CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 15:10 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59979 New | YO Yosemite-Crew YosemiteCrew | 8.3 | Oct 28 | YosemiteCrew: Missing organization authorization on service and PMS library/template routes |
| CVE-2026-112357 New | GK GFI KerioConnect GFI USA, LLC | 7.8 | Oct 28 | GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation |
| CVE-2026-67187 New | NF Ninja Forms Saturday Drive | 7.1 | Oct 28 | Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields |
| CVE-2026-93520 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write |
| CVE-2026-93519 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server XFixes Pointer Barrier Event List Buffer Overflow |
| CVE-2026-93518 New | XO xorg-x11-server x.org | 7.8 | Oct 28 | X.Org Server XKB ResizeKeyType Numeric Truncation |
| CVE-2026-115603 New | AA Advanced Ads – Tracking Advanced Ads GmbH | 8.5 | Oct 28 | WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability |
| CVE-2026-116390 New | FE Filter Everything — WordPress & WooCommerce Filters stepasyuk | 7.2 | Oct 28 | WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability |
| CVE-2026-116389 New | PM Phoenix Media Rename crossi72 | 8.8 | Oct 28 | WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability |
| CVE-2026-115590 New | DO Dokan weDevs | 7.2 | Oct 28 | WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability |
| CVE-2026-116078 New | BA bandit mtrudel | 8.7 | Oct 28 | HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit |
| CVE-2026-52729 New | XI xibo-cms xibosignage | 7.1 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion |
| CVE-2026-93517 New | XW xwayland x.org | 8.5 | Oct 28 | X.Org Server GLX RenderLarge Heap Buffer Overflow |
| CVE-2026-59185 New | ID identrail identrail | 8.5 | Oct 28 | identrail: Cross-tenant GitHub installation binding without ownership verification |
| CVE-2026-59179 New | OP openhop naorsabag | 8.3 | Oct 28 | OpenHop: Path Traversal in Flow ID File Operations |
| CVE-2026-59177 New | DE device-builder esphome | 8.8 | Oct 28 | ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces |
| CVE-2026-59176 New | FU functype jordanburke | 7.8 | Oct 28 | Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import |
| CVE-2026-59172 New | JO joker candid82 | 7.8 | Oct 28 | Joker linter executed project-local .jokerd/linter.* files during linting |
| CVE-2026-59164 New | NO nora getnora-io | 7.1 | Oct 28 | NORA missing cross-user token-management authorization |
| CVE-2026-116391 New | GL GS Logo Slider GS Plugins | 8.8 | Oct 28 | WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability |
| CVE-2026-116392 New | AC Accordion PickPlugins | 7.2 | Oct 28 | WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability |
| CVE-2026-116393 New | OE Optima Express iHomefinder, Inc. | 7.5 | Oct 28 | WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability |
| CVE-2026-111850 New | BU BuddyPress BuddyPress | 8.5 | Oct 28 | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability |
| CVE-2026-115612 New | SL SliceWP iova.mihai | 7.1 | Oct 28 | WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115591 New | CF Contact Form by Supsystic Supsystic | 7.5 | Oct 28 | WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability |
| CVE-2026-115593 New | UE Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Unlimited Elements | 7.1 | Oct 28 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115596 New | EP eCommerce Product Catalog impleCode | 7.1 | Oct 28 | WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115606 New | DT DXP ToolKit Crowd Favorite | 7.1 | Oct 28 | WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115609 New | GE GetPaid Stiofan | 7.1 | Oct 28 | WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-118037 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing |
| CVE-2026-118036 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering |
| CVE-2026-118035 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing |
| CVE-2026-118040 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing |
| CVE-2026-118039 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing |
| CVE-2026-118038 New | TD Telerik Document Processing Libraries Progress Software | 7.1 | Oct 28 | Path Traversal in Telerik Document Processing Libraries AI Agent Tools |
| CVE-2026-67073 New | BA BigFix AEX HCL Software | 8.6 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-102790 New | IE iCagenda extension for Joomla icagenda.com | 8.6 | Oct 28 | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 |
| CVE-2026-118485 New | AX Axel Axel Download Accelerator | 8.1 | Oct 28 | Axel Download Accelerator Path Traversal via URL Filename Decoding |
| CVE-2026-6064 New | AA Avast Antivirus Gen Digital | 7.3 | Oct 28 | Norton, Avast, and AVG local privilege escalation via link following in Data Shredder |
| CVE-2026-110541 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-110540 New | PD PowerProtect Data Domain Management Center Dell | 7.1 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-103779 New | PD PowerProtect Data Domain Dell | 8.3 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-112198 New | ND NoviGest Desktop App Tactis | 8.3 | Oct 28 | Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App |
| CVE-2026-87102 New | AC Acronis Cyber Protect 17 Acronis | 7.4 | Oct 28 | Sensitive information disclosure and manipulation due to improper token validation |
| CVE-2025-30414 New | AC Acronis Cyber Protect 17 Acronis | 7.1 | Oct 28 | Local privilege escalation due to improper authentication |
| CVE-2026-87103 New | AC Acronis Cyber Protect 17 Acronis | 7.4 | Oct 28 | Sensitive information disclosure and manipulation due to improper token validation |
| CVE-2026-86377 New | PD PowerProtect Data Domain Dell | 7.6 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86378 New | PD PowerProtect Data Domain Dell | 8.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86379 New | PD PowerProtect Data Domain Management Center Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-86380 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |