CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 01:03 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-94499 | FO FormGent wpWax | 7.1 | Sep 30 | WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability |
| CVE-2026-94178 | IA Import and export users and customers Javier Carazo | 7.5 | Sep 30 | WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability |
| CVE-2026-94177 | GA GamiPress Ruben Garcia | 8.5 | Sep 30 | WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability |
| CVE-2026-94123 | NG NextGEN Gallery Syed Balkhi | 7.5 | Sep 30 | WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability |
| CVE-2026-94122 | RS Responsive Slider Gallery A WP Life | 7.2 | Sep 30 | WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability |
| CVE-2026-94121 | 1B 10Web Booster – Website speed optimization, Cache & Page Speed optimizer 10Web | 8.8 | Sep 30 | WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability |
| CVE-2026-94120 | GL GravityExport Lite for Gravity Forms GravityKit | 7.5 | Sep 30 | WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability |
| CVE-2026-94115 | EP Easy Pricing Tables Fatcatapps | 8.5 | Sep 30 | WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability |
| CVE-2026-94082 | QC Quiz Cat Fatcatapps | 7.6 | Sep 30 | WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability |
| CVE-2026-94081 | WP WordPress Persistent Login lukeseager | 7.1 | Sep 30 | WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-94078 | SR Site Reviews Gemini Labs | 7.1 | Sep 30 | WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-94076 | SP SEO Plugin by Squirrly SEO SEO Squirrly | 8.8 | Sep 30 | WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability |
| CVE-2026-93771 | CO Cost of Goods for WooCommerce WPFactory | 7.2 | Sep 30 | WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability |
| CVE-2026-93770 | WS WP Statistics VeronaLabs | 7.1 | Sep 30 | WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-93651 | MA Minimum and Maximum Quantity for WooCommerce Dotstore | 7.2 | Sep 30 | WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability |
| CVE-2026-93624 | MP Music Player for WooCommerce codepeople | 7.2 | Sep 30 | WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability |
| CVE-2026-93621 | WD WP Data Access Passionate Programmer Peter | 8.2 | Sep 30 | WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability |
| CVE-2026-93514 | NF Notification for Telegram rainafarai | 7.1 | Sep 30 | WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-93512 | JP JW Player for WordPress ilGhera | 7.1 | Sep 30 | WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-62085 | WA WP Activity Log Melapress | 7.6 | Sep 30 | WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability |
| CVE-2026-27371 | WP WPFunnels WPFunnels | 7.1 | Sep 30 | WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability |
| CVE-2026-95616 | AW Apache WSS4J Apache Software Foundation | 7.5 | Sep 30 | Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions |
| CVE-2026-103321 | MI MISP MISP | 8.3 | Sep 30 | MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image |
| CVE-2026-92121 | AW Apache WSS4J Apache Software Foundation | 7.5 | Sep 30 | Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference |
| CVE-2026-85532 | AW Apache WSS4J Apache Software Foundation | 7.5 | Sep 30 | Apache WSS4J: Insufficient Validation of Derived-Key Parameters |
| CVE-2026-103242 | RH Red Hat Enterprise Linux 10 Red Hat | 7.1 | Sep 30 | Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag |
| CVE-2026-62146 | RH Red Hat OpenShift Container Platform 4.16 Red Hat | 7.8 | Sep 30 | Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket |
| CVE-2026-10739 | SC SDP Client Cato Networks | 8.5 | Sep 30 | Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation |
| CVE-2026-76992 | DS Development System 3 CODESYS | 7.5 | Sep 30 | Uncontrolled Memory Allocation in CODESYS Gateway Client |
| CVE-2026-103239 | MI MISP MISP | 8.6 | Sep 30 | MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection |
| CVE-2026-103237 | MI MISP MISP | 8.3 | Sep 30 | MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows |
| CVE-2026-93994 | AM Apache MINA SSHD Apache Software Foundation | 8.1 | Sep 30 | Apache MINA SSHD: Repeated-publickey policy bypass on server |
| CVE-2026-10764 | BV BVMS IQSIGHT | 8.7 | Sep 30 | Information disclosure in BVMS 4.5 up to 12.3 |
| CVE-2026-94002 | AM Apache MINA SSHD Apache Software Foundation | 7.5 | Sep 30 | Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies |
| CVE-2026-79625 | CF Control for BeagleBone SL CODESYS | 8.1 | Sep 30 | Improper Synchronization in Monitoring in CODESYS Control Runtime |
| CVE-2026-103235 | MI MISP MISP | 8.7 | Sep 30 | MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events |
| CVE-2026-102578 | MO Moodle Moodle | 8.8 | Sep 30 | Moodle: sql injection in question bank web service |
| CVE-2026-75098 | PD Product Designer App productdesignerapp | 7.5 | Sep 30 | Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design |
| CVE-2026-97347 | PV Post Views Stats Counter kazukiyanamoto | 7.2 | Sep 30 | Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header |
| CVE-2026-102454 | EN EasyFlow .NET DigiWin | 7.2 | Sep 30 | DigiWin｜EasyFlow .NET - Arbitrary File Upload |
| CVE-2026-102511 | AP Apache PLC4X Apache Software Foundation | 8.5 | Sep 30 | Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them |
| CVE-2026-102510 | AP Apache PLC4X Apache Software Foundation | 8.7 | Sep 30 | Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths |
| CVE-2026-102509 | AP Apache PLC4X Apache Software Foundation | 8.7 | Sep 30 | Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser |
| CVE-2026-92873 | PG Pgpool-II Pgpool Global Development Group | 7.3 | Sep 30 | Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node |
| CVE-2026-92871 | PG Pgpool-II Pgpool Global Development Group | 7.5 | Sep 30 | A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process |
| CVE-2026-6806 | MC Motors – Car Dealership & Classified Listings Plugin stylemix | 7.5 | Sep 30 | Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters |
| CVE-2026-92870 | PG Pgpool-II Pgpool Global Development Group | 7.5 | Sep 30 | A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination |
| CVE-2026-92867 | PG Pgpool-II Pgpool Global Development Group | 8.8 | Sep 30 | An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution |
| CVE-2026-97150 | BC BcAddonMigrator baserCMS Users Community | 7.2 | Sep 30 | When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed |
| CVE-2026-89294 | SS Simply Schedule Appointments croixhaug | 7.5 | Sep 30 | Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter |