CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 14:33 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-88928 New | PF PAYCOMET for WooCommerce | 6.5 | Oct 29 | PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass |
| CVE-2026-78396 New | LL Link Library | 5.3 | Oct 29 | Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure |
| CVE-2026-78395 New | LL Link Library | 5.3 | Oct 29 | Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass |
| CVE-2026-115302 New | CF Contact Form by Supsystic | 5.3 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion |
| CVE-2026-115301 New | CF Contact Form by Supsystic | 7.2 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block |
| CVE-2026-115300 New | CF Contact Form by Supsystic | 4.3 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF |
| CVE-2026-115299 New | CF Contact Form by Supsystic | 5.4 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF |
| CVE-2026-115282 New | RC Recipe Card Blocks Lite | 5.3 | Oct 29 | Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure |
| CVE-2026-93293 New | PP Password Protected – Protect Your Site Content With a Password saadiqbal | 6.4 | Oct 29 | Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler |
| CVE-2026-118905 New | NV nvm nvm-sh | 7.0 | Oct 29 | nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed |
| CVE-2026-93757 New | WA Wild Apricot Login wild-apricot | 7.5 | Oct 29 | Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite |
| CVE-2026-96228 New | SW SSL Wireless SMS Notification sslplugins | 8.1 | Oct 29 | SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover |
| CVE-2026-96666 New | SA Schema App Structured Data vberkel | 7.2 | Oct 29 | Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter |
| CVE-2026-93904 New | SW Social Web Suite – Social Media Auto Post, Social Media Auto Publish dejanmarkovic | 7.5 | Oct 29 | Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter |
| CVE-2026-93855 New | SN SendPress Newsletters brewlabs | 7.5 | Oct 29 | SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter |
| CVE-2026-96669 New | FS Food Store – Online Food Delivery & Pickup wpscripts | 7.2 | Oct 29 | Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie |
| CVE-2026-96741 New | DA DSGVO All in one for WP mlfactory | 7.2 | Oct 29 | DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption |
| CVE-2026-109516 New | BF Bot for Telegram on WooCommerce guruteam | 9.8 | Oct 29 | Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token |
| CVE-2026-42949 New | FR Frangoteam frangoteam | 5.6 | Oct 29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-40063 New | FR Frangoteam frangoteam | 5.3 | Oct 29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-42922 New | FR Frangoteam frangoteam | 9.8 | Oct 29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-118426 New | OS Octopus Server Octopus Deploy | 5.3 | Oct 29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search |
| CVE-2026-113409 New | OR ortto canva | 4.8 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting |
| CVE-2026-114173 New | OR ortto canva | 5.3 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages |
| CVE-2026-113387 New | OR ortto canva | 8.6 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML |
| CVE-2026-66092 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS in pre-login notice via reachable legacy logon route |
| CVE-2026-66091 New | OP openEQUELLA Apereo Foundation | 6.9 | Oct 29 | Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details |
| CVE-2026-66090 New | OP openEQUELLA Apereo Foundation | 7.1 | Oct 29 | XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read |
| CVE-2026-66089 New | OP openEQUELLA Apereo Foundation | 6.1 | Oct 29 | XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion |
| CVE-2026-66088 New | OP openEQUELLA Apereo Foundation | 9.4 | Oct 29 | Unrestricted Command Execution via system.execute |
| CVE-2026-16889 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin |
| CVE-2026-21157 New | BI Bixby Samsung Mobile | 8.3 | Oct 29 | Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity |
| CVE-2026-113957 New | CO container Apple | – | Oct 29 | An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an… |
| CVE-2026-118590 New | NI nibabel nipy | 5.3 | Oct 29 | nipy nibabel Header volumeutils.py array_from_file memory allocation |
| CVE-2026-79589 New | Product not mapped yet | – | Oct 29 | The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell |
| CVE-2026-118589 New | ME meshio nschloe | 5.3 | Oct 28 | nschloe meshio VTK Reader _vtk_42.py memory allocation |
| CVE-2026-118586 New | FE feedfinder2 dfm | 5.3 | Oct 28 | dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery |
| CVE-2026-118585 New | IN inventariobasico configuroweb | 3.5 | Oct 28 | configuroweb inventariobasico Add Product addlist.php cross site scripting |
| CVE-2026-86983 New | SW swift-crypto Apple | – | Oct 28 | A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length |
| CVE-2026-118579 New | DI DIR-505 D-Link | 9.8 | Oct 28 | D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor |
| CVE-2026-118578 New | MU MusicFreeDesktop maotoumao | 4.3 | Oct 28 | maotoumao MusicFreeDesktop Request Forwarder information disclosure |
| CVE-2026-82411 New | OP open-object maykinmedia | 6.5 | Oct 28 | Objects API: Cross-object-type authorization bypass on the object history-detail endpoint |
| CVE-2026-85749 New | MA MailWatch mailwatch | 8.1 | Oct 28 | MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail |
| CVE-2026-55561 New | IN InvoicePlane InvoicePlane | 5.3 | Oct 28 | InvoicePlane: Guest user IDOR in quote approval and rejection |
| CVE-2026-75520 New | DO domoticz domoticz | 5.4 | Oct 28 | Domoticz: Missing authorization and path traversal in the udevices Lua parser handler |
| CVE-2026-118577 New | MU MusicFreeDesktop maotoumao | 6.3 | Oct 28 | maotoumao MusicFreeDesktop Request Forwarder server-side request forgery |
| CVE-2026-118538 New | A2 a2ui a2ui-project | 5.5 | Oct 28 | a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes |
| CVE-2026-61575 New | AV AVideo-Encoder WWBN | 4.7 | Oct 28 | AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles |
| CVE-2026-61569 New | AV AVideo-Encoder WWBN | 7.5 | Oct 28 | AVideo-Encoder: pre-authentication streamer-login SQL injection |
| CVE-2026-54453 New | OP OpenCATS opencats | 7.2 | Oct 28 | OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional) |