CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 15:54 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108064 | WE WP Encryption | 6.5 | Oct 14 | WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler |
| CVE-2026-107594 | FU File Upload to Order | 10.0 | Oct 14 | File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion |
| CVE-2026-107508 | UM Ultimate Multisite | 8.6 | Oct 14 | Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter |
| CVE-2026-107320 | GA GamiPress | 5.3 | Oct 14 | GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure |
| CVE-2026-107319 | GA GamiPress | 4.3 | Oct 14 | GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure |
| CVE-2026-107178 | IP Image Photo Gallery Final Tiles Grid | 6.8 | Oct 14 | Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter |
| CVE-2026-107160 | LF LTL Freight Quotes | 5.3 | Oct 14 | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message |
| CVE-2026-107158 | LF LTL Freight Quotes | 5.3 | Oct 14 | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route |
| CVE-2026-107126 | WB WP Booking System | 8.8 | Oct 14 | WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header |
| CVE-2026-106646 | CL Classified Listing | 5.9 | Oct 14 | Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers |
| CVE-2026-106469 | GF Gutenverse Form | 6.8 | Oct 14 | Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon |
| CVE-2026-106166 | NE NEX-Forms | 5.3 | Oct 14 | NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter |
| CVE-2026-106099 | WD WP Data Access | 5.3 | Oct 14 | WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export |
| CVE-2026-106098 | WD WP Data Access | 5.3 | Oct 14 | WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update |
| CVE-2026-105975 | CS CamPay Shortcode Payment Gateway | 5.3 | Oct 14 | CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference |
| CVE-2026-105969 | CB CodeAtoZ B2B Suite for WooCommerce | 5.3 | Oct 14 | CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure |
| CVE-2026-105261 | SP Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | 6.8 | Oct 14 | PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes |
| CVE-2026-104751 | RM Rank Math SEO | 5.3 | Oct 14 | Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion |
| CVE-2026-104644 | IP Image Photo Gallery Final Tiles Grid | 6.8 | Oct 14 | Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update |
| CVE-2026-103307 | WP Walletdoc Payment Gateway for WooCommerce | 8.6 | Oct 14 | Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook |
| CVE-2026-94370 | QT Qt_for_MCUs qt | 6.5 | Oct 14 | Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs |
| CVE-2026-110459 | UP UniFi Protect AI Key Ubiquiti Inc | 8.6 | Oct 14 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes,… |
| CVE-2026-110458 | UP UniFi Protect AI Key Ubiquiti Inc | 3.7 | Oct 14 | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on… |
| CVE-2026-107153 | RB Rakuten BIGs Rakuten Mobile, Inc. | 6.6 | Oct 14 | Multiple smartphones provided by Rakuten Mobile, Inc |
| CVE-2026-110457 | UP UniFi Protect AI Key Ubiquiti Inc | 3.7 | Oct 14 | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about… |
| CVE-2026-110456 | UP UniFi Protect AI Key Ubiquiti Inc | 5.3 | Oct 14 | A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal… |
| CVE-2026-110455 | UP UniFi Protect AI Key Ubiquiti Inc | 8.1 | Oct 14 | A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a… |
| CVE-2026-110454 | UP UniFi Protect AI Key Ubiquiti Inc | 5.3 | Oct 14 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device |
| CVE-2026-106931 In wildKEV | SS SiteGuard Server Edition for Apache httpd EG Secure Solutions Inc. | 7.8 | Oct 14 | EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability |
| CVE-2026-105429 | NE NetBird NetBird | 8.0 | Oct 14 | NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution |
| CVE-2026-101926 | HW Hyyan WooCommerce Polylang Integration hyyan | 6.5 | Oct 14 | Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter |
| CVE-2026-103369 | SS Social Share Buttons & Analytics Plugin – GetSocial.io joaoromao | 6.4 | Oct 14 | Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX |
| CVE-2026-101924 | NE NewStatPress ice00 | 7.2 | Oct 14 | NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String |
| CVE-2026-110453 | NI Nix NixOS | 4.3 | Oct 14 | Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients |
| CVE-2026-110452 | NI Nix NixOS | 4.0 | Oct 14 | The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership |
| CVE-2026-110451 | NI Nix NixOS | 4.3 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled |
| CVE-2026-110450 | NI Nix NixOS | 8.0 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification |
| CVE-2026-110449 | NI Nix NixOS | 7.5 | Oct 14 | Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled |
| CVE-2026-100153 | NE NewStatPress ice00 | 7.2 | Oct 14 | NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field) |
| CVE-2026-87855 | JF JTL-Connector for WooCommerce ntbyk | 9.8 | Oct 14 | JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method |
| CVE-2026-97471 | AF Avada (Fusion) Builder themefusion | 5.3 | Oct 14 | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token |
| CVE-2026-97398 | FF FV Flowplayer Video Player foliovision | 7.2 | Oct 14 | FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute |
| CVE-2026-95808 | FM Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 10web | 7.5 | Oct 14 | Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter |
| CVE-2026-100185 | DA Directorist: AI-Powered Business Directory, Listings & Classified Ads wpwax | 6.4 | Oct 14 | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field |
| CVE-2026-83592 | CF Contact Form DB for Enfold doctorwp | 7.2 | Oct 14 | Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values |
| CVE-2026-95816 | SF Smart Forms – when you need more than just a contact form edgarrojas | 7.2 | Oct 14 | Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter |
| CVE-2026-78193 | JF JTL-Connector for WooCommerce ntbyk | 7.5 | Oct 14 | JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection |
| CVE-2026-94377 | VR Verified Reviews (Avis Vérifiés) avisverifies | 7.2 | Oct 14 | Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire) |
| CVE-2026-97020 | PE PO/MO Editor dougwollison | 6.4 | Oct 14 | PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter |
| CVE-2026-93885 | CD Cryptocurrency Donation Box – Bitcoin & Crypto Donations blackworks1 | 7.2 | Oct 14 | Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter |