CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 16:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119049 New | FR FreeMail idinging | 7.6 | Oct 29 | FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming |
| CVE-2026-119048 New | JE JeeSite thinkgem | 4.2 | Oct 29 | JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module |
| CVE-2019-25781 New | MA Markdown Python-Markdown | 7.5 | Oct 29 | Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing |
| CVE-2026-42707 New | HC HivePress Claim Listings HivePress | 4.3 | Oct 29 | WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2026-48195 New | PP PDF Poster bPlugins | 6.5 | Oct 29 | WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-113691 New | BI BMC IT Service Management Suite BMC | 5.1 | Oct 29 | Stored Cross-Site Scripting in BMC ITSM Knowledge Articles |
| CVE-2026-39741 New | SC Simple Cloudflare Turnstile RelyWP | 5.3 | Oct 29 | WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability |
| CVE-2026-48196 New | KF Kali Forms Kaliforms | 6.5 | Oct 29 | WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-22386 New | WJ WP Job Portal Ahmad | 4.3 | Oct 29 | WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability |
| CVE-2026-52709 New | VG Video Gallery Block bPlugins | 6.5 | Oct 29 | WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-113690 New | BI BMC IT Service Management Suite BMC | 4.8 | Oct 29 | Stored Cross-Site Scripting in BMC ITSM Attachments |
| CVE-2026-113689 New | BI BMC IT Service Management Suite BMC | 5.1 | Oct 29 | Stored Cross-Site Scripting in BMC ITSM Work Notes |
| CVE-2026-24533 New | CB Cozy Blocks CozyThemes | 6.5 | Oct 29 | WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-42703 New | KF Kali Forms Kaliforms | 6.5 | Oct 29 | WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability |
| CVE-2026-113688 New | BI BMC IT Service Management Suite BMC | 5.3 | Oct 29 | Server-Side Request Forgery in BMC ITSM SmartIT |
| CVE-2026-118087 New | SR Site Reviews Gemini Labs | 6.5 | Oct 29 | WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-118094 New | AI Ad Inserter Igor Funa | 6.5 | Oct 29 | WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-39735 New | JE JetEngine Crocoblock | 6.5 | Oct 29 | WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability |
| CVE-2026-56056 New | TP The Post Grid Mamunur Rashid | 6.5 | Oct 29 | WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-118093 New | PF Product Feed Manager WPFunnels Team | 5.3 | Oct 29 | WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability |
| CVE-2026-93006 New | RH Red Hat Ceph Storage 9 Red Hat | 6.8 | Oct 29 | Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content |
| CVE-2026-93007 New | RH Red Hat Ceph Storage 9 Red Hat | 5.3 | Oct 29 | Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation |
| CVE-2026-93011 New | RH Red Hat Ceph Storage 9 Red Hat | 5.3 | Oct 29 | Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms |
| CVE-2026-49142 New | OP openemr openemr | 8.8 | Oct 29 | OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[] |
| CVE-2026-93008 New | RH Red Hat Ceph Storage 9 Red Hat | 6.8 | Oct 29 | Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations |
| CVE-2026-119028 New | OA oapi-codegen oapi-codegen | 8.8 | Oct 29 | oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values |
| CVE-2026-119027 New | OA oapi-codegen oapi-codegen | 7.5 | Oct 29 | oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension |
| CVE-2026-109822 New | NW NWR100 Yamaha Corporation | 6.5 | Oct 29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information |
| CVE-2026-97854 New | NW NWR100 Yamaha Corporation | 9.8 | Oct 29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability |
| CVE-2026-103665 New | YL Yamaha LAN Monitor for Windows Yamaha Corporation | 7.8 | Oct 29 | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs) |
| CVE-2026-97860 New | YM YMS-VPN8 Yamaha Corporation | 6.7 | Oct 29 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths |
| CVE-2026-27401 New | YP YITH PayPal Express Checkout for WooCommerce YITH | 5.3 | Oct 29 | WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability |
| CVE-2026-115821 New | NE NewsmanApp newsmanapp | 7.2 | Oct 29 | NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters |
| CVE-2026-110184 New | NE Newsmatic blazethemes | 7.5 | Oct 29 | Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter |
| CVE-2026-92086 New | MW MW WP Form websoudan | 5.3 | Oct 29 | MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter |
| CVE-2026-109216 New | MB Meta Box – A Framework for Dynamic Websites metabox | 4.9 | Oct 29 | Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys |
| CVE-2026-96767 New | NU NEX-Forms – Ultimate Forms Plugin for WordPress webaways | 7.2 | Oct 29 | NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header |
| CVE-2026-119025 New | OP opencode anomalyco | 7.5 | Oct 29 | open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows |
| CVE-2026-5702 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application |
| CVE-2026-5700 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5699 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5698 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5697 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-115611 New | TA TableOn PluginUs.Net | 7.1 | Oct 29 | WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115964 New | MO Motors StylemixThemes | 9.3 | Oct 29 | WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability |
| CVE-2026-115962 New | MY myCred myCred | 4.3 | Oct 29 | WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability |
| CVE-2026-115592 New | OC OceanWP OceanWP | 7.1 | Oct 29 | WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-116409 New | UO Upsell Order Bump Offer for WooCommerce WP Swings | 7.1 | Oct 29 | WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112827 New | HD HANDMADE – Dropshipping for Etsy and WooCommerce VillaTheme | 7.1 | Oct 29 | WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability |
| CVE-2026-114193 New | GM GEO my WordPress Eyal Fitoussi | 7.5 | Oct 29 | WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability |