automattic vulnerabilities
75 published CVEs name automattic among the affected products.
- 75Published CVEs75 of them scored
- 24Last 12 monthspublished in the last year
- 3Critical17 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-125120
Mongoose: sanitizeFilter not applied on countDocuments
Automattic · mongoose
Critical9.8 - CVE-2026-125119
Mongoose: Connection-level sanitizeFilter not applied
Automattic · mongoose
High7.5 - CVE-2026-125118
Mongoose: Prototype pollution via Schema.prototype.virtual()
Automattic · mongoose
Medium6.5 - CVE-2026-125117
Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
Automattic · mongoose
High8.2 - CVE-2026-125116
Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
Automattic · mongoose
Medium4.8 - CVE-2026-112329
Sensei LMS 4.26.4 Broken Access Control via save_new_message
Automattic · Sensei LMS
Medium5.3 - CVE-2026-112328
Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
Automattic · Sensei LMS
Medium5.3 - CVE-2026-40808
WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability
Automattic · Jetpack VideoPress
Medium6.5 - CVE-2026-106608
WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability
Automattic · WooCommerce
High7.2 - CVE-2026-106601
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
Automattic · Jetpack
Medium5.4