Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

149-75% vs 7-day avg of 597

2 critical, 41 high, 60 medium, 26 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	6.5	CVE-2026-114192	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. WpEvently	NVD	Oct 24 14:16 UTC
CVE-2026-114192Missing Authorization vulnerability in Magepeople inc Executive summary A missing authorization flaw in the WpEvently WordPress plugin, made by Magepeople inc, lets users reach functions they should not be able to use. The advisory rates it CVSS 6.5 but says it is low priority and unlikely to be exploited. The vendor recommends updating the plugin to version 5.7.9 or later. Technical summary The weakness is classed as Broken Access Control (OWASP A1) in WpEvently plugin versions up to and including 5.7.8. The required privilege is listed as Unauthenticated, and the advisory does not describe the specific attack steps or endpoints. The patched version is 5.7.9, and the advisory recommends updating to that version or later, with hosting providers or developers as a fallback if updating is not possible. No workarounds are stated beyond updating, and no detection guidance, indicators of compromise, or evidence of exploitation in the wild is stated. The advisory gives CVSS 6.5 but does not provide a full CVSS vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects Magepeople inc.Magepeople inc. WpEvently NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	Medium	6.5	CVE-2026-112825	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. Car Rental Manager	NVD	Oct 23 09:17 UTC
CVE-2026-112825Missing Authorization vulnerability in Magepeople inc Executive summary A broken access control flaw in the Car Rental Manager WordPress plugin, made by Magepeople inc, lets low-privileged users reach actions they should not be able to perform. The advisory rates it medium severity with a CVSS score of 6.5 and says it is expected to be exploited. The vendor recommends updating the plugin to version 1.5.4 or later. Technical summary The vulnerability is a missing authorization or broken access control issue, classified as OWASP A1. The advisory states that versions 1.5.3 and earlier are vulnerable and that version 1.5.4 is patched. The required privilege is Subscriber, so an authenticated low-privileged account is the precondition for exploitation. The advisory says no mitigation rule can be assigned, so a virtual patch is not available, and it gives no other workaround beyond updating or asking a host or developer for help. Exploitation in the wild is not confirmed, though the advisory says it is expected to be exploited. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Magepeople inc.Magepeople inc. Car Rental Manager NIST National Vulnerability DatabasePublished Oct 23, 2026 09:17 UTC Read the advisory
	Medium	5.3	CVE-2026-111849	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. WpTravelly	NVD	Oct 21 13:18 UTC
CVE-2026-111849Missing Authorization vulnerability in Magepeople inc From the advisory Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Magepeople inc.Magepeople inc. WpTravelly NIST National Vulnerability DatabasePublished Oct 21, 2026 13:18 UTC Read the advisory
	Medium	5.3	CVE-2026-112824	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. Bus Ticket Booking with Seat Reservation	NVD	Oct 20 16:17 UTC
CVE-2026-112824Missing Authorization vulnerability in Magepeople inc From the advisory Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Magepeople inc.Magepeople inc. Bus Ticket Booking with Seat Reservation NIST National Vulnerability DatabasePublished Oct 20, 2026 16:17 UTC Read the advisory
	Medium	5.3	CVE-2026-103350	Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc Magepeople inc.Magepeople inc. Booking and Rental Manager	NVD	Oct 15 18:17 UTC
CVE-2026-103350Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc From the advisory Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Removing Important Client Functionality.This issue affects Booking and Rental Manager: from n/a through 2.8.0. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Magepeople inc.Magepeople inc. Booking and Rental Manager NIST National Vulnerability DatabasePublished Oct 15, 2026 18:17 UTC Read the advisory
	Medium	6.5	CVE-2026-107425	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. Bus Ticket Booking with Seat Reservation	NVD	Oct 14 13:17 UTC
CVE-2026-107425Missing Authorization vulnerability in Magepeople inc From the advisory Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Affects Magepeople inc.Magepeople inc. Bus Ticket Booking with Seat Reservation NIST National Vulnerability DatabasePublished Oct 14, 2026 13:17 UTC Read the advisory
	Medium	6.5	CVE-2026-95589	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. Deposits and Partial Payments for WooCommerce	NVD	Oct 9 10:16 UTC
CVE-2026-95589Missing Authorization vulnerability in Magepeople inc From the advisory Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affects Magepeople inc.Magepeople inc. Deposits and Partial Payments for WooCommerce NIST National Vulnerability DatabasePublished Oct 9, 2026 10:16 UTC Read the advisory
	Medium	5.3	CVE-2026-103351	Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc Magepeople inc.Magepeople inc. Taxi Booking Manager for WooCommerce	NVD	Oct 5 09:17 UTC
CVE-2026-103351Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc From the advisory Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input Data Manipulation.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.1. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects Magepeople inc.Magepeople inc. Taxi Booking Manager for WooCommerce NIST National Vulnerability DatabasePublished Oct 5, 2026 09:17 UTC Read the advisory
	Medium	5.4	CVE-2026-62063	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. WpTravelly	NVD	Oct 1 13:17 UTC
CVE-2026-62063Missing Authorization vulnerability in Magepeople inc From the advisory Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects Magepeople inc.Magepeople inc. WpTravelly NIST National Vulnerability DatabasePublished Oct 1, 2026 13:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects