CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:18 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115713 New | EC Elastic Cloud Enterprise Elastic | 7.5 | Oct 29 | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification |
| CVE-2026-115712 New | EC Elastic Cloud Enterprise Elastic | 4.3 | Oct 29 | Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings |
| CVE-2026-115711 New | EC Elastic Cloud Enterprise Elastic | 6.4 | Oct 29 | Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure |
| CVE-2026-115709 New | EC Elastic Cloud Enterprise Elastic | 8.2 | Oct 29 | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss |
| CVE-2026-115708 New | EC Elastic Cloud Enterprise Elastic | 7.2 | Oct 29 | Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass |
| CVE-2026-115707 New | EC Elastic Cloud Enterprise Elastic | 6.4 | Oct 29 | Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation |
| CVE-2026-115706 New | EC Elastic Cloud Enterprise Elastic | 6.8 | Oct 29 | Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation |
| CVE-2026-39736 New | JE JetEngine Crocoblock | 8.5 | Oct 29 | WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability |
| CVE-2026-116402 New | SU SureForms Brainstorm Force | 5.3 | Oct 29 | WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability |
| CVE-2026-118425 New | RH Red Hat Build of Keycloak Red Hat | 6.8 | Oct 29 | Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback |
| CVE-2026-48202 New | BR Brave Brave | 5.3 | Oct 29 | WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability |
| CVE-2026-39782 New | KF Kali Forms Kaliforms | 5.3 | Oct 29 | WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability |
| CVE-2026-25467 New | UR User Registration ThemeGrill | 5.3 | Oct 29 | WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability |
| CVE-2026-116399 New | IC InstaWP Connect InstaWP | 8.8 | Oct 29 | WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-116857 New | JE JetSmartFilters Crocoblock | 6.5 | Oct 29 | WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-113697 New | BH BMC Helix Operations Management BMC | 4.8 | Oct 29 | Reflected Cross-Site Scripting in BMC Helix Operations Management |
| CVE-2026-113696 New | BI BMC IT Service Management Suite BMC | 5.3 | Oct 29 | Improper Authorization in BMC ITSM SmartIT Change Approvals |
| CVE-2026-113695 New | BI BMC IT Service Management Suite BMC | 4.8 | Oct 29 | Reflected Cross-Site Scripting in BMC ITSM SmartIT |
| CVE-2026-93009 New | RH Red Hat Ceph Storage 9 Red Hat | 4.3 | Oct 29 | Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder |
| CVE-2026-93010 New | RH Red Hat Ceph Storage 9 Red Hat | 4.3 | Oct 29 | Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check |
| CVE-2026-113694 New | BI BMC IT Service Management Suite BMC | 5.3 | Oct 29 | Improper Authorization in BMC ITSM SmartIT Attachments |
| CVE-2026-113693 New | BI BMC IT Service Management Suite BMC | 5.3 | Oct 29 | System Account Credential Disclosure in BMC ITSM |
| CVE-2026-54862 New | IA Import and export users and customers Codection | 6.5 | Oct 29 | WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-113692 New | BI BMC IT Service Management Suite BMC | 6.9 | Oct 29 | Path Traversal in BMC ITSM |
| CVE-2026-119054 New | MP Multiple Pages Generator by Themeisle Themeisle | 5.4 | Oct 29 | Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url |
| CVE-2026-119053 New | LW lwIP lwIP | 5.3 | Oct 29 | lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto() |
| CVE-2026-119052 New | LL llama.cpp ggml-org | 7.5 | Oct 29 | llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length |
| CVE-2026-119051 New | FL flat hughsk | 5.9 | Oct 29 | flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys |
| CVE-2026-119050 New | AG agno agno-agi | 8.1 | Oct 29 | Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection |
| CVE-2026-119049 New | FR FreeMail idinging | 7.6 | Oct 29 | FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming |
| CVE-2026-119048 New | JE JeeSite thinkgem | 4.2 | Oct 29 | JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module |
| CVE-2019-25781 New | MA Markdown Python-Markdown | 7.5 | Oct 29 | Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing |
| CVE-2026-42707 New | HC HivePress Claim Listings HivePress | 4.3 | Oct 29 | WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability |
| CVE-2026-48195 New | PP PDF Poster bPlugins | 6.5 | Oct 29 | WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-113691 New | BI BMC IT Service Management Suite BMC | 5.1 | Oct 29 | Stored Cross-Site Scripting in BMC ITSM Knowledge Articles |
| CVE-2026-39741 New | SC Simple Cloudflare Turnstile RelyWP | 5.3 | Oct 29 | WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability |
| CVE-2026-48196 New | KF Kali Forms Kaliforms | 6.5 | Oct 29 | WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-22386 New | WJ WP Job Portal Ahmad | 4.3 | Oct 29 | WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability |
| CVE-2026-52709 New | VG Video Gallery Block bPlugins | 6.5 | Oct 29 | WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-113690 New | BI BMC IT Service Management Suite BMC | 4.8 | Oct 29 | Stored Cross-Site Scripting in BMC ITSM Attachments |
| CVE-2026-113689 New | BI BMC IT Service Management Suite BMC | 5.1 | Oct 29 | Stored Cross-Site Scripting in BMC ITSM Work Notes |
| CVE-2026-24533 New | CB Cozy Blocks CozyThemes | 6.5 | Oct 29 | WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-42703 New | KF Kali Forms Kaliforms | 6.5 | Oct 29 | WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability |
| CVE-2026-113688 New | BI BMC IT Service Management Suite BMC | 5.3 | Oct 29 | Server-Side Request Forgery in BMC ITSM SmartIT |
| CVE-2026-118087 New | SR Site Reviews Gemini Labs | 6.5 | Oct 29 | WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-118094 New | AI Ad Inserter Igor Funa | 6.5 | Oct 29 | WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-39735 New | JE JetEngine Crocoblock | 6.5 | Oct 29 | WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability |
| CVE-2026-56056 New | TP The Post Grid Mamunur Rashid | 6.5 | Oct 29 | WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-118093 New | PF Product Feed Manager WPFunnels Team | 5.3 | Oct 29 | WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability |
| CVE-2026-93006 New | RH Red Hat Ceph Storage 9 Red Hat | 6.8 | Oct 29 | Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content |