CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 07:05 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-100276 | YO YouTrack JetBrains | 7.5 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action |
| CVE-2026-100262 | YO YouTrack JetBrains | 7.1 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates |
| CVE-2026-100256 | II IntelliJ IDEA JetBrains | 7.8 | Sep 30 | In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects |
| CVE-2026-100254 | TE TeamCity JetBrains | 8.8 | Sep 30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings |
| CVE-2026-100253 | TE TeamCity JetBrains | 8.8 | Sep 30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL |
| CVE-2026-103229 | RE Restaurant-Management-System AdithyaYelloju | 7.3 | Sep 30 | AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection |
| CVE-2026-103398 | OP OpenSave Liquid-co | 8.1 | Sep 30 | OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path |
| CVE-2026-103270 | LI LightLLM ModelTC | 7.5 | Sep 30 | LightLLM through 1.2.0 Missing Authentication on RL Control Routes |
| CVE-2026-102984 | AS astro withastro | 8.2 | Sep 30 | Astro: Malformed port in the Host header can crash the Node adapter |
| CVE-2026-102717 | ND NetX Duo Eclipse Foundation | 7.5 | Sep 30 | MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash |
| CVE-2026-47097 | HP HELO Plus AJA Video Systems | 7.5 | Sep 30 | AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle |
| CVE-2026-18783 | TM Trex MES Trex Digital Smart Manufacturing Systems Inc. | 8.8 | Sep 30 | Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES |
| CVE-2026-101295 | AI Assisted Installer for Red Hat OpenShift Container Platform 2 Red Hat | 7.3 | Sep 30 | Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction |
| CVE-2026-62097 | BD Business Directory WPTasty | 7.6 | Sep 30 | WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability |
| CVE-2026-102398 | PB Popup by Supsystic supsystic | 7.1 | Sep 30 | WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-102396 | UM Ultimate Maps by Supsystic supsystic | 7.1 | Sep 30 | WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-102395 | EG Easy Google Maps supsystic | 7.1 | Sep 30 | WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-102385 | NF Ninja Forms Kevin Stover | 7.1 | Sep 30 | WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-100507 | ID If-So Dynamic Content Personalization If-So Dynamic Content | 7.1 | Sep 30 | WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97293 | ML Media LIbrary Assistant David Lingren | 8.5 | Sep 30 | WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability |
| CVE-2026-97289 | QA Quiz And Survey Master ExpressTech | 7.1 | Sep 30 | WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97287 | ET Event Tickets Liquid Web / StellarWP | 8.5 | Sep 30 | WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability |
| CVE-2026-97272 | PP Premmerce Permalink Manager for WooCommerce Premmerce | 7.1 | Sep 30 | WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97271 | WP WPFunnels WPFunnels | 7.1 | Sep 30 | WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97253 | LA LayerSlider Kreatura | 7.1 | Sep 30 | WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97250 | GM Geo Mashup Dylan Kuhn | 7.1 | Sep 30 | WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97245 | SU SureCart SureCart | 7.2 | Sep 30 | WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability |
| CVE-2026-97244 | CL Creator LMS WPFunnels | 7.5 | Sep 30 | WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability |
| CVE-2026-97241 | BA BackupEase PrecisionWP | 7.5 | Sep 30 | WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability |
| CVE-2026-97240 | SB StifLi Backup Tools Esteban | 7.5 | Sep 30 | WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability |
| CVE-2026-97237 | JE JetEngine Crocoblock | 7.1 | Sep 30 | WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97235 | TA ThemeREX Addons ThemeRex | 7.1 | Sep 30 | WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97197 | WB WordPress Backup & Migration WebToffee | 7.5 | Sep 30 | WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability |
| CVE-2026-97077 | AI Ad Inserter Spacetime | 7.1 | Sep 30 | WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97065 | HA Happyforms Happyforms | 7.1 | Sep 30 | WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96838 | BM Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification YoOhw Studio | 8.8 | Sep 30 | WordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-96837 | CA CartFlows Brainstorm Force | 8.8 | Sep 30 | WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-96836 | PD Parsi Date Morteza Geransayeh | 7.1 | Sep 30 | WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96833 | UA Ultimate Addons for Contact Form 7 Themefic | 7.2 | Sep 30 | WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.51 - PHP Object Injection vulnerability |
| CVE-2026-96832 | CE Content Egg keywordrush | 7.2 | Sep 30 | WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability |
| CVE-2026-96831 | TB Themify Builder themifyme | 8.8 | Sep 30 | WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability |
| CVE-2026-96830 | GI GiveWP Nexcess | 7.1 | Sep 30 | WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96828 | CD Category Discount Woocommerce Vidish | 7.6 | Sep 30 | WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability |
| CVE-2026-96827 | AN Admin Notices Manager Melapress | 7.6 | Sep 30 | WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability |
| CVE-2026-96823 | CR Customer Reviews for WooCommerce CusRev | 7.5 | Sep 30 | WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability |
| CVE-2026-96820 | AS Awesome Support awesomesupport | 7.1 | Sep 30 | WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96819 | OI oik bobbingwide | 7.1 | Sep 30 | WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96818 | WE WP Express Checkout (Accept PayPal Payments) mra13 / Team Tips and Tricks HQ | 7.5 | Sep 30 | WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability |
| CVE-2026-96817 | MF MakeCommerce for WooCommerce MakeCommerce.net | 8.2 | Sep 30 | WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability |
| CVE-2026-96816 | TS Trusted Shops Easy Integration for WooCommerce vendidero | 7.1 | Sep 30 | WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability |