CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 02:06 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114694 New | EM Events Manager Pixelite | 7.1 | Oct 24 | WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114693 New | AV All-in-One Video Gallery Plugins360 Labs | 6.5 | Oct 24 | WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-110892 New | SU SureDash Brainstorm Force | 6.5 | Oct 24 | WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability |
| CVE-2026-114697 New | QA QA Analytics QuarkA | 7.1 | Oct 24 | WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114178 New | WT W3 Total Cache Bold Grid | 7.1 | Oct 24 | WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114190 New | LC LiteSpeed Cache Hai Zheng / Lite Speed Cache | 5.9 | Oct 24 | WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability |
| CVE-2026-112866 New | PF Product Filter by WBW WPFactory | 9.3 | Oct 24 | WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability |
| CVE-2026-94075 New | NE Newsletters Tribulant Software | 9.8 | Oct 24 | WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability |
| CVE-2026-112869 New | WO We’re Open! Noah Hearle | 7.1 | Oct 24 | WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-111402 New | NE Newsletters Tribulant Software | 9.3 | Oct 24 | WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability |
| CVE-2026-112844 New | WE WP Event Solution Arraytics | 7.1 | Oct 24 | WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114179 New | BB BP Better Messages wordplus | 7.1 | Oct 24 | WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115975 New | CE cervantes CervantesSec | 7.1 | Oct 24 | Broken access control in JiraController |
| CVE-2026-115803 New | SC Scada-LTS Scada-lts | 4.3 | Oct 24 | Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization |
| CVE-2026-115802 New | IN InternAgent InternScience | 4.3 | Oct 24 | InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere |
| CVE-2026-108013 New | BP BigFix Platform HCL Software | 6.8 | Oct 24 | HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID) |
| CVE-2026-114429 New | WP WPVR | 6.8 | Oct 24 | WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content |
| CVE-2026-113674 New | GE GeoDirectory | 3.7 | Oct 24 | GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification |
| CVE-2026-113673 New | GE GeoDirectory | 7.2 | Oct 24 | GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export |
| CVE-2026-113493 New | GE GeoDirectory | 6.8 | Oct 24 | GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute |
| CVE-2026-113492 New | GE GeoDirectory | 5.3 | Oct 24 | GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action |
| CVE-2026-113491 New | GE GeoDirectory | 6.4 | Oct 24 | GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal |
| CVE-2026-113490 New | GE GeoDirectory | 5.3 | Oct 24 | GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint |
| CVE-2026-113489 New | GE GeoDirectory | 4.3 | Oct 24 | GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR |
| CVE-2026-112207 New | DM Download Monitor | 7.1 | Oct 24 | Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link |
| CVE-2026-110956 New | AS asVereinbase | 9.8 | Oct 24 | asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation |
| CVE-2026-105199 New | PT Pixel Tag Manager for WooCommerce | 6.8 | Oct 24 | Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID |
| CVE-2026-97353 New | NK News Kit Addons For Elementor | 5.4 | Oct 24 | News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form |
| CVE-2026-97352 New | NK News Kit Addons For Elementor | 4.3 | Oct 24 | News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer |
| CVE-2026-107907 New | MV MAS Videos | 6.5 | Oct 24 | MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist |
| CVE-2026-87835 New | FE Front End Users | 6.5 | Oct 24 | Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment |
| CVE-2026-107887 New | AT Advanced Twenty Seventeen | 5.4 | Oct 24 | Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme |
| CVE-2026-115806 New | PM Prime Mover – Backup and Migration codexonics | 9.8 | Oct 24 | Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace |
| CVE-2026-115807 New | UP User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor cozmoslabs | 7.1 | Oct 24 | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute |
| CVE-2026-115929 New | CO Compass MongoDB, Inc. | 6.8 | Oct 24 | MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs |
| CVE-2026-115931 New | PO postiz-app GitroomHQ | 9.9 | Oct 23 | Arbitrary file read and backend crash through unrestricted provider method calls |
| CVE-2026-115938 New | CM cms craftcms | 8.8 | Oct 23 | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE |
| CVE-2026-115937 New | CO commerce-mollie craftcms | 7.5 | Oct 23 | Unauthenticated payment reuse allows unpaid orders to be marked as paid |
| CVE-2026-115801 New | KH khaiii Kakao | 5.3 | Oct 23 | Kakao khaiii JSON Config File Linear.cpp open out-of-bounds |
| CVE-2026-115935 New | CM cms craftcms | 8.8 | Oct 23 | Control panel only API response emulation replaces "securityKey" and reaches server RCE |
| CVE-2026-115897 New | SE serialize-javascript yahoo | 2.1 | Oct 23 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body |
| CVE-2026-115895 New | HA happy-dom capricorn86 | 8.8 | Oct 23 | Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution |
| CVE-2026-115893 New | WA wasmtime bytecodealliance | 9.9 | Oct 23 | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction |
| CVE-2026-115892 New | WA wasmtime bytecodealliance | 5.7 | Oct 23 | Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type |
| CVE-2026-115889 New | WA wasmtime bytecodealliance | 9.9 | Oct 23 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation |
| CVE-2026-115887 New | GR graphql-scalars graphql-hive | 7.5 | Oct 23 | graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service |
| CVE-2026-115886 New | ML mlflow mlflow | 6.5 | Oct 23 | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints |
| CVE-2026-115885 New | LA langgraph langchain-ai | 4.1 | Oct 23 | LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output |
| CVE-2026-115883 New | LA langgraph langchain-ai | 6.0 | Oct 23 | LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores |
| CVE-2026-113951 New | CO Container Apple | – | Oct 23 | If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf |