CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 12:47 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-95165 | Product not mapped yet | 6.1 | Oct 5 | Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field |
| CVE-2026-95166 | Product not mapped yet | 5.4 | Oct 5 | In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload |
| CVE-2026-105171 | FO food-waste-management-system kishor-23 | 6.3 | Oct 4 | kishor-23 food-waste-management-system Role Attribute admin.php authorization |
| CVE-2026-105168 | FO food-waste-management-system kishor-23 | 6.3 | Oct 4 | kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection |
| CVE-2026-105165 | SE secrets-replicator devopspolis | 6.3 | Oct 4 | devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment |
| CVE-2026-105163 | CR crossplane-runtime crossplane | 5.3 | Oct 4 | crossplane crossplane-runtime ImageConfig client.go Get toctou |
| CVE-2026-105161 | AI aiir invariant-systems-ai | 5.3 | Oct 4 | invariant-systems-ai aiir Policy Gate signature verification |
| CVE-2026-104402 | MM Mindio Magic MCP farvisun | 4.3 | Oct 4 | WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability |
| CVE-2026-105224 | YE yeswiki YesWiki | 5.4 | Oct 4 | YesWiki before 4.6.7 Stored XSS via Bazar valeur Action |
| CVE-2026-105206 | ZI zitadel zitadel | 5.3 | Oct 4 | ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service |
| CVE-2026-105205 | SI siyuan siyuan-note | 5.3 | Oct 4 | SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo |
| CVE-2026-105157 | DO DocSys RainyGao | 4.3 | Oct 4 | RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal |
| CVE-2026-105146 | DI Discuz! Comsenz | 4.7 | Oct 4 | Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection |
| CVE-2026-105145 | VE Verba Weaviate | 5.3 | Oct 4 | Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure |
| CVE-2026-105144 | DR Drogon Drogon | 5.3 | Oct 4 | Drogon Static File Router StaticFileRouter.cc route path traversal |
| CVE-2026-105141 | CO cognee topoteretes | 6.3 | Oct 4 | topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials |
| CVE-2026-105137 | LA Laradock Laradock | 5.0 | Oct 4 | Laradock Build Process Dockerfile code download |
| CVE-2026-97332 | UP User Private Files | 5.3 | Oct 4 | User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite) |
| CVE-2026-86817 | FS Five Star Business Profile and Schema | 4.9 | Oct 4 | Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback |
| CVE-2026-104118 | RF Razorpay for WooCommerce | 5.3 | Oct 4 | Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR |
| CVE-2026-17005 | HS Horizontal scrolling announcements | 6.8 | Oct 4 | Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field |
| CVE-2026-105098 | CC CoinEx Crypto Omega Solution | 4.3 | Oct 4 | Omega Solution CoinEx Crypto Support Ticket API customer information disclosure |
| CVE-2026-105097 | CC CoinEx Crypto Omega Solution | 4.3 | Oct 4 | Omega Solution CoinEx Crypto Customer Information API customer-currency authorization |
| CVE-2026-105131 | EZ ezBookkeeping mayswind | 5.4 | Oct 4 | mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint |
| CVE-2026-105096 | CC CoinEx Crypto Omega Solution | 6.3 | Oct 4 | Omega Solution CoinEx Crypto Customer Profile API customer authorization |
| CVE-2026-105129 | LA laradashboard laradashboard | 6.5 | Oct 3 | LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API |
| CVE-2026-105128 | LA laradashboard laradashboard | 5.4 | Oct 3 | LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url |
| CVE-2026-105127 | LA laradashboard laradashboard | 5.3 | Oct 3 | LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints |
| CVE-2026-105124 | WC wcms vincent-peugnet | 6.1 | Oct 3 | W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments |
| CVE-2026-105122 | OP OpenAM OpenIdentityPlatform | 5.4 | Oct 3 | OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri |
| CVE-2026-105121 | OP OpenAM OpenIdentityPlatform | 4.9 | Oct 3 | OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping |
| CVE-2026-105120 | OP OpenAM OpenIdentityPlatform | 4.9 | Oct 3 | OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint |
| CVE-2026-105119 | OP OpenAM OpenIdentityPlatform | 6.8 | Oct 3 | OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows |
| CVE-2026-105118 | OP OpenAM OpenIdentityPlatform | 4.7 | Oct 3 | OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession |
| CVE-2026-105117 | OP OpenAM OpenIdentityPlatform | 6.1 | Oct 3 | OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions |
| CVE-2026-105116 | OP OpenAM OpenIdentityPlatform | 6.1 | Oct 3 | OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page |
| CVE-2026-105114 | OP OpenAM OpenIdentityPlatform | 6.1 | Oct 3 | OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page |
| CVE-2026-105113 | NE nezha nezhahq | 6.5 | Oct 3 | Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock |
| CVE-2026-105112 | NE nezha nezhahq | 5.3 | Oct 3 | Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints |
| CVE-2026-104983 | XR Xreader Linux Mint | 6.3 | Oct 3 | Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal |
| CVE-2026-18040 | BC BC-JAVA Legion of the Bouncy Castle Inc. | 5.9 | Oct 3 | HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler |
| CVE-2026-71892 | BC BC-FJA Legion of the Bouncy Castle Inc. | 6.9 | Oct 3 | CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys |
| CVE-2026-97873 | BC BC-JAVA Legion of the Bouncy Castle Inc. | 5.3 | Oct 3 | Legacy PBES1 and PKCS#12 PBE iteration count honoured unbounded in the raw JCA provider |
| CVE-2026-104982 | XR Xreader Linux Mint | 4.3 | Oct 3 | Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal |
| CVE-2026-92767 | TI Twenty20 Image Before-After zayedbaloch | 6.4 | Oct 3 | Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute |
| CVE-2026-100157 | WU WP Ultimate Review roxnor | 6.5 | Oct 3 | WP Ultimate Review <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) |
| CVE-2026-11601 | WR WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System arraytics | 5.3 | Oct 3 | WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete |
| CVE-2026-104313 | WE WPC Estimated Delivery Date for WooCommerce wpclever | 6.1 | Oct 3 | WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Reflected Cross-Site Scripting via 'rule_data' Parameter |
| CVE-2026-103519 | WU WP Ultimate Review roxnor | 5.4 | Oct 3 | WP Ultimate Review <= 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter |
| CVE-2026-93896 | WN WPFront Notification Bar syammohanm | 6.1 | Oct 3 | WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scripting via REQUEST_URI |