CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 00:28 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112230 New | PB Popup Builder | 3.7 | Oct 23 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter |
| CVE-2026-112219 New | DM Download Monitor | 4.9 | Oct 23 | Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route |
| CVE-2026-111982 New | UP User Profile Builder | 7.2 | Oct 23 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change |
| CVE-2026-111966 New | UP User Profile Builder | 6.8 | Oct 23 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute |
| CVE-2026-111738 New | SO Speed Optimizer | 5.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option |
| CVE-2026-111737 New | SO Speed Optimizer | 3.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists |
| CVE-2026-110537 New | EA Essential Addons for Elementor | 3.8 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action |
| CVE-2026-110510 New | EA Essential Addons for Elementor | 3.5 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag |
| CVE-2026-109936 New | OB Otter Blocks | 7.5 | Oct 23 | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter |
| CVE-2026-109935 New | OB Otter Blocks | 5.3 | Oct 23 | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API |
| CVE-2026-109934 New | OB Otter Blocks | 5.3 | Oct 23 | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API |
| CVE-2026-109933 New | OB Otter Blocks | 6.8 | Oct 23 | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes |
| CVE-2026-107858 New | AD Agent Development Kit (ADK) for Java Google | 7.2 | Oct 23 | Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server |
| CVE-2026-109198 New | CA CleanTalk Anti-Spam – Complete Spam Protection cleantalk | 7.2 | Oct 23 | Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter |
| CVE-2026-115497 New | MS Music Store – WordPress eCommerce codepeople | 7.5 | Oct 23 | Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter |
| CVE-2026-55835 New | LO lookyloo Lookyloo | 6.9 | Oct 23 | Lookyloo: Potential sub-system DoS due to parameter missmatch in notification |
| CVE-2026-86055 New | PA Part-DB-server Part-DB | 8.7 | Oct 23 | Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover |
| CVE-2026-86020 New | PA Part-DB-server Part-DB | 4.6 | Oct 23 | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports |
| CVE-2026-86019 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Attachment Size Limit Bypass via API Base64 Upload |
| CVE-2026-86018 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads |
| CVE-2026-59188 New | PA Part-DB-server Part-DB | 5.4 | Oct 23 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer |
| CVE-2026-55600 New | PA Part-DB-server Part-DB | 5.7 | Oct 23 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name |
| CVE-2026-54631 New | PA Part-DB-server Part-DB | 6.3 | Oct 23 | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie |
| CVE-2026-90458 New | IR Ironic OpenStack | 5.4 | Oct 23 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service |
| CVE-2026-54630 New | PA Part-DB-server Part-DB | 9.6 | Oct 23 | Part-DB: Authenticated RCE via .phar attachment upload served from public/media |
| CVE-2026-54615 New | PA Part-DB-server Part-DB | 6.0 | Oct 23 | Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) |
| CVE-2026-89419 New | IR Ironic OpenStack | 5.0 | Oct 23 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific… |
| CVE-2026-115638 New | IR Ironic OpenStack | 4.3 | Oct 23 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb |
| CVE-2026-115547 New | OA Okta Access Gateway Okta | 9.1 | Oct 23 | Command Execution via Admin Console Input in Okta Access Gateway |
| CVE-2026-115546 New | OA Okta Access Gateway Okta | 8.1 | Oct 23 | Authentication Source Verification Issue in Okta Access Gateway |
| CVE-2026-115537 New | HO HospitalManagement gedelumbung | 4.3 | Oct 23 | gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect |
| CVE-2026-19678 New | OF onPhase Forms onPhase | 8.7 | Oct 23 | Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure |
| CVE-2026-19677 New | OF onPhase Forms onPhase | 9.3 | Oct 23 | Authentication Bypass Leading to Server-Side Command Execution |
| CVE-2026-115536 New | HO HospitalManagement gedelumbung | 4.3 | Oct 23 | gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting |