CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 13:20 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114270 New | GE GeoDirectory | 5.3 | Oct 29 | GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure |
| CVE-2026-110983 New | WP WP Photo Album Plus | 4.3 | Oct 29 | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF |
| CVE-2026-110505 New | ES Enable SVG, WebP, and ICO Upload | 6.8 | Oct 29 | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass |
| CVE-2026-110504 New | ES Enable SVG, WebP, and ICO Upload | 6.8 | Oct 29 | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass |
| CVE-2026-110030 New | HP Hide Price Until Login | 5.3 | Oct 29 | Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration |
| CVE-2026-108763 New | WS Wallet System for WooCommerce | 4.3 | Oct 29 | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR |
| CVE-2026-88928 New | PF PAYCOMET for WooCommerce | 6.5 | Oct 29 | PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass |
| CVE-2026-78396 New | LL Link Library | 5.3 | Oct 29 | Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure |
| CVE-2026-78395 New | LL Link Library | 5.3 | Oct 29 | Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass |
| CVE-2026-115302 New | CF Contact Form by Supsystic | 5.3 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion |
| CVE-2026-115300 New | CF Contact Form by Supsystic | 4.3 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF |
| CVE-2026-115299 New | CF Contact Form by Supsystic | 5.4 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF |
| CVE-2026-115282 New | RC Recipe Card Blocks Lite | 5.3 | Oct 29 | Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure |
| CVE-2026-93293 New | PP Password Protected – Protect Your Site Content With a Password saadiqbal | 6.4 | Oct 29 | Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler |
| CVE-2026-42949 New | FR Frangoteam frangoteam | 5.6 | Oct 29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-40063 New | FR Frangoteam frangoteam | 5.3 | Oct 29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-118426 New | OS Octopus Server Octopus Deploy | 5.3 | Oct 29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search |
| CVE-2026-113409 New | OR ortto canva | 4.8 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting |
| CVE-2026-114173 New | OR ortto canva | 5.3 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages |
| CVE-2026-66092 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS in pre-login notice via reachable legacy logon route |
| CVE-2026-66091 New | OP openEQUELLA Apereo Foundation | 6.9 | Oct 29 | Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details |
| CVE-2026-66089 New | OP openEQUELLA Apereo Foundation | 6.1 | Oct 29 | XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion |
| CVE-2026-16889 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin |
| CVE-2026-118590 New | NI nibabel nipy | 5.3 | Oct 29 | nipy nibabel Header volumeutils.py array_from_file memory allocation |
| CVE-2026-118589 New | ME meshio nschloe | 5.3 | Oct 28 | nschloe meshio VTK Reader _vtk_42.py memory allocation |
| CVE-2026-118586 New | FE feedfinder2 dfm | 5.3 | Oct 28 | dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery |
| CVE-2026-118578 New | MU MusicFreeDesktop maotoumao | 4.3 | Oct 28 | maotoumao MusicFreeDesktop Request Forwarder information disclosure |
| CVE-2026-82411 New | OP open-object maykinmedia | 6.5 | Oct 28 | Objects API: Cross-object-type authorization bypass on the object history-detail endpoint |
| CVE-2026-55561 New | IN InvoicePlane InvoicePlane | 5.3 | Oct 28 | InvoicePlane: Guest user IDOR in quote approval and rejection |
| CVE-2026-75520 New | DO domoticz domoticz | 5.4 | Oct 28 | Domoticz: Missing authorization and path traversal in the udevices Lua parser handler |
| CVE-2026-118577 New | MU MusicFreeDesktop maotoumao | 6.3 | Oct 28 | maotoumao MusicFreeDesktop Request Forwarder server-side request forgery |
| CVE-2026-118538 New | A2 a2ui a2ui-project | 5.5 | Oct 28 | a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes |
| CVE-2026-61575 New | AV AVideo-Encoder WWBN | 4.7 | Oct 28 | AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles |
| CVE-2026-116641 New | MO MongoDB MongoDB | 6.8 | Oct 28 | The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs |
| CVE-2026-61573 New | AV AVideo-Encoder WWBN | 6.1 | Oct 28 | AVideo-Encoder: reflected cross-site scripting in the login interface |
| CVE-2026-118537 New | A2 a2ui A2ui | 4.3 | Oct 28 | a2ui Image Player/Video Player/Audio Player Image.js input validation |
| CVE-2026-57448 New | BL blombooru mrblomblo | 6.2 | Oct 28 | Blombooru: administrator image-proxy server-side request forgery |
| CVE-2026-118757 New | PD PiWeb Disable payment method / Partial payment for WooCommerce PI Websolution | 6.5 | Oct 28 | PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees |
| CVE-2026-118756 New | GO gopass gopasspw | 5.5 | Oct 28 | gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir |
| CVE-2026-118754 New | DE Dolibarr ERP/CRM Dolibarr | 5.3 | Oct 28 | Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php |
| CVE-2026-118693 New | CH cherrytree giuspen | 4.7 | Oct 28 | CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path |
| CVE-2026-118667 New | LA langgraph langchain-ai | 4.3 | Oct 28 | LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests |
| CVE-2026-118666 New | EX executor-legacy-ws @graphql-tools | 6.0 | Oct 28 | GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller |
| CVE-2026-118663 New | NO node-server honojs | 5.3 | Oct 28 | @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths |
| CVE-2026-118662 New | VI vite vitejs | 6.9 | Oct 28 | Vite: `server.fs.deny` bypassed with queries |
| CVE-2026-118661 New | HA happy-dom capricorn86 | 6.5 | Oct 28 | Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies |
| CVE-2026-118658 New | EC echo labstack | 4.7 | Oct 28 | Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto |
| CVE-2026-118657 New | EC echo labstack | 5.9 | Oct 28 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers |
| CVE-2026-118656 New | EC echo labstack | 6.1 | Oct 28 | Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI |
| CVE-2026-118655 New | EC echo labstack | 5.9 | Oct 28 | Echo: Static Middleware Double-Unescape Path Traversal |