CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 07:54 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116409 New | UO Upsell Order Bump Offer for WooCommerce WP Swings | 7.1 | Oct 29 | WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112827 New | HD HANDMADE – Dropshipping for Etsy and WooCommerce VillaTheme | 7.1 | Oct 29 | WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2026-114193 New | GM GEO my WordPress Eyal Fitoussi | 7.5 | Oct 29 | WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability |
| CVE-2026-115599 New | LE LearnPress ThimPress | 7.5 | Oct 29 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability |
| CVE-2026-115965 New | BU BuddyPress BuddyPress | 8.5 | Oct 29 | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability |
| CVE-2026-115967 New | LW Login with phone number Hamid Alinia | 8.8 | Oct 29 | WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability |
| CVE-2026-115963 New | BL Broadcast Live Video VideoWhisper.com | 7.1 | Oct 29 | WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability |
| CVE-2026-33924 New | CM CMC Nozomi Networks | 7.2 | Oct 29 | Authenticated RCE in update functionality in Guardian/CMC before 26.4.0 |
| CVE-2026-33923 New | CM CMC Nozomi Networks | 7.2 | Oct 29 | Update bundle signature bypass in Guardian/CMC before 26.4.0 |
| CVE-2026-111417 New | FO foxit.com Foxit Software Inc. | 7.5 | Oct 29 | Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service |
| CVE-2026-111418 New | FO foxit.com Foxit Software Inc. | 7.5 | Oct 29 | SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service |
| CVE-2026-111419 New | FO foxit.com Foxit Software Inc. | 8.6 | Oct 29 | Hardcoded API Token in Foxit Official Website |
| CVE-2026-117611 New | CH Checkmk Checkmk GmbH | 7.1 | Oct 29 | Trust of compromised eMudhra root CA in bundled CA stores |
| CVE-2026-107743 New | MW Mapster WP Maps mapster | 7.2 | Oct 29 | Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter |
| CVE-2025-62841 New | H3 HBS 3 Hybrid Backup Sync QNAP Systems Inc. | 8.7 | Oct 29 | Hard-coded Cryptographic Key #2 |
| CVE-2025-62839 New | H3 HBS 3 Hybrid Backup Sync QNAP Systems Inc. | 8.7 | Oct 29 | Hard-coded Cryptographic Key #1 |
| CVE-2026-114488 New | RH Red Hat Fuse 7 Red Hat | 7.4 | Oct 29 | Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding |
| CVE-2026-15564 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 7.4 | Oct 29 | Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization |
| CVE-2026-86794 New | CE Community Events | 8.8 | Oct 29 | Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form |
| CVE-2026-111739 New | AS All-In-One Security (AIOS) | 7.5 | Oct 29 | Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter |
| CVE-2026-89216 New | VT vTables | 8.6 | Oct 29 | vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter |
| CVE-2026-115301 New | CF Contact Form by Supsystic | 7.2 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block |
| CVE-2026-118905 New | NV nvm nvm-sh | 7.0 | Oct 29 | nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed |
| CVE-2026-93757 New | WA Wild Apricot Login wild-apricot | 7.5 | Oct 29 | Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite |
| CVE-2026-96228 New | SW SSL Wireless SMS Notification sslplugins | 8.1 | Oct 29 | SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover |
| CVE-2026-96666 New | SA Schema App Structured Data vberkel | 7.2 | Oct 29 | Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter |
| CVE-2026-93904 New | SW Social Web Suite – Social Media Auto Post, Social Media Auto Publish dejanmarkovic | 7.5 | Oct 29 | Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter |
| CVE-2026-93855 New | SN SendPress Newsletters brewlabs | 7.5 | Oct 29 | SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter |
| CVE-2026-96669 New | FS Food Store – Online Food Delivery & Pickup wpscripts | 7.2 | Oct 29 | Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie |
| CVE-2026-96741 New | DA DSGVO All in one for WP mlfactory | 7.2 | Oct 29 | DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption |
| CVE-2026-113387 New | OR ortto canva | 8.6 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML |
| CVE-2026-66090 New | OP openEQUELLA Apereo Foundation | 7.1 | Oct 29 | XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read |
| CVE-2026-21157 New | BI Bixby Samsung Mobile | 8.3 | Oct 29 | Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity |
| CVE-2026-107047 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data |
| CVE-2026-107020 New | Product not mapped yet | 7.5 | Oct 29 | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL |
| CVE-2026-107052 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via… |
| CVE-2026-107042 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via… |
| CVE-2026-107037 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note… |
| CVE-2026-107026 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content |
| CVE-2026-85749 New | MA MailWatch mailwatch | 8.1 | Oct 28 | MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail |
| CVE-2026-61569 New | AV AVideo-Encoder WWBN | 7.5 | Oct 28 | AVideo-Encoder: pre-authentication streamer-login SQL injection |
| CVE-2026-54453 New | OP OpenCATS opencats | 7.2 | Oct 28 | OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional) |
| CVE-2026-61571 New | AV AVideo-Encoder WWBN | 7.3 | Oct 28 | AVideo-Encoder: missing authentication on control and status endpoints |
| CVE-2026-61572 New | AV AVideo-Encoder WWBN | 8.6 | Oct 28 | AVideo-Encoder: unauthenticated full-response server-side request forgery |
| CVE-2026-54455 New | OP OpenCATS opencats | 7.6 | Oct 28 | OpenCATS: Authenticated SQL injection in activity DataGrid date filters |
| CVE-2026-93851 New | MA Mattermost Mattermost | 8.0 | Oct 28 | Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post |
| CVE-2026-61546 New | AN anki-mcp-server-addon ankimcp | 8.8 | Oct 28 | AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools |
| CVE-2026-118804 New | BB Bricks Builder Bricks | 7.5 | Oct 28 | Bricks Broken Access Control via query_result Endpoint |
| CVE-2026-118803 New | BT Bricks Theme Bricks | 7.5 | Oct 28 | Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result |
| CVE-2026-118755 New | PE personal-management-system Volmarg | 7.2 | Oct 28 | Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path |