CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 21:04 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112838 New | VI VikRentCar e4jvikwp | 7.1 | Oct 23 | WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112821 New | KP Knit Pay Knit Pay | 6.5 | Oct 23 | WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability |
| CVE-2026-112825 New | CR Car Rental Manager Magepeople inc. | 6.5 | Oct 23 | WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2026-4952 New | WA WebOrderSystem (AuftragsManager) VertiGIS Ltd. | 5.1 | Oct 23 | Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem |
| CVE-2026-4951 New | WK WebOrderSystem (KundenManager) VertiGIS Ltd. | 5.1 | Oct 23 | Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem |
| CVE-2026-4950 New | WK WebOrderSystem (KundenManager) VertiGIS Ltd. | 4.8 | Oct 23 | Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem |
| CVE-2026-63244 New | Product not mapped yet | 9.8 | Oct 23 | Authentication Bypass Vulnerability |
| CVE-2026-75775 New | RO Router ASUS | 7.7 | Oct 23 | Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted… |
| CVE-2026-93489 New | RO Router ASUS | 8.7 | Oct 23 | Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform… |
| CVE-2026-75779 New | RO Router ASUS | 8.6 | Oct 23 | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick… |
| CVE-2026-63243 New | CS Creative Sound Blaster Katana V2, V2X, SE Creative Labs | 4.3 | Oct 23 | Firmware verification vulnerability |
| CVE-2026-55981 New | CS Creative Sound Blaster Katana V2, V2X, SE Creative Labs | 9.6 | Oct 23 | Firmware verification vulnerability |
| CVE-2026-94268 New | AC Advanced Custom Fields: Extended | 8.1 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action |
| CVE-2026-94267 New | AC Advanced Custom Fields: Extended | 9.0 | Oct 23 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action |
| CVE-2026-94264 New | AC Advanced Custom Fields: Extended | 6.8 | Oct 23 | Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes |
| CVE-2026-94262 New | AC Advanced Custom Fields: Extended | 8.1 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action |
| CVE-2026-113501 New | LC LiteSpeed Cache | 3.1 | Oct 23 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal |
| CVE-2026-113500 New | LC LiteSpeed Cache | 7.5 | Oct 23 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization |
| CVE-2026-113499 New | LC LiteSpeed Cache | 7.5 | Oct 23 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting |
| CVE-2026-113472 New | DP Depicter — Popup & Slider Builder | 5.4 | Oct 23 | Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload |
| CVE-2026-112230 New | PB Popup Builder | 3.7 | Oct 23 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter |
| CVE-2026-112219 New | DM Download Monitor | 4.9 | Oct 23 | Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route |
| CVE-2026-111982 New | UP User Profile Builder | 7.2 | Oct 23 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change |
| CVE-2026-111966 New | UP User Profile Builder | 6.8 | Oct 23 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute |
| CVE-2026-111738 New | SO Speed Optimizer | 5.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option |
| CVE-2026-111737 New | SO Speed Optimizer | 3.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists |
| CVE-2026-110537 New | EA Essential Addons for Elementor | 3.8 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action |
| CVE-2026-110510 New | EA Essential Addons for Elementor | 3.5 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag |
| CVE-2026-109936 New | OB Otter Blocks | 7.5 | Oct 23 | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter |
| CVE-2026-109935 New | OB Otter Blocks | 5.3 | Oct 23 | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API |
| CVE-2026-109934 New | OB Otter Blocks | 5.3 | Oct 23 | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API |
| CVE-2026-109933 New | OB Otter Blocks | 6.8 | Oct 23 | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes |
| CVE-2026-107858 New | AD Agent Development Kit (ADK) for Java Google | 7.2 | Oct 23 | Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server |
| CVE-2026-109198 New | CA CleanTalk Anti-Spam – Complete Spam Protection cleantalk | 7.2 | Oct 23 | Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter |
| CVE-2026-115497 New | MS Music Store – WordPress eCommerce codepeople | 7.5 | Oct 23 | Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter |
| CVE-2026-55835 New | LO lookyloo Lookyloo | 6.9 | Oct 23 | Lookyloo: Potential sub-system DoS due to parameter missmatch in notification |
| CVE-2026-86055 New | PA Part-DB-server Part-DB | 8.7 | Oct 23 | Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover |
| CVE-2026-86020 New | PA Part-DB-server Part-DB | 4.6 | Oct 23 | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports |
| CVE-2026-86019 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Attachment Size Limit Bypass via API Base64 Upload |
| CVE-2026-86018 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads |
| CVE-2026-59188 New | PA Part-DB-server Part-DB | 5.4 | Oct 23 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer |
| CVE-2026-55600 New | PA Part-DB-server Part-DB | 5.7 | Oct 23 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name |
| CVE-2026-54631 New | PA Part-DB-server Part-DB | 6.3 | Oct 23 | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie |
| CVE-2026-90458 New | IR Ironic OpenStack | 5.4 | Oct 23 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service |
| CVE-2026-54630 New | PA Part-DB-server Part-DB | 9.6 | Oct 23 | Part-DB: Authenticated RCE via .phar attachment upload served from public/media |
| CVE-2026-54615 New | PA Part-DB-server Part-DB | 6.0 | Oct 23 | Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) |
| CVE-2026-89419 New | IR Ironic OpenStack | 5.0 | Oct 23 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific… |
| CVE-2026-115638 New | IR Ironic OpenStack | 4.3 | Oct 23 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb |
| CVE-2026-115547 New | OA Okta Access Gateway Okta | 9.1 | Oct 23 | Command Execution via Admin Console Input in Okta Access Gateway |
| CVE-2026-115546 New | OA Okta Access Gateway Okta | 8.1 | Oct 23 | Authentication Source Verification Issue in Okta Access Gateway |