CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 16:26 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-86809 | PE Persian Elementor | 5.3 | Sep 11 | Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass |
| CVE-2026-85116 | SC Simple CAPTCHA with Cloudflare Turnstile | 6.5 | Sep 11 | Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation |
| CVE-2026-82215 | PG Payment Gateway PayPay for WooCommerce | 5.9 | Sep 11 | WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook |
| CVE-2026-82213 | NX Nexi XPay Build | 5.3 | Sep 11 | Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR |
| CVE-2026-77159 | RH Red Hat Enterprise Linux 10 Red Hat | 5.5 | Sep 11 | Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink |
| CVE-2026-87123 | HB hbs hbs | 5.9 | Sep 11 | hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping |
| CVE-2026-87859 | MO morgan morgan | 5.3 | Sep 11 | morgan vulnerable to Log Injection via unescaped double quote in quoted log fields |
| CVE-2026-87727 | AC a-blog cms appleple inc. | 6.5 | Sep 11 | a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product |
| CVE-2026-6640 | ML Media Library Assistant dglingren | 6.4 | Sep 11 | Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter |
| CVE-2026-6642 | ML Media Library Assistant dglingren | 6.4 | Sep 11 | Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import |
| CVE-2026-6641 | ML Media Library Assistant dglingren | 6.4 | Sep 11 | Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter |
| CVE-2026-89179 | WE WeenyGenius Howyar | 4.3 | Sep 11 | Howyar｜WeenyGenius - Missing Support for Integrity Check |
| CVE-2026-89175 | EH EH1000B Kingdom Communication Associated | 5.3 | Sep 11 | Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication |
| CVE-2026-89173 | EH EH1000B Kingdom Communication Associated | 5.3 | Sep 11 | Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure |
| CVE-2026-13326 | QT qt qt | 6.9 | Sep 11 | Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module |
| CVE-2026-86815 | BA BackWPup | 5.5 | Sep 11 | BackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes |
| CVE-2026-86812 | WP WPCafe | 6.5 | Sep 11 | WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API |
| CVE-2026-86782 | VI Visualizer | 5.5 | Sep 11 | Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR |
| CVE-2026-86781 | SZ SSL Zen — SSL Certificate Installer & HTTPS Redirects | 5.3 | Sep 11 | SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure |
| CVE-2026-86780 | FI Featured Image with URL | 6.8 | Sep 11 | Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text |
| CVE-2026-85678 | AB AI Builder | 6.8 | Sep 11 | AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript |
| CVE-2026-82305 | YW YITH WooCommerce Wishlist | 5.3 | Sep 11 | YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title |
| CVE-2026-14566 | AD advanced-customized-prompts | 4.3 | Sep 11 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering |
| CVE-2026-14565 | AD advanced-customized-prompts | 5.4 | Sep 11 | Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration |
| CVE-2026-14562 | TE teddy-bear-customize-addon | 5.3 | Sep 11 | Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure |
| CVE-2026-83546 | CO CoolClock | 6.8 | Sep 11 | CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute |
| CVE-2026-83545 | CO CoolClock | 6.8 | Sep 11 | CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON |
| CVE-2026-89169 | LI live-boot Debian | 4.1 | Sep 11 | live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing |
| CVE-2026-89160 | PC PCRE2 PCRE | 6.5 | Sep 11 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject |
| CVE-2026-89158 | PC PCRE2 PCRE | 6.5 | Sep 11 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write |
| CVE-2026-89156 | PC PCRE2 PCRE | 5.9 | Sep 11 | PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data |
| CVE-2026-78172 | TW Themify – WooCommerce Product Filter themifyme | 6.1 | Sep 11 | Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting |
| CVE-2026-7438 | BT Bold Timeline Lite boldthemes | 6.4 | Sep 11 | Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
| CVE-2026-18562 | HP HUSKY – Products Filter for WooCommerce Professional realmag777 | 6.1 | Sep 11 | HUSKY <= 1.4.3 - Reflected Cross-Site Scripting |
| CVE-2026-19985 | RA Relevanssi – A Better Search comesio | 6.1 | Sep 11 | Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting |
| CVE-2026-11446 | BA Booktics – Appointment Booking Calendar for Service Businesses arraytics | 5.3 | Sep 11 | Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization |
| CVE-2026-84960 | WM WP-Members Membership Plugin cbutlerjr | 6.1 | Sep 11 | WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting |
| CVE-2026-18964 | FC Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty premio | 6.1 | Sep 11 | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting |
| CVE-2026-11496 | PB PDF Builder for WooCommerce. Create invoices,packing slips and more edgarrojas | 6.5 | Sep 11 | Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure |
| CVE-2026-12215 | OL OTP Login & Register Woocommerce xootix | 5.3 | Sep 11 | OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force |
| CVE-2026-77150 | UE Unlimited Elements For Elementor unitecms | 6.1 | Sep 11 | Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting |
| CVE-2026-88914 | RH Red Hat Enterprise Linux 10 Red Hat | 4.4 | Sep 11 | Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser |
| CVE-2026-78129 | ST strongSwan strongSwan | 5.9 | Sep 11 | strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption |
| CVE-2026-78126 | ST strongSwan strongSwan | 5.9 | Sep 11 | strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin |
| CVE-2026-78123 | ST strongSwan strongSwan | 5.9 | Sep 11 | strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin |
| CVE-2026-89092 | GL glibc The GNU C Library | 4.2 | Sep 11 | Stack overflow in nscd due to unbounded alloca use |
| CVE-2026-89145 | FL flextype flextype | 4.2 | Sep 11 | Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory |
| CVE-2026-79035 | Product not mapped yet | 6.1 | Sep 11 | A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary Javascript in the… |
| CVE-2025-69904 | Product not mapped yet | 4.9 | Sep 11 | Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input |
| CVE-2026-84941 | OV OC200 v3 TP-Link Systems Inc. | 6.9 | Sep 10 | Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read |