CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 04:59 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-49142 New | OP openemr openemr | 8.8 | Oct 29 | OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[] |
| CVE-2026-93008 New | RH Red Hat Ceph Storage 9 Red Hat | 6.8 | Oct 29 | Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations |
| CVE-2026-119028 New | OA oapi-codegen oapi-codegen | 8.8 | Oct 29 | oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values |
| CVE-2026-119027 New | OA oapi-codegen oapi-codegen | 7.5 | Oct 29 | oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension |
| CVE-2026-109822 New | NW NWR100 Yamaha Corporation | 6.5 | Oct 29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information |
| CVE-2026-97854 New | NW NWR100 Yamaha Corporation | 9.8 | Oct 29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability |
| CVE-2026-103665 New | YL Yamaha LAN Monitor for Windows Yamaha Corporation | 7.8 | Oct 29 | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs) |
| CVE-2026-97860 New | YM YMS-VPN8 Yamaha Corporation | 6.7 | Oct 29 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths |
| CVE-2026-27401 New | YP YITH PayPal Express Checkout for WooCommerce YITH | 5.3 | Oct 29 | WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability |
| CVE-2026-115821 New | NE NewsmanApp newsmanapp | 7.2 | Oct 29 | NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters |
| CVE-2026-110184 New | NE Newsmatic blazethemes | 7.5 | Oct 29 | Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter |
| CVE-2026-92086 New | MW MW WP Form websoudan | 5.3 | Oct 29 | MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter |
| CVE-2026-109216 New | MB Meta Box – A Framework for Dynamic Websites metabox | 4.9 | Oct 29 | Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys |
| CVE-2026-96767 New | NU NEX-Forms – Ultimate Forms Plugin for WordPress webaways | 7.2 | Oct 29 | NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header |
| CVE-2026-119025 New | OP opencode anomalyco | 7.5 | Oct 29 | open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows |
| CVE-2026-5702 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application |
| CVE-2026-5700 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5699 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5698 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5697 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-115611 New | TA TableOn PluginUs.Net | 7.1 | Oct 29 | WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115964 New | MO Motors StylemixThemes | 9.3 | Oct 29 | WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability |
| CVE-2026-115962 New | MY myCred myCred | 4.3 | Oct 29 | WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability |
| CVE-2026-115592 New | OC OceanWP OceanWP | 7.1 | Oct 29 | WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-116409 New | UO Upsell Order Bump Offer for WooCommerce WP Swings | 7.1 | Oct 29 | WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112827 New | HD HANDMADE – Dropshipping for Etsy and WooCommerce VillaTheme | 7.1 | Oct 29 | WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2026-114193 New | GM GEO my WordPress Eyal Fitoussi | 7.5 | Oct 29 | WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability |
| CVE-2026-115599 New | LE LearnPress ThimPress | 7.5 | Oct 29 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability |
| CVE-2026-115965 New | BU BuddyPress BuddyPress | 8.5 | Oct 29 | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability |
| CVE-2026-115967 New | LW Login with phone number Hamid Alinia | 8.8 | Oct 29 | WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability |
| CVE-2026-115963 New | BL Broadcast Live Video VideoWhisper.com | 7.1 | Oct 29 | WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability |
| CVE-2026-118989 New | PI Product Import Export for WooCommerce WebToffee | 5.5 | Oct 29 | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects |
| CVE-2026-33924 New | CM CMC Nozomi Networks | 7.2 | Oct 29 | Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 |
| CVE-2026-33923 New | CM CMC Nozomi Networks | 7.2 | Oct 29 | Update bundle signature bypass in Guardian/CMC before 26.4.0 |
| CVE-2026-118984 New | OM OmniRoute cheaper-inference | 5.5 | Oct 29 | OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login |
| CVE-2026-71569 New | AC Apache Camel Apache Software Foundation | 4.8 | Oct 29 | Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name |
| CVE-2026-115942 New | AQ Apache Qpid Proton C Apache Software Foundation | – | Oct 29 | Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read |
| CVE-2026-114230 New | AQ Apache Qpid Proton C Apache Software Foundation | – | Oct 29 | Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames |
| CVE-2026-105042 New | AQ Apache Qpid Proton C Apache Software Foundation | – | Oct 29 | Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash |
| CVE-2026-105031 New | AQ Apache Qpid Proton C Apache Software Foundation | – | Oct 29 | Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. |
| CVE-2026-111417 New | FO foxit.com Foxit Software Inc. | 7.5 | Oct 29 | Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service |
| CVE-2026-111418 New | FO foxit.com Foxit Software Inc. | 7.5 | Oct 29 | SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service |
| CVE-2026-111419 New | FO foxit.com Foxit Software Inc. | 8.6 | Oct 29 | Hardcoded API Token in Foxit Official Website |
| CVE-2026-117611 New | CH Checkmk Checkmk GmbH | 7.1 | Oct 29 | Trust of compromised eMudhra root CA in bundled CA stores |
| CVE-2026-111318 New | HM HT Mega Addons for Elementor – Elementor Widgets & Template Builder devitemsllc | 5.4 | Oct 29 | HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink |
| CVE-2026-107743 New | MW Mapster WP Maps mapster | 7.2 | Oct 29 | Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter |
| CVE-2026-91153 New | EF Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI wpeverest | 5.3 | Oct 29 | Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...}) |
| CVE-2026-116763 New | LC LiteSpeed Cache litespeedtech | 5.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) |
| CVE-2026-104727 New | SO Sequential Order Numbers for WooCommerce berocket | 6.4 | Oct 29 | Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys |
| CVE-2026-109215 New | LC LiteSpeed Cache litespeedtech | 6.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization |