CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 02:55 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-95512 | RH Red Hat build of OpenJDK 11 ELS Red Hat | 5.5 | Oct 2 | Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader |
| CVE-2026-59670 | RA Repasat application Repasat | 4.8 | Oct 2 | Multiple vulnerabilities in the Repasat application |
| CVE-2026-80337 | SA Sef - AI Chatbot Platform HAVELSAN Inc. | 5.3 | Oct 2 | Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform |
| CVE-2026-80464 | SA Sef - AI Chatbot Platform HAVELSAN Inc. | 4.9 | Oct 2 | API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform |
| CVE-2026-59669 | RA Repasat application Repasat | 4.8 | Oct 2 | Multiple vulnerabilities in the Repasat application |
| CVE-2026-91784 | GO gotop cjbassi | 4.8 | Oct 2 | Argument Injection leading to arbitrary process termination in gotop |
| CVE-2026-94432 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 5.3 | Oct 2 | Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter |
| CVE-2026-97338 | DM Download Manager codename065 | 6.4 | Oct 2 | Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name |
| CVE-2026-97634 | ET Event Tickets and Registration stellarwp | 6.5 | Oct 2 | Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter |
| CVE-2026-96647 | LA Listdom: AI-powered Business Directory with Classifieds Ads Listings webilia | 6.4 | Oct 2 | Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter |
| CVE-2026-12951 | MW MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions wcmp | 6.5 | Oct 2 | MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter |
| CVE-2026-93880 | GA Greenshift – animation and page builder blocks wpsoul | 6.1 | Oct 2 | Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder |
| CVE-2026-17508 | BC BC-FJA Legion of the Bouncy Castle Inc. | 5.3 | Oct 2 | Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points |
| CVE-2026-103602 | BC bc-csharp Legion of the Bouncy Castle Inc. | 5.3 | Oct 2 | Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts |
| CVE-2026-63569 | BC bc-csharp Legion of the Bouncy Castle Inc. | 6.5 | Oct 2 | MTI/A0 DHAgreement does not validate the peer's ephemeral value |
| CVE-2026-97219 | MA MStore API | 4.3 | Oct 2 | MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter |
| CVE-2026-92924 | UE Unlimited Elements for Elementor | 5.4 | Oct 2 | Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data |
| CVE-2026-91020 | WG WebToffee Gift Cards for WooCommerce | 5.3 | Oct 2 | WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount |
| CVE-2026-90987 | EP Easy PayPal & Stripe Buy Now Button | 5.3 | Oct 2 | Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price |
| CVE-2026-90952 | WE WP Edit Password Protected | 5.3 | Oct 2 | WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API |
| CVE-2026-85005 | PM Popup Maker WP | 5.4 | Oct 2 | Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization |
| CVE-2026-84740 | TE The Events Calendar | 6.5 | Oct 2 | The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter |
| CVE-2026-79618 | WU WP User Frontend | 4.3 | Oct 2 | WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form |
| CVE-2026-1661 | WM WP Mail Logging | 4.3 | Oct 2 | WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection |
| CVE-2026-13413 | CC CMP – Coming Soon & Maintenance | 5.3 | Oct 2 | CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match |
| CVE-2026-97318 | GA Giveaways and Contests by RafflePress | 6.1 | Oct 2 | Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter |
| CVE-2026-97317 | GA Giveaways and Contests by RafflePress | 5.3 | Oct 2 | Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page |
| CVE-2026-94298 | BU BuildKit | 6.2 | Oct 2 | BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter |
| CVE-2026-91022 | MO Motors | 6.8 | Oct 2 | Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color |
| CVE-2026-85016 | UE Unlimited Elements for Elementor | 6.8 | Oct 2 | Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter |
| CVE-2026-13718 | TR Tabs Responsive | 6.8 | Oct 2 | Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content |
| CVE-2026-90988 | RA Request a Quote | 5.3 | Oct 2 | Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum |
| CVE-2026-85004 | PM Popup Maker | 4.3 | Oct 2 | Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect |
| CVE-2026-81740 | PP Paytm Payment Gateway | 5.3 | Oct 2 | Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback |
| CVE-2026-78471 | AU Autoptimize optimizingmatters | 5.4 | Oct 2 | Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name |
| CVE-2026-84925 | AW Avada | Website Builder For WordPress & WooCommerce ThemeFusion | 6.1 | Oct 2 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter |
| CVE-2026-104054 | CA cal.diy calcom | 6.3 | Oct 2 | calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization |
| CVE-2026-104053 | PS Pet Shop Management System itsourcecode | 6.3 | Oct 2 | itsourcecode Pet Shop Management System admin_reservefilter.php sql injection |
| CVE-2026-21140 | SM Samsung Mobile Devices Samsung Mobile | 6.9 | Oct 2 | Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications |
| CVE-2026-104052 | PS Pet Shop Management System itsourcecode | 6.3 | Oct 2 | itsourcecode Pet Shop Management System admin_reject_completed.php sql injection |
| CVE-2026-51899 | Product not mapped yet | 4.3 | Oct 2 | In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow… |
| CVE-2026-103760 | MO Mooncake kvcache-ai | 5.9 | Oct 1 | Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write |
| CVE-2025-71427 | OF Office-PowerPoint-MCP-Server GongRzhe | 6.8 | Oct 1 | Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image |
| CVE-2026-27873 | EF EasyIO FG Johnson Controls | 5.6 | Oct 1 | - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying |
| CVE-2026-64892 | EI Easy IO Neo Johnson Controls | 6.3 | Oct 1 | - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations |
| CVE-2026-104356 | PI pictshare HaschekSolutions | 5.9 | Oct 1 | PictShare < 3.7.1 Predictable Delete Code via rand() |
| CVE-2026-71448 | EF EasyIO FS32 Johnson Controls | 5.6 | Oct 1 | : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse |
| CVE-2026-71454 | CA CAPEC-63 CWE-79 - Cross-site Scripting | 5.8 | Oct 1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS) |
| CVE-2026-71453 | EF EasyIO FS32 Johnson Controls | 5.6 | Oct 1 | - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack |
| CVE-2026-104002 | PO powertools-lambda-python AWS | 5.3 | Oct 1 | Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) |