Threats
CVEs published in the last 120 days, plus everything on CISA’s known-exploited list. Scores, exploit likelihood and exploitation status in one place.
| Score | CVE | Affected | EPSS | Published |
|---|---|---|---|---|
| — unscored | CVE-2026-98165 | Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only The BAR0 fallback read path was introduced as a workaround for SR-IOV VFs where the VRAM aperture is not available during early init. Restrict this workaround to only SR-IOV VFs where it's needed. (cherry picked from commit d8a0affd207c813bd063fa2c27786f449eaf92b8) | 0.20% | 6 Oct 2026 |
| 4.8 medium | CVE-2026-97308 | WebFactory Login Lockdown Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions. | 0.19% | 6 Oct 2026 |
| 8.1 high | CVE-2026-95594 | Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions. | 0.24% | 6 Oct 2026 |
| 7.3 high | CVE-2026-95526 | RealMag777 BEAR Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions. | 0.23% | 6 Oct 2026 |
| 8.2 high | CVE-2026-95105 | danielberkompas cloak Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward. | 0.11% | 6 Oct 2026 |
| 7.1 high | CVE-2026-94675 | Fluent Forms Free vs Pro Fluent Forms Pro Add On Pack Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions. | 0.19% | 6 Oct 2026 |
| 6.3 medium | CVE-2026-94206 | danielberkompas cloak_ecto Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured. This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. | 0.26% | 6 Oct 2026 |
| 7.5 high | CVE-2026-66588 | Dream-Theme The7 Unauthenticated Broken Access Control in The7 <= 14.2.2 versions. | 0.30% | 6 Oct 2026 |
| 8.8 high | CVE-2026-62072 | Progress Planner Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions. | 0.34% | 6 Oct 2026 |
| 7.8 high | CVE-2026-4889 | RDL Technologies eLoanApp Platform SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries. | 0.30% | 6 Oct 2026 |
| 7.5 high | CVE-2026-48199 | Beplusthemes Sermon'e Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions. | 0.39% | 6 Oct 2026 |
| 7.2 high | CVE-2026-48197 | PublishPress Capabilities Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0. | 0.46% | 6 Oct 2026 |
| 7.5 high | CVE-2026-42638 | Awesomemotive Easy Digital Downloads Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1. | 0.26% | 6 Oct 2026 |
| 6.5 medium | CVE-2026-42637 | PayPlug for WooCommerce (Official) Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions. | 0.33% | 6 Oct 2026 |
| 7.1 high | CVE-2026-42636 | WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions. | 0.25% | 6 Oct 2026 |
| 7.1 high | CVE-2026-42635 | wpgenie WooCommerce Simple Auctions Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions. | 0.25% | 6 Oct 2026 |
| 7.1 high | CVE-2026-42634 | bPlugins Video Background Block – Use video as background in the section. Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions. | 0.25% | 6 Oct 2026 |
| 7.1 high | CVE-2026-42418 | Socialrocket Social Rocket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5. | 0.25% | 6 Oct 2026 |
| 9.3 critical | CVE-2026-42417 | reputeinfosystems ARMember Premium Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions. | 0.33% | 6 Oct 2026 |
| 8.5 high | CVE-2026-42416 | AndonDesign UDesign Core Subscriber SQL Injection in UDesign Core <= 4.15.0 versions. | 0.29% | 6 Oct 2026 |