CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 07:46 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-97663 | CR Customer Reviews for WooCommerce ivole | 7.2 | Oct 2 | Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name |
| CVE-2026-17507 | BC BC-JAVA Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender |
| CVE-2026-103604 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Quadratic-time escaping when converting X.509 distinguished names to strings |
| CVE-2026-103603 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Unbounded HSS public key level count allows huge array allocation during signature verification |
| CVE-2026-103601 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check |
| CVE-2026-103600 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Unbounded ASN.1 nesting depth causes process-terminating stack overflow |
| CVE-2026-63578 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Unbounded PBE iteration count when decrypting PKCS#8 private keys |
| CVE-2026-63577 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix |
| CVE-2026-63576 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | URI name constraints checked against a mis-parsed host |
| CVE-2026-63575 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count |
| CVE-2026-63574 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Unbounded allocation from OpenPGP signature and user attribute subpacket lengths |
| CVE-2026-63573 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap |
| CVE-2026-63572 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files |
| CVE-2026-63571 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Attribute certificate path validation does not verify the attribute certificate's signature |
| CVE-2026-63570 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links |
| CVE-2026-63568 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion |
| CVE-2026-63567 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | IesEngine block-cipher mode checks padding before MAC (CBC padding oracle) |
| CVE-2026-63566 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | DTLS handshake reassembler allocates buffer from unchecked 24-bit length |
| CVE-2026-16001 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | IesEngine stream-mode MAC forgery via length-dependent KDF split |
| CVE-2026-16000 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used |
| CVE-2026-15999 | BC bc-csharp Legion of the Bouncy Castle Inc. | 7.5 | Oct 2 | AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication |
| CVE-2026-102565 | BB BA Book Everything bookingalgorithms | 7.2 | Oct 2 | BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter |
| CVE-2026-91828 | OG OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | 7.5 | Oct 2 | OMGF < 6.3.11 - Unauthenticated DoS via do_optimize |
| CVE-2026-92174 | SW SiteOrigin Widgets Bundle gpriday | 7.5 | Oct 2 | SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter |
| CVE-2026-90438 | NF Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder kstover | 7.2 | Oct 2 | Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission |
| CVE-2026-15897 | SF Super Forms – Drag & Drop Form Builder WebRehab | 8.8 | Oct 2 | Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login |
| CVE-2026-92820 | NF Ninja Forms - File Uploads SaturdayDrive | 8.1 | Oct 2 | Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload |
| CVE-2026-10026 | CF CTX Feed Pro CTX | 7.2 | Oct 2 | CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution |
| CVE-2026-93367 | VT Visitor Traffic Real Time Statistics pro wp-buy | 7.2 | Oct 2 | Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title) |
| CVE-2026-104123 | OR Online Reviewer Management System SourceCodester | 7.3 | Oct 2 | SourceCodester Online Reviewer Management System btn_functions.php activity sql injection |
| CVE-2026-104120 | MC mcp-server-everything modelcontextprotocol | 7.3 | Oct 2 | modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery |
| CVE-2026-103098 | GV GV-Eye GeoVision Inc. | 7.5 | Oct 2 | GV-Eye Sensitive information exposure in URL query parameter Vulnerability |
| CVE-2026-103097 | GV GV-Eye GeoVision Inc. | 7.5 | Oct 2 | GV-Eye Relay Payment API Key Vulnerability |
| CVE-2026-103096 | GV GV-Eye GeoVision Inc. | 7.5 | Oct 2 | GV-Eye Hardcoded API Key Vulnerability |
| CVE-2026-51914 | Product not mapped yet | 8.8 | Oct 2 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller |
| CVE-2026-51907 | Product not mapped yet | 8.1 | Oct 2 | In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the… |
| CVE-2026-51901 | Product not mapped yet | 8.1 | Oct 2 | SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control |
| CVE-2026-67989 | Product not mapped yet | 7.5 | Oct 2 | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on… |
| CVE-2026-51916 | Product not mapped yet | 7.5 | Oct 2 | TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py |
| CVE-2026-51917 | Product not mapped yet | 7.3 | Oct 2 | FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code |
| CVE-2026-103766 | CL clipbucket-v5 MacWarrior | 7.2 | Oct 1 | ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter |
| CVE-2026-103761 | MO Mooncake kvcache-ai | 7.5 | Oct 1 | Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue |
| CVE-2026-86344 | RH Red Hat Directory Server 11 Red Hat | 7.5 | Oct 1 | 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue |
| CVE-2026-64893 | EN EasyIO NEO Johnson Controls | 7.3 | Oct 1 | - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack |
| CVE-2026-34494 | NS Neo Series MVP2 Johnson Controls | 7.2 | Oct 1 | - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations |
| CVE-2026-34493 | EF EasyIO FS32 Johnson Controls | 7.2 | Oct 1 | - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations |
| CVE-2026-104051 | PI pictshare HaschekSolutions | 8.2 | Oct 1 | PictShare < 3.7.1 Sensitive Information Disclosure via info API |
| CVE-2026-71452 | EF EasyIO FS32 Johnson Controls | 7.2 | Oct 1 | - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection |
| CVE-2026-104020 | IO ion-python Amazon | 7.5 | Oct 1 | Uncontrolled recursion in the Ion reader in Amazon Ion Python |
| CVE-2026-96780 | FI figlet.js patorjk | 8.2 | Oct 1 | figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width |