CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 12:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109822 New | NW NWR100 Yamaha Corporation | 6.5 | Oct 29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information |
| CVE-2026-97860 New | YM YMS-VPN8 Yamaha Corporation | 6.7 | Oct 29 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths |
| CVE-2026-27401 New | YP YITH PayPal Express Checkout for WooCommerce YITH | 5.3 | Oct 29 | WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability |
| CVE-2026-92086 New | MW MW WP Form websoudan | 5.3 | Oct 29 | MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter |
| CVE-2026-109216 New | MB Meta Box – A Framework for Dynamic Websites metabox | 4.9 | Oct 29 | Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys |
| CVE-2026-5702 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application |
| CVE-2026-5700 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5699 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5698 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-5697 New | SA SABBATIC app SABBATIC | 4.8 | Oct 29 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application |
| CVE-2026-115962 New | MY myCred myCred | 4.3 | Oct 29 | WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability |
| CVE-2026-118989 New | PI Product Import Export for WooCommerce WebToffee | 5.5 | Oct 29 | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects |
| CVE-2026-118984 New | OM OmniRoute cheaper-inference | 5.5 | Oct 29 | OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login |
| CVE-2026-71569 New | AC Apache Camel Apache Software Foundation | 4.8 | Oct 29 | Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name |
| CVE-2026-111318 New | HM HT Mega Addons for Elementor – Elementor Widgets & Template Builder devitemsllc | 5.4 | Oct 29 | HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink |
| CVE-2026-91153 New | EF Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI wpeverest | 5.3 | Oct 29 | Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...}) |
| CVE-2026-116763 New | LC LiteSpeed Cache litespeedtech | 5.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace) |
| CVE-2026-104727 New | SO Sequential Order Numbers for WooCommerce berocket | 6.4 | Oct 29 | Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys |
| CVE-2026-109215 New | LC LiteSpeed Cache litespeedtech | 6.4 | Oct 29 | LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization |
| CVE-2026-91152 New | EF Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI wpeverest | 6.1 | Oct 29 | Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter |
| CVE-2026-107627 New | GA Greenshift – animation and page builder blocks wpsoul | 5.4 | Oct 29 | Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block |
| CVE-2026-107629 New | GA Greenshift – animation and page builder blocks wpsoul | 5.4 | Oct 29 | Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText |
| CVE-2026-110707 New | RA RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator themeisle | 4.7 | Oct 29 | RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element |
| CVE-2026-103875 New | ML Media Library Assistant dglingren | 4.7 | Oct 29 | Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links |
| CVE-2026-118192 New | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 6.5 | Oct 29 | JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute |
| CVE-2026-103485 New | EF Extensions for Leaflet Map hupe13 | 5.4 | Oct 29 | Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property |
| CVE-2026-88941 New | AS Administration Server Kaspersky | 5.2 | Oct 29 | Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center |
| CVE-2026-7190 New | II ICT Innovations’ PHP-CGI/PHP-FPM configuration ICT Innovations | 5.1 | Oct 29 | Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration |
| CVE-2026-118030 New | RH Red Hat Build of Keycloak Red Hat | 4.2 | Oct 29 | Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins |
| CVE-2026-117859 New | RH Red Hat Build of Keycloak Red Hat | 5.4 | Oct 29 | Keycloak-services: keycloak-services: par single-use bypass via flow restart |
| CVE-2026-117688 New | RH Red Hat Build of Keycloak Red Hat | 5.3 | Oct 29 | Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration |
| CVE-2026-117548 New | RH Red Hat Directory Server 11 Red Hat | 6.5 | Oct 29 | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service |
| CVE-2026-117627 New | RH Red Hat Build of Keycloak Red Hat | 5.4 | Oct 29 | Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions |
| CVE-2026-19610 New | RH Red Hat JBoss Enterprise Application Platform 7 Red Hat | 6.5 | Oct 29 | Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean |
| CVE-2026-115259 New | PE Photo Engine (Media Organizer & Lightroom) | 4.9 | Oct 29 | Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR |
| CVE-2026-114270 New | GE GeoDirectory | 5.3 | Oct 29 | GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure |
| CVE-2026-110983 New | WP WP Photo Album Plus | 4.3 | Oct 29 | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF |
| CVE-2026-110505 New | ES Enable SVG, WebP, and ICO Upload | 6.8 | Oct 29 | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass |
| CVE-2026-110504 New | ES Enable SVG, WebP, and ICO Upload | 6.8 | Oct 29 | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass |
| CVE-2026-110030 New | HP Hide Price Until Login | 5.3 | Oct 29 | Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration |
| CVE-2026-108763 New | WS Wallet System for WooCommerce | 4.3 | Oct 29 | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR |
| CVE-2026-88928 New | PF PAYCOMET for WooCommerce | 6.5 | Oct 29 | PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass |
| CVE-2026-78396 New | LL Link Library | 5.3 | Oct 29 | Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure |
| CVE-2026-78395 New | LL Link Library | 5.3 | Oct 29 | Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass |
| CVE-2026-115302 New | CF Contact Form by Supsystic | 5.3 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion |
| CVE-2026-115300 New | CF Contact Form by Supsystic | 4.3 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF |
| CVE-2026-115299 New | CF Contact Form by Supsystic | 5.4 | Oct 29 | Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF |
| CVE-2026-115282 New | RC Recipe Card Blocks Lite | 5.3 | Oct 29 | Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure |
| CVE-2026-93293 New | PP Password Protected – Protect Your Site Content With a Password saadiqbal | 6.4 | Oct 29 | Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler |
| CVE-2026-42949 New | FR Frangoteam frangoteam | 5.6 | Oct 29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809) |