CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,443 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,443
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product themeum:tutor_lms_elearning_and_online_course_solution. Show all products

10 CVEs, showing 1 to 10
CVESeverityTitlePublished
CVE-2026-92715Medium 4.3Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
Assigned by Wordfence
Oct 17, 2026
CVE-2026-93681Medium 6.4Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
Assigned by Wordfence
Oct 16, 2026
CVE-2026-88963Medium 6.1Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
Assigned by Wordfence
Oct 16, 2026
CVE-2026-100193Medium 4.7Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
Assigned by Wordfence
Oct 14, 2026
CVE-2026-18439Medium 4.3Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
Assigned by Wordfence
Sep 22, 2026
CVE-2026-89081Medium 6.1Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
Assigned by Wordfence
Sep 19, 2026
CVE-2026-88944Medium 4.3Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
Assigned by Wordfence
Sep 19, 2026
CVE-2026-89333Medium 6.5Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
Assigned by Wordfence
Sep 19, 2026
CVE-2026-78175High 8.8Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Assigned by Wordfence
Sep 12, 2026
CVE-2026-16759Medium 6.5Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
Assigned by Wordfence
Aug 28, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.