CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 09:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-86388 New | PD PowerProtect Data Domain Dell | 5.3 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86392 New | PD PowerProtect Data Domain Dell | 4.9 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86393 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-14571 New | FS Futurum Software User Authentication Module Futurum Software | 9.1 | Oct 28 | SQL injection (SQLi) in the user authentication module of Futurum Software |
| CVE-2026-86394 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86395 New | PD PowerProtect Data Domain Virtual Edition Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0… |
| CVE-2026-86396 New | PD PowerProtect Data Domain Dell | 8.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86397 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86398 New | PD PowerProtect Data Domain Dell | 8.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86399 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86400 New | PD PowerProtect Data Domain Dell | 9.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86401 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90717 New | PD PowerProtect Data Domain Management Center Dell | 9.1 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-16020 New | DF DefterAsist Financial Advisor Platform Fazile BACAK | 5.4 | Oct 28 | Stored XSS Fazile BACAK's DefterAsist Financial Advisor Platform |
| CVE-2026-90719 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90720 New | PD PowerProtect Data Domain Dell | 6.7 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-90721 New | PD PowerProtect Data Domain Dell | 3.4 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-90723 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-90724 New | PD PowerProtect Data Domain Management Center Dell | 2.7 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-118435 New | Product not mapped yet | 5.4 | Oct 28 | Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation |
| CVE-2026-85655 New | EM Enable Media Replace shortpixel | 4.3 | Oct 28 | Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow |
| CVE-2026-101935 New | EK Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search echoplugins | 6.1 | Oct 28 | Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter |
| CVE-2026-92797 New | ME Memberpress MemberPress | 8.8 | Oct 28 | Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter |
| CVE-2026-63286 New | AC AXIS Camera Station 5 Axis Communications AB | 7.1 | Oct 28 | Database backups are vulnerable to offline attacks |
| CVE-2026-109975 New | CB Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox cozythemes | 6.4 | Oct 28 | Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute |
| CVE-2026-76005 New | WI WP Inventory Manager chuck1982 | 6.5 | Oct 28 | WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute |
| CVE-2026-118169 New | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 4.9 | Oct 28 | Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter |
| CVE-2026-104743 New | TA Tainacan tainacan | 4.9 | Oct 28 | Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment |
| CVE-2026-76780 New | BA BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility rankingcoach | 6.3 | Oct 28 | BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation |
| CVE-2026-110185 New | BF Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More bitpressadmin | 5.9 | Oct 28 | Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters |
| CVE-2026-116750 New | VC VikRentCar Car Rental Management System e4jvikwp | 6.5 | Oct 28 | VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute |
| CVE-2026-109218 New | CM Contact Manager kleor | 9.8 | Oct 28 | Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass |
| CVE-2026-109370 New | DE Document Embedder – let visitors read files without downloading bplugins | 6.4 | Oct 28 | Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute |
| CVE-2026-77871 New | PS Post Snippets – Custom WordPress Code Snippets Customizer saadiqbal | 6.4 | Oct 28 | Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
| CVE-2026-107710 New | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 6.4 | Oct 28 | Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title |
| CVE-2026-109988 New | PA Product Addons for Woocommerce – Product Options with Custom Fields acowebs | 4.4 | Oct 28 | Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter |
| CVE-2026-2839 New | AC Advanced Custom Fields: Extended hwk-fr | 5.3 | Oct 28 | Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints |
| CVE-2026-116761 New | CM CMB2 jtsternberg | 5.4 | Oct 28 | CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form |
| CVE-2026-108366 New | EA easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution wpdevteam | 6.4 | Oct 28 | easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute |
| CVE-2026-110071 New | MB Mang Board kitae-park | 6.4 | Oct 28 | Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute |
| CVE-2026-111111 New | PS Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons bdthemes | 7.2 | Oct 28 | Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape |
| CVE-2026-111213 New | TT Travelly – Tour & Travel Booking Manager for WooCommerce magepeopleteam | 4.3 | Oct 28 | Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter |
| CVE-2026-116610 New | CL Clean Login hornero | 4.3 | Oct 28 | Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook |
| CVE-2026-116749 New | VC VikRentCar Car Rental Management System e4jvikwp | 6.4 | Oct 28 | VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute |
| CVE-2026-92098 New | WM Webheadcoder Multi-Step Forms for Contact Form 7 webheadllc | 6.1 | Oct 28 | Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter |
| CVE-2026-109980 New | RP Related Posts for WordPress barrykooij | 4.3 | Oct 28 | Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter |
| CVE-2026-104729 New | AF Avada (Fusion) Builder themefusion | 6.4 | Oct 28 | Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes |
| CVE-2026-118164 New | ID If-So Dynamic Content – Elementor & All Page Builders Personalization ifso | 6.4 | Oct 28 | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter |
| CVE-2026-100175 New | PO Postie wayneallen-1 | 5.4 | Oct 28 | Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink |
| CVE-2026-109384 New | TI The Innovative Form Builder – IvyForms melograno | 8.8 | Oct 28 | The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload |