CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 05:48 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54853 New | PB Profile Builder Cozmoslabs | 5.3 | Oct 29 | WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability |
| CVE-2026-114706 New | ST Strong Testimonials WP Chill | 6.5 | Oct 29 | WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-27063 New | KF Kit (formerly ConvertKit) Kit | 5.3 | Oct 29 | WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability |
| CVE-2026-115601 New | CP Custom Price for WooCommerce WP Desk | 5.3 | Oct 29 | WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability |
| CVE-2026-115605 New | SU SureDash Brainstorm Force | 4.3 | Oct 29 | WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability |
| CVE-2026-118095 New | ML Media LIbrary Assistant David Lingren | 6.5 | Oct 29 | WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-54871 New | SE ShopBuilder – Elementor WooCommerce Builder Addons Mamunur Rashid | 5.3 | Oct 29 | WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability |
| CVE-2026-25450 New | UR User Registration ThemeGrill | 5.3 | Oct 29 | WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability |
| CVE-2026-116850 New | HA Happy Addons for Elementor weDevs | 6.5 | Oct 29 | WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114181 New | TB Taxi Booking Manager for WooCommerce Magepeople inc. | 5.3 | Oct 29 | WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability |
| CVE-2026-118088 New | WP WPFunnels WPFunnels Team | 5.3 | Oct 29 | WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability |
| CVE-2026-116849 New | ST StreamCast bPlugins | 6.5 | Oct 29 | WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-110881 New | SU SureDash Brainstorm Force | 6.5 | Oct 29 | WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-116856 New | FQ Flexible Quantity – Measurement Price Calculator for WooCommerce WP Desk | 5.3 | Oct 29 | WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability |
| CVE-2026-39737 New | JF JetElements For Elementor Crocoblock | 6.5 | Oct 29 | WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-118091 New | WP WPFunnels WPFunnels Team | 5.3 | Oct 29 | WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability |
| CVE-2026-116387 New | SU SureForms Brainstorm Force | 5.3 | Oct 29 | WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability |
| CVE-2026-39742 New | GB Gutenberg Blocks by Kadence Blocks Liquid Web / StellarWP | 6.5 | Oct 29 | WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115610 New | PA PublishPress Authors PublishPress | 6.5 | Oct 29 | WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-118092 New | ML MasterStudy LMS StylemixThemes | 4.3 | Oct 29 | WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability |
| CVE-2026-116406 New | WB Webba Booking Webba Plugins | 4.3 | Oct 29 | WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability |
| CVE-2026-52708 New | WU WP User Frontend weDevs | 4.3 | Oct 29 | WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability |
| CVE-2026-116846 New | WU WP User Manager WP User Manager | 5.3 | Oct 29 | WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability |
| CVE-2026-48884 New | WU WP User Frontend weDevs | 5.3 | Oct 29 | WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability |
| CVE-2026-80069 New | ML MasterStudy LMS WordPress Plugin Stylemix | 4.3 | Oct 29 | MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax |
| CVE-2026-80067 New | ML MasterStudy LMS WordPress Plugin Stylemix | 5.4 | Oct 29 | MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter |
| CVE-2026-115712 New | EC Elastic Cloud Enterprise Elastic | 4.3 | Oct 29 | Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings |
| CVE-2026-115711 New | EC Elastic Cloud Enterprise Elastic | 6.4 | Oct 29 | Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure |
| CVE-2026-115707 New | EC Elastic Cloud Enterprise Elastic | 6.4 | Oct 29 | Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation |
| CVE-2026-115706 New | EC Elastic Cloud Enterprise Elastic | 6.8 | Oct 29 | Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation |
| CVE-2026-116402 New | SU SureForms Brainstorm Force | 5.3 | Oct 29 | WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability |
| CVE-2026-118425 New | RH Red Hat Build of Keycloak Red Hat | 6.8 | Oct 29 | Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback |
| CVE-2026-48202 New | BR Brave Brave | 5.3 | Oct 29 | WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability |
| CVE-2026-39782 New | KF Kali Forms Kaliforms | 5.3 | Oct 29 | WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability |
| CVE-2026-25467 New | UR User Registration ThemeGrill | 5.3 | Oct 29 | WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability |
| CVE-2026-116857 New | JE JetSmartFilters Crocoblock | 6.5 | Oct 29 | WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-113697 New | BH BMC Helix Operations Management BMC | 4.8 | Oct 29 | Reflected Cross-Site Scripting in BMC Helix Operations Management |
| CVE-2026-113696 New | BI BMC IT Service Management Suite BMC | 5.3 | Oct 29 | Improper Authorization in BMC ITSM SmartIT Change Approvals |
| CVE-2026-113695 New | BI BMC IT Service Management Suite BMC | 4.8 | Oct 29 | Reflected Cross-Site Scripting in BMC ITSM SmartIT |
| CVE-2026-93009 New | RH Red Hat Ceph Storage 9 Red Hat | 4.3 | Oct 29 | Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder |
| CVE-2026-93010 New | RH Red Hat Ceph Storage 9 Red Hat | 4.3 | Oct 29 | Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check |
| CVE-2026-113694 New | BI BMC IT Service Management Suite BMC | 5.3 | Oct 29 | Improper Authorization in BMC ITSM SmartIT Attachments |
| CVE-2026-113693 New | BI BMC IT Service Management Suite BMC | 5.3 | Oct 29 | System Account Credential Disclosure in BMC ITSM |
| CVE-2026-54862 New | IA Import and export users and customers Codection | 6.5 | Oct 29 | WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-113692 New | BI BMC IT Service Management Suite BMC | 6.9 | Oct 29 | Path Traversal in BMC ITSM |
| CVE-2026-119054 New | MP Multiple Pages Generator by Themeisle Themeisle | 5.4 | Oct 29 | Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url |
| CVE-2026-119053 New | LW lwIP lwIP | 5.3 | Oct 29 | lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto() |
| CVE-2026-119051 New | FL flat hughsk | 5.9 | Oct 29 | flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys |
| CVE-2026-119048 New | JE JeeSite thinkgem | 4.2 | Oct 29 | JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module |
| CVE-2026-42707 New | HC HivePress Claim Listings HivePress | 4.3 | Oct 29 | WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability |