CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 13:52 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118030 New | RH Red Hat Build of Keycloak Red Hat | 4.2 | Oct 29 | Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins |
| CVE-2026-117859 New | RH Red Hat Build of Keycloak Red Hat | 5.4 | Oct 29 | Keycloak-services: keycloak-services: par single-use bypass via flow restart |
| CVE-2026-117688 New | RH Red Hat Build of Keycloak Red Hat | 5.3 | Oct 29 | Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration |
| CVE-2026-117548 New | RH Red Hat Directory Server 11 Red Hat | 6.5 | Oct 29 | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service |
| CVE-2026-117627 New | RH Red Hat Build of Keycloak Red Hat | 5.4 | Oct 29 | Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions |
| CVE-2026-114488 New | RH Red Hat Fuse 7 Red Hat | 7.4 | Oct 29 | Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding |
| CVE-2026-19610 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 6.5 | Oct 29 | Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean |
| CVE-2026-15564 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 7.4 | Oct 29 | Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization |
| CVE-2026-86794 New | CE Community Events | 8.8 | Oct 29 | Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form |
| CVE-2026-85007 New | VP Video Player for YouTube | 3.8 | Oct 29 | YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax |
| CVE-2026-115259 New | PE Photo Engine (Media Organizer & Lightroom) | 4.9 | Oct 29 | Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR |
| CVE-2026-115245 New | CA Chat AI with Dispatcher | 9.8 | Oct 29 | Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload |
| CVE-2026-114270 New | GE GeoDirectory | 5.3 | Oct 29 | GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure |
| CVE-2026-113617 New | AI Automated Import Products to Cart | 9.9 | Oct 29 | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal |
| CVE-2026-113616 New | LA LogixFast Auth | 9.8 | Oct 29 | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset |
| CVE-2026-111739 New | AS All-In-One Security (AIOS) | 7.5 | Oct 29 | Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter |
| CVE-2026-110983 New | WP WP Photo Album Plus | 4.3 | Oct 29 | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF |
| CVE-2026-110505 New | ES Enable SVG, WebP, and ICO Upload | 6.8 | Oct 29 | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass |
| CVE-2026-110504 New | ES Enable SVG, WebP, and ICO Upload | 6.8 | Oct 29 | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass |
| CVE-2026-110030 New | HP Hide Price Until Login | 5.3 | Oct 29 | Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration |
| CVE-2026-108763 New | WS Wallet System for WooCommerce | 4.3 | Oct 29 | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR |
| CVE-2026-108686 New | WP WP Post Author | 3.7 | Oct 29 | WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure |
| CVE-2026-108685 New | WP WP Post Author | 3.7 | Oct 29 | WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields |
| CVE-2026-105258 New | AB Appointment Booking Plugin | 3.5 | Oct 29 | LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings |
| CVE-2026-103693 New | FD Frontend Dashboard | 9.0 | Oct 29 | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection |
| CVE-2024-3586 New | LE LetterPress | 3.5 | Oct 29 | LetterPress < 2.4.0 - Admin+ Stored XSS |
| CVE-2026-89216 New | VT vTables | 8.6 | Oct 29 | vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter |
| CVE-2026-88928 New | PF PAYCOMET for WooCommerce | 6.5 | Oct 29 | PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass |
| CVE-2026-78396 New | LL Link Library | 5.3 | Oct 29 | Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure |
| CVE-2026-78395 New | LL Link Library | 5.3 | Oct 29 | Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass |
| CVE-2026-115302 New | CF Contact Form by Supsystic | 5.3 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion |
| CVE-2026-115301 New | CF Contact Form by Supsystic | 7.2 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block |
| CVE-2026-115300 New | CF Contact Form by Supsystic | 4.3 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF |
| CVE-2026-115299 New | CF Contact Form by Supsystic | 5.4 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF |
| CVE-2026-115282 New | RC Recipe Card Blocks Lite | 5.3 | Oct 29 | Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure |
| CVE-2026-93293 New | PP Password Protected – Protect Your Site Content With a Password saadiqbal | 6.4 | Oct 29 | Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler |
| CVE-2026-118905 New | NV nvm nvm-sh | 7.0 | Oct 29 | nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed |
| CVE-2026-93757 New | WA Wild Apricot Login wild-apricot | 7.5 | Oct 29 | Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite |
| CVE-2026-96228 New | SW SSL Wireless SMS Notification sslplugins | 8.1 | Oct 29 | SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover |
| CVE-2026-96666 New | SA Schema App Structured Data vberkel | 7.2 | Oct 29 | Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter |
| CVE-2026-93904 New | SW Social Web Suite – Social Media Auto Post, Social Media Auto Publish dejanmarkovic | 7.5 | Oct 29 | Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter |
| CVE-2026-93855 New | SN SendPress Newsletters brewlabs | 7.5 | Oct 29 | SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter |
| CVE-2026-96669 New | FS Food Store – Online Food Delivery & Pickup wpscripts | 7.2 | Oct 29 | Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie |
| CVE-2026-96741 New | DA DSGVO All in one for WP mlfactory | 7.2 | Oct 29 | DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption |
| CVE-2026-109516 New | BF Bot for Telegram on WooCommerce guruteam | 9.8 | Oct 29 | Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token |
| CVE-2026-42949 New | FR Frangoteam frangoteam | 5.6 | Oct 29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-40063 New | FR Frangoteam frangoteam | 5.3 | Oct 29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-42922 New | FR Frangoteam frangoteam | 9.8 | Oct 29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-118426 New | OS Octopus Server Octopus Deploy | 5.3 | Oct 29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search |
| CVE-2026-113409 New | OR ortto canva | 4.8 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting |