOW |
—
|
— | — | — | 0 | An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineer | Details | |
| 02 Oct 2026 | HIGH 7.5 |
0.0%
|
LOW |
—
|
— | — | — | 0 | API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, | Details | |
| 02 Oct 2026 | CRITICAL 9 |
0.0%
|
HIGH |
—
|
— | — | — | 0 | A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection w | Details | |
| 02 Oct 2026 | HIGH 7.2 |
0.0%
|
LOW |
—
|
— | — | — | 0 | ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager | Details | |
| 02 Oct 2026 | CRITICAL 9.4 |
0.0%
|
LOW |
—
|
— | — | — | 0 | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata hand | Details | |
| 02 Oct 2026 | CRITICAL 9.8 |
0.0%
|
LOW |
—
|
— | — | — | 0 | Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allow | Details | |
| 01 Oct 2026 | HIGH 7.5 |
0.0%
|
LOW |
—
|
— | — | — | 0 | Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePee | Details | |
| 01 Oct 2026 | MEDIUM 5.9 |
0.0%
|
HIGH |
—
|
— | — | — | 0 | Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated rem | Details | |
| 01 Oct 2026 | MEDIUM 6.8 |
0.0%
|
HIGH |
—
|
— | — | — | 0 | Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and | Details | |
| 01 Oct 2026 | HIGH 7.5 |
0.0%
|
LOW |
—
|
— | — | — | 0 | A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the f | Details | |
| 01 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-sit | Details | |
| 01 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This i | Details | |
| 01 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects Ea | Details | |
| 01 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive | Details | |
| 01 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abus | Details | |
| 01 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middl | Details | |
| 01 Oct 2026 | — |
0.0%
|
— |
—
|
— | — | — | 0 | - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resour | Details | |
| 01 Oct 2026 | CRITICAL 9.8 |
0.0%
|
LOW |
—
|
— | — | — | 0 | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry | Details | |
| 01 Oct 2026 | MEDIUM 6.5 |
0.0%
|
LOW |
—
|
— | — | — | 0 | infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the expos | Details | |
| 01 Oct 2026 | MEDIUM 6.5 |
0.2%
|
LOW |
—
|
— | — | — | 0 | Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on | Details |