CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 08:19 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110314 New | BA bandit mtrudel | 6.3 | Oct 26 | WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit |
| CVE-2026-114216 New | BA bandit mtrudel | 6.3 | Oct 26 | Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit |
| CVE-2026-116282 New | KA Kameleo Kameleo | 4.3 | Oct 26 | Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure |
| CVE-2026-116488 New | MC mcuxsdk-middleware-usb NXP | 6.8 | Oct 26 | NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers |
| CVE-2026-116487 New | MC mcuxsdk-middleware-usb NXP | 4.6 | Oct 26 | NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read |
| CVE-2026-116486 New | OB objenesis easymock | 4.5 | Oct 26 | Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache |
| CVE-2026-116217 New | RO rosariosis francoisjacquet | 6.1 | Oct 26 | RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php |
| CVE-2026-116216 New | MA maccms10 maccmspro | 5.3 | Oct 26 | MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment |
| CVE-2026-116213 New | WF Webasyst Framework Webasyst | 4.9 | Oct 26 | Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks |
| CVE-2026-116212 New | WF Webasyst Framework Webasyst | 5.4 | Oct 26 | Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL |
| CVE-2026-116210 New | WF Webasyst Framework Webasyst | 6.5 | Oct 26 | Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions |
| CVE-2026-115196 New | Product not mapped yet | 5.4 | Oct 26 | An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic |
| CVE-2026-115195 New | Product not mapped yet | 6.5 | Oct 26 | A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}) |
| CVE-2026-115194 New | Product not mapped yet | 6.5 | Oct 26 | A path traversal vulnerability exists in the Mautic Asset API |
| CVE-2026-116280 New | KA Kameleo Kameleo | 5.5 | Oct 26 | Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery |
| CVE-2026-116275 New | AL AllenNLP AllenAI | 6.3 | Oct 26 | AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection |
| CVE-2026-116492 New | CR crm frappe | 6.5 | Oct 26 | Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API |
| CVE-2026-116274 New | JI JIZHICMS Jizhicms | 4.3 | Oct 26 | JIZHICMS Front-end Order OrderController.php pay improper authorization |
| CVE-2026-115720 New | BU builder frappe | 5.0 | Oct 26 | Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect |
| CVE-2026-116263 New | PI PictShare HaschekSolutions | 4.6 | Oct 26 | HaschekSolutions PictShare File Upload core.php architect race condition |
| CVE-2026-105947 New | LS Logsign SIEM Innotim Software, Telecommunications, and Consulting Co. Ltd. | 6.5 | Oct 26 | Arbitrary File Read in Innotim Software's Logsign SIEM |
| CVE-2026-116262 New | LI libimobiledevice Libimobiledevice | 5.4 | Oct 26 | libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow |
| CVE-2026-115718 New | BU builder frappe | 4.3 | Oct 26 | Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt |
| CVE-2026-116259 New | LI libimobiledevice Libimobiledevice | 5.3 | Oct 26 | libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption |
| CVE-2026-116258 New | LI libimobiledevice Libimobiledevice | 6.3 | Oct 26 | libimobiledevice AFC afc.c heap-based overflow |
| CVE-2026-89209 New | MS Mendix SAML (Mendix 10 compatible) Siemens | 6.8 | Oct 26 | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix… |
| CVE-2026-114708 New | JE JetSmartFilters Crocoblock | 6.5 | Oct 26 | WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115595 New | CF Contact Form by Supsystic Supsystic | 5.3 | Oct 26 | WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability |
| CVE-2026-115959 New | AS APIExperts Square for WooCommerce WPExperts | 5.3 | Oct 26 | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability |
| CVE-2026-115960 New | AS APIExperts Square for WooCommerce WPExperts | 4.3 | Oct 26 | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability |
| CVE-2026-115955 New | AP Advanced Post Block - Post Grid for WordPress block editor bPlugins | 6.5 | Oct 26 | WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115956 New | PV Panorama Viewer – 360 Degree Image + Video Viewer bPlugins | 6.5 | Oct 26 | WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115961 New | BS B Slider bPlugins | 6.5 | Oct 26 | WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114707 New | JF JetElements For Elementor Crocoblock | 6.5 | Oct 26 | WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115594 New | ML Media LIbrary Assistant David Lingren | 6.5 | Oct 26 | WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability |
| CVE-2026-115953 New | GM Geo Mashup Dylan Kuhn | 6.5 | Oct 26 | WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115954 New | GM Geo Mashup Dylan Kuhn | 5.4 | Oct 26 | WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability |
| CVE-2026-115950 New | BP Better Post & Filter Widgets for Elementor WP Smart Widgets | 6.5 | Oct 26 | WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115951 New | LL Lazy Load for Videos Kevin Weber | 6.5 | Oct 26 | WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114709 New | AI Ad Inserter Igor Funa | 6.5 | Oct 26 | WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115949 New | BP Better Post & Filter Widgets for Elementor WP Smart Widgets | 6.5 | Oct 26 | WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability |
| CVE-2026-115614 New | BA Booking and Rental Manager Magepeople inc. | 5.3 | Oct 26 | WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability |
| CVE-2026-97255 New | RE Royal Elementor Addons WProyal | 5.3 | Oct 26 | WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97254 New | RE Royal Elementor Addons WProyal | 6.5 | Oct 26 | WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97295 New | ML Media LIbrary Assistant David Lingren | 4.3 | Oct 26 | WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-112865 New | RE Royal Elementor Addons WProyal | 6.5 | Oct 26 | WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-116255 New | CO codefever PGYER | 5.3 | Oct 26 | PGYER codefever URI Sanitizer doc.php _detail path traversal |
| CVE-2026-110377 New | BW Bopo – WooCommerce Product Bundle Builder VillaTheme | 5.3 | Oct 26 | WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability |
| CVE-2026-115602 New | GB Gutenberg Blocks by Kadence Blocks Liquid Web / StellarWP | 6.5 | Oct 26 | WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115613 New | IG Image Gallery block – Create and display photo gallery/photo album. bPlugins | 6.5 | Oct 26 | WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability |