Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Tue, 3 Nov 2026 | 6 | 31 | 52 | 0 | 44 | 133 |
| Mon, 2 Nov 2026 | 28 | 152 | 141 | 19 | 137 | 477 |
| Sun, 1 Nov 2026 | 8 | 24 | 27 | 15 | 24 | 98 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 44 | 218 | 261 | 30 | 115 | 668 |
| Thu, 29 Oct 2026 | 71 | 201 | 222 | 22 | 21 | 537 |
| Wed, 28 Oct 2026 | 35 | 224 | 214 | 31 | 122 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 161 | 273 | 57 | 226 | 738 |
| Sun, 25 Oct 2026 | 4 | 35 | 66 | 26 | 0 | 131 |
| Sat, 24 Oct 2026 | 12 | 20 | 35 | 6 | 0 | 73 |
| Fri, 23 Oct 2026 | 40 | 170 | 91 | 27 | 164 | 492 |
| Thu, 22 Oct 2026 | 69 | 161 | 208 | 54 | 0 | 492 |
| Wed, 21 Oct 2026 | 52 | 218 | 225 | 47 | 0 | 542 |
| Tue, 20 Oct 2026 | 169 | 814 | 812 | 127 | 1 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
2,908 vulnerabilities
The Motors - Car Dealership & Classified Listings WordPress plugin up to and including 1.4.126 contains a blind SQL injection vulnerability (CWE-89). An unauthenticated remote attacker can send crafted requests to read, modify or delete database contents, including user accounts and private data. Patchstack rates the issue as high priority with a CVSS score of 9.3.
StylemixThemes · Motors
The WordPress plugin Broadcast Live Video (videowhisper-live-streaming-integration) up to and including version 7.3.9 contains a broken access control flaw classified as missing authorization (CWE-862). An authenticated low-privileged user, such as a subscriber account, may be able to perform actions they should not be allowed to, which can affect site integrity and availability. Sources disagree on the exact flaw and score: the CNA rates it 7.1, while VulDB classifies it as CWE-306 with 5.4.
VideoWhisper.com · Broadcast Live Video
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The TableOn plugin for WordPress (posts-table-filterable), versions up to and including 1.0.7, contains a reflected cross-site scripting vulnerability (CWE-79). An attacker can craft a link or page that injects malicious scripts into the site, which run in the browser of a visitor. Exploitation requires that a user, for example a logged-in administrator, clicks the crafted link or visits the crafted page.
PluginUs.Net · TableOn
LearnPress, a WordPress plugin for creating and selling online courses, contains a missing authorization flaw (CWE-862) in versions up to and including 4.4.11. An unauthenticated remote attacker may be able to access functions or data they should not see, such as other users' information. The CVSS base score is 7.5 with a high impact on confidentiality only; the vulnerable endpoint is not described in the sources, and VulDB rates the issue lower (5.3).
ThimPress · LearnPress
The OceanWP WordPress theme up to and including version 4.2.7 contains a reflected cross-site scripting (XSS) vulnerability (CVE-2026-115592). An attacker can craft a link that injects script into a visitor's browser session on the affected website. The attack requires that a victim opens the crafted link, so the main risk lies with logged-in users, especially administrators. No login is required to prepare the attack.
OceanWP · OceanWP WordPress theme
Research and translation in progress – available shortly.
The WordPress plugin GEO my WordPress (geo-my-wp) in versions up to and including 4.5.5.5 lacks proper authorization checks. According to the CNA, an unauthenticated remote attacker may be able to access functions or data they should not reach, with a high confidentiality impact. Exposure depends on a publicly reachable WordPress site running the affected plugin.
Eyal Fitoussi · GEO my WordPress
The WordPress plugin HANDMADE – Dropshipping for Etsy and WooCommerce up to version 1.0.10 lacks a proper authorization check (CWE-862). According to the CVE record, an authenticated user with low privileges may be able to perform actions they should not be allowed to, which could affect the availability and integrity of data in the WooCommerce shop. The CVSS score is 7.1 (High), but the exact vulnerable function and required privilege level are not documented in the sources reviewed.
VillaTheme · HANDMADE – Dropshipping for Etsy and WooCommerce
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Checkmk trusts a root CA in its bundled CA stores (certifi and, according to some sources, webpki-roots) that chains to eMudhra (emSign) intermediate certificates whose private keys have been compromised. An attacker holding one of these keys could issue certificates for arbitrary host names that would be accepted as valid. Exploitation requires that the attacker can also intercept traffic between Checkmk and a monitored HTTPS endpoint, for example through a man-in-the-middle position.
Checkmk GmbH · Checkmk
Research and translation in progress – available shortly.
The Foxit official website embeds a third-party API token in its JavaScript code, so any visitor can read it. An attacker who obtains the token can submit fake user behavior data and distort Foxit's data statistics. The Foxit bulletin states the token is used to submit user behavior data; the CNA record rates the impact as information disclosure with high confidentiality impact.
Foxit Software Inc. · foxit.com
The online HTML-to-PDF conversion service on Foxit's official website contains a server-side request forgery (SSRF) flaw. By submitting ZIP-formatted input, an unauthenticated remote attacker can bypass restrictions on requests to internal IP addresses and may discover internal network resources. The vulnerability affects Foxit's hosted service, not customer installations, and Foxit states that the fix was released on 29 October 2026.
Foxit Software Inc. · foxit.com HTML-to-PDF conversion service
A broken access control flaw in the online HTML-to-PDF conversion service on Foxit's official website uses a shared token for submitted documents. An unauthenticated remote attacker may be able to access conversion documents submitted by other users. Foxit's bulletin says the issue is fixed on the server side and no customer action is required.
Foxit Software Inc. · foxit.com HTML-to-PDF online service
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Mapster WP Maps WordPress plugin up to and including version 2.0.5 contains a stored Cross-Site Scripting vulnerability (CWE-79). A map configuration REST endpoint does not check permissions, and the background color value is output without proper escaping in an inline style attribute. An unauthenticated attacker can therefore store script code that runs in the browser of visitors who open an affected page, including logged-in administrators.
Mapster · WP Maps
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
