CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:29 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115942 New | AQ Apache Qpid Proton C Apache Software Foundation | – | Oct 29 | Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read |
| CVE-2026-114230 New | AQ Apache Qpid Proton C Apache Software Foundation | – | Oct 29 | Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames |
| CVE-2026-105042 New | AQ Apache Qpid Proton C Apache Software Foundation | – | Oct 29 | Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash |
| CVE-2026-105031 New | AQ Apache Qpid Proton C Apache Software Foundation | – | Oct 29 | Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. |
| CVE-2026-111417 New | FO foxit.com Foxit Software Inc. | 7.5 | Oct 29 | Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service |
| CVE-2026-111418 New | FO foxit.com Foxit Software Inc. | 7.5 | Oct 29 | SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service |
| CVE-2026-111419 New | FO foxit.com Foxit Software Inc. | 8.6 | Oct 29 | Hardcoded API Token in Foxit Official Website |
| CVE-2026-117611 New | CH Checkmk Checkmk GmbH | 7.1 | Oct 29 | Trust of compromised eMudhra root CA in bundled CA stores |
| CVE-2026-111318 New | HM HT Mega Addons for Elementor – Elementor Widgets & Template Builder devitemsllc | 5.4 | Oct 29 | HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink |
| CVE-2026-107743 New | MW Mapster WP Maps mapster | 7.2 | Oct 29 | Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter |
| CVE-2026-104727 New | SO Sequential Order Numbers for WooCommerce berocket | 6.4 | Oct 29 | Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys |
| CVE-2026-109215 New | LC LiteSpeed Cache litespeedtech | 6.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization |
| CVE-2026-107627 New | GA Greenshift – animation and page builder blocks wpsoul | 5.4 | Oct 29 | Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block |
| CVE-2026-107629 New | GA Greenshift – animation and page builder blocks wpsoul | 5.4 | Oct 29 | Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText |
| CVE-2026-110707 New | RA RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator themeisle | 4.7 | Oct 29 | RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element |
| CVE-2026-103875 New | ML Media Library Assistant dglingren | 4.7 | Oct 29 | Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links |
| CVE-2026-103485 New | EF Extensions for Leaflet Map hupe13 | 5.4 | Oct 29 | Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property |
| CVE-2026-88941 New | AS Administration Server Kaspersky | 8.4 | Oct 29 | Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center |
| CVE-2026-85498 New | RH Red Hat Enterprise Linux 10 Red Hat | 3.5 | Oct 29 | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow |
| CVE-2026-7190 New | II ICT Innovations’ PHP-CGI/PHP-FPM configuration ICT Innovations | 5.1 | Oct 29 | Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration |
| CVE-2026-114358 New | RX Radius Xenia M2M Platform Radius Synergies | 9.3 | Oct 29 | SQL Injection Vulnerability in Radius Xenia M2M Platform |
| CVE-2026-115303 New | CF Contact Form by Supsystic | 3.7 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping |
| CVE-2025-62841 New | H3 HBS 3 Hybrid Backup Sync QNAP Systems Inc. | 8.7 | Oct 29 | Hard-coded Cryptographic Key #2 |
| CVE-2025-62839 New | H3 HBS 3 Hybrid Backup Sync QNAP Systems Inc. | 8.7 | Oct 29 | Hard-coded Cryptographic Key #1 |
| CVE-2026-118030 New | RH Red Hat Build of Keycloak Red Hat | 4.2 | Oct 29 | Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins |
| CVE-2026-117859 New | RH Red Hat Build of Keycloak Red Hat | 5.4 | Oct 29 | Keycloak-services: keycloak-services: par single-use bypass via flow restart |
| CVE-2026-117688 New | RH Red Hat Build of Keycloak Red Hat | 5.3 | Oct 29 | Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration |
| CVE-2026-117548 New | RH Red Hat Directory Server 11 Red Hat | 6.5 | Oct 29 | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service |
| CVE-2026-117627 New | RH Red Hat Build of Keycloak Red Hat | 5.4 | Oct 29 | Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions |
| CVE-2026-114488 New | RH Red Hat Fuse 7 Red Hat | 7.4 | Oct 29 | Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding |
| CVE-2026-19610 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 6.5 | Oct 29 | Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean |
| CVE-2026-15564 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 7.4 | Oct 29 | Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization |
| CVE-2026-86794 New | CE Community Events | – | Oct 29 | Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form |
| CVE-2026-85007 New | VP Video Player for YouTube | – | Oct 29 | YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax |
| CVE-2026-115259 New | PE Photo Engine (Media Organizer & Lightroom) | – | Oct 29 | Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR |
| CVE-2026-115245 New | CA Chat AI with Dispatcher | – | Oct 29 | Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload |
| CVE-2026-114270 New | GE GeoDirectory | – | Oct 29 | GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure |
| CVE-2026-113617 New | AI Automated Import Products to Cart | – | Oct 29 | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal |
| CVE-2026-113616 New | LA LogixFast Auth | – | Oct 29 | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset |
| CVE-2026-111739 New | AS All-In-One Security (AIOS) | – | Oct 29 | Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter |
| CVE-2026-110983 New | WP WP Photo Album Plus | – | Oct 29 | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF |
| CVE-2026-110505 New | ES Enable SVG, WebP, and ICO Upload | – | Oct 29 | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass |
| CVE-2026-110504 New | ES Enable SVG, WebP, and ICO Upload | – | Oct 29 | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass |
| CVE-2026-110030 New | HP Hide Price Until Login | – | Oct 29 | Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration |
| CVE-2026-108763 New | WS Wallet System for WooCommerce | – | Oct 29 | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR |
| CVE-2026-108686 New | WP WP Post Author | – | Oct 29 | WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure |
| CVE-2026-108685 New | WP WP Post Author | – | Oct 29 | WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields |
| CVE-2026-105258 New | AB Appointment Booking Plugin | – | Oct 29 | LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings |
| CVE-2026-103693 New | FD Frontend Dashboard | – | Oct 29 | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection |
| CVE-2024-3586 New | LE LetterPress | – | Oct 29 | LetterPress < 2.4.0 - Admin+ Stored XSS |