CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 13:20 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-97854 New | NW NWR100 Yamaha Corporation | 9.8 | Oct 29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability |
| CVE-2026-115964 New | MO Motors StylemixThemes | 9.3 | Oct 29 | WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability |
| CVE-2026-114358 New | RX Radius Xenia M2M Platform Radius Synergies | 9.3 | Oct 29 | SQL Injection Vulnerability in Radius Xenia M2M Platform |
| CVE-2026-115245 New | CA Chat AI with Dispatcher | 9.8 | Oct 29 | Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload |
| CVE-2026-113617 New | AI Automated Import Products to Cart | 9.9 | Oct 29 | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal |
| CVE-2026-113616 New | LA LogixFast Auth | 9.8 | Oct 29 | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset |
| CVE-2026-103693 New | FD Frontend Dashboard | 9.0 | Oct 29 | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection |
| CVE-2026-109516 New | BF Bot for Telegram on WooCommerce guruteam | 9.8 | Oct 29 | Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token |
| CVE-2026-42922 New | FR Frangoteam frangoteam | 9.8 | Oct 29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-66088 New | OP openEQUELLA Apereo Foundation | 9.4 | Oct 29 | Unrestricted Command Execution via system.execute |
| CVE-2026-118579 New | DI DIR-505 D-Link | 9.8 | Oct 28 | D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor |
| CVE-2026-61567 New | AV AVideo-Encoder WWBN | 10.0 | Oct 28 | AVideo-Encoder: unauthenticated command execution through streamer login trust |
| CVE-2026-61564 New | AV AVideo-Encoder WWBN | 10.0 | Oct 28 | AVideo-Encoder: unauthenticated installer PHP code injection |
| CVE-2026-118690 New | SI signalk-server SignalK | 9.8 | Oct 28 | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs |
| CVE-2026-117574 New | RH Red Hat OpenShift AI (RHOAI) Red Hat | 9.1 | Oct 28 | Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization |
| CVE-2026-63190 New | FE FearlessCMS fearlessgeekmedia | 9.4 | Oct 28 | FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS |
| CVE-2026-118264 New | EC echo labstack | 9.1 | Oct 28 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls |
| CVE-2026-103409 New | SS Session Smart Router Juniper Networks | 9.8 | Oct 28 | Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed |
| CVE-2026-103406 New | SS Session Smart Conductor Juniper Networks | 9.8 | Oct 28 | Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. |
| CVE-2026-44179 New | XW xwiki-pro-macros xwikisas | 9.9 | Oct 28 | XWiki Pro Macros: excerpt-include title and content injection executes code |
| CVE-2026-115968 New | UM Ultimate Member Ultimate Member | 9.8 | Oct 28 | WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability |
| CVE-2026-105420 New | WF Wing FTP Server Wing Soft Technology | 9.4 | Oct 28 | Path Traversal in Wing WFTP Server leading to Remote Code Execution |
| CVE-2026-111411 New | FA FunnelKit Automations Aman | 9.3 | Oct 28 | WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability |
| CVE-2026-115607 New | DT DXP ToolKit Crowd Favorite | 9.3 | Oct 28 | WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability |
| CVE-2026-115904 New | AP App topluyo | 9.6 | Oct 28 | Topluyo Desktop for Linux has an OS Command Injection issue |
| CVE-2026-67074 New | BA BigFix AEX HCL Software | 9.1 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-114278 New | EC Eclipse Che Eclipse Foundation | 9.8 | Oct 28 | Unauthenticated Command Injection via kubeconfig Username in che-machine-exec |
| CVE-2026-118477 New | KA Kalifast EISGE | 9.8 | Oct 28 | KaliFast Project Management Platform ei_git_repo_url OS Command Injection |
| CVE-2026-103792 New | PD PowerProtect Data Domain Management Center Dell | 9.6 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-103799 New | PD PowerProtect Data Domain Management Center Dell | 9.6 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-112197 New | ND NoviGest Desktop App Tactis | 9.4 | Oct 28 | Missing Authentication for Critical Function in Tactis' NoviGest Desktop App |
| CVE-2026-103780 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86384 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-14571 New | FS Futurum Software User Authentication Module Futurum Software | 9.1 | Oct 28 | SQL injection (SQLi) in the user authentication module of Futurum Software |
| CVE-2026-86397 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86400 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-90717 New | PD PowerProtect Data Domain Management Center Dell | 9.1 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-109218 New | CM Contact Manager kleor | 9.8 | Oct 28 | Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass |
| CVE-2026-103688 New | CF Checkout Files Upload for WooCommerce | 9.8 | Oct 28 | Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload |
| CVE-2026-104383 New | AQ Aquila EagleCloud | 9.4 | Oct 28 | Code injection in EagleCloud Aquila on-premises version |
| CVE-2026-84999 New | PR Pie Register Premium Pie Register | 9.8 | Oct 28 | Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler |
| CVE-2026-106013 New | JX Jupiter X Core artbees | 9.8 | Oct 28 | Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter |
| CVE-2026-110879 New | JA jackson-databind FasterXML | 9.8 | Oct 28 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) |
| CVE-2026-118312 New | CH Chrome Google | 9.6 | Oct 27 | Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118309 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
| CVE-2026-118308 New | CH Chrome Google | 9.6 | Oct 27 | Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118310 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
| CVE-2026-118342 New | CH Chrome Google | 9.6 | Oct 27 | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118316 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-118332 New | CH Chrome Google | 9.6 | Oct 27 | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… |