CVE Program partner

Patchstack

Patchstack

API
CVEs, 365 days6,19818,910 all time, 32 rejected
Quality86%median 99%
CVSS by the CNA99%share of records
CWE99%share of records
Affected versions61%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationPatchstack
RoleCNA
TypeBug Bounty Provider, Hosted Service, Open Source, Researcher, Vendor
Reports tomitre
ScopeVulnerabilities in third-party PHP and JavaScript software discovered by Patchstack and researchers participating in the Patchstack Bug Bounty Program.
Advisorieshttps://patchstack.com/database/

Latest CVEs · RSS

  • CVE-2026-110384 2026-10-17 · CVSS 7.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-co
  • CVE-2026-111413 2026-10-16 · CVSS 8.8
    Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects
  • CVE-2026-110896 2026-10-16 · CVSS 5.3
    Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af
  • CVE-2026-111400 2026-10-16 · CVSS 6.5
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack
  • CVE-2026-111396 2026-10-16 · CVSS 7.1
    Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Contro
  • CVE-2026-111409 2026-10-16 · CVSS 5.3
    Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrec
  • CVE-2026-110903 2026-10-16 · CVSS 6.5
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-cale
  • CVE-2026-110900 2026-10-16 · CVSS 5.3
    Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a
  • CVE-2026-110901 2026-10-16 · CVSS 5.4
    Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Sec
  • CVE-2026-110380 2026-10-16 · CVSS 5.3
    Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.Thi
  • CVE-2026-111405 2026-10-16 · CVSS 6.5
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactiv
  • CVE-2026-111399 2026-10-16 · CVSS 8.5
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactiv
  • CVE-2026-111397 2026-10-16 · CVSS 5.3
    Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issu
  • CVE-2026-94169 2026-10-16 · CVSS 10.0
    Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: fro
  • CVE-2026-94388 2026-10-16 · CVSS 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind S
  • CVE-2026-97296 2026-10-16 · CVSS 8.1
    Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n
  • CVE-2026-96339 2026-10-16 · CVSS 7.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue af
  • CVE-2026-110366 2026-10-16 · CVSS 5.3
    Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue
  • CVE-2026-110361 2026-10-15 · CVSS 6.5
    Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue a
  • CVE-2026-110362 2026-10-15 · CVSS 5.3
    Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access C
  • CVE-2026-109893 2026-10-15 · CVSS 6.5
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored
  • CVE-2026-110374 2026-10-15 · CVSS 4.3
    Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Secu
  • CVE-2026-108499 2026-10-15 · CVSS 5.3
    Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issu
  • CVE-2026-110364 2026-10-15 · CVSS 5.3
    Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-f
  • CVE-2026-110375 2026-10-15 · CVSS 6.5
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored X

All CVE Program partners