CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:50 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-103063 | EE ElementsKit Elementor addons Lite Wpmet | 6.5 | Oct 1 | WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-103345 | PR Pie Register Shamim Rajani | 5.3 | Oct 1 | WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability |
| CVE-2026-103064 | EE ElementsKit Elementor addons Lite Wpmet | 6.5 | Oct 1 | WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-102390 | AA AFFI – Affiliate Marketing for WooCommerce VillaTheme | 5.3 | Oct 1 | WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability |
| CVE-2026-102382 | MS Majestic Support Ahmad | 4.3 | Oct 1 | WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-102381 | MS Majestic Support Ahmad | 5.3 | Oct 1 | WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability |
| CVE-2026-103343 | FL FluentForm WP ManageNinja LLC | 6.5 | Oct 1 | WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-103341 | UE Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Unlimited Elements | 5.3 | Oct 1 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability |
| CVE-2026-103340 | SR Site Reviews Gemini Labs | 5.3 | Oct 1 | WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability |
| CVE-2026-103754 | RH Red Hat Ansible Automation Platform 2 Red Hat | 5.9 | Oct 1 | Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory |
| CVE-2026-103336 | WU WP Ultimate CSV Importer Smackcoders Inc. | 5.3 | Oct 1 | WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability |
| CVE-2026-103680 | TN Tnef Tnef Project | 6.5 | Oct 1 | Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation |
| CVE-2026-103679 | TN Tnef Tnef Project | 6.5 | Oct 1 | Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction |
| CVE-2026-103858 | MI MISP MISP | 5.3 | Oct 1 | MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions |
| CVE-2026-94276 | AA Apache APISIX Apache Software Foundation | 5.1 | Oct 1 | Apache APISIX: Openid-connect introspection validation issue |
| CVE-2026-94269 | AA Apache APISIX Apache Software Foundation | 6.3 | Oct 1 | Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch |
| CVE-2026-94212 | AA Apache APISIX Apache Software Foundation | 6.4 | Oct 1 | Apache APISIX: unauthenticated impersonation issue in saml-auth |
| CVE-2026-82806 | AA Apache APISIX Apache Software Foundation | 5.3 | Oct 1 | Apache APISIX: cross-request permission pollution via static permission list mutation |
| CVE-2026-78242 | AA Apache APISIX Apache Software Foundation | 5.7 | Oct 1 | Apache APISIX: data-mask may fail to redact request headers in logger output |
| CVE-2026-103353 | FL FluentForm WP ManageNinja LLC | 5.3 | Oct 1 | WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability |
| CVE-2026-103291 | GH Ghost TryGhost | 6.4 | Oct 1 | Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch |
| CVE-2026-103289 | GH Ghost TryGhost | 6.5 | Oct 1 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments |
| CVE-2026-103288 | GH Ghost TryGhost | 6.5 | Oct 1 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like |
| CVE-2026-103285 | GH Ghost TryGhost | 4.3 | Oct 1 | Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery |
| CVE-2026-103284 | GH Ghost TryGhost | 4.3 | Oct 1 | Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback |
| CVE-2026-103282 | GH Ghost TryGhost | 4.3 | Oct 1 | Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token |
| CVE-2026-103281 | GH Ghost TryGhost | 5.4 | Oct 1 | Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API |
| CVE-2026-103280 | GH Ghost TryGhost | 5.3 | Oct 1 | Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint |
| CVE-2026-103279 | GH Ghost TryGhost | 6.8 | Oct 1 | Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass |
| CVE-2026-103276 | GH Ghost TryGhost | 5.3 | Oct 1 | Ghost before 6.20.0 File Read via URL Encoding Bypass |
| CVE-2026-103275 | GH Ghost TryGhost | 4.3 | Oct 1 | Ghost 5.42.2 before 6.58.0 Password Hash Disclosure |
| CVE-2026-103274 | GH Ghost TryGhost | 5.3 | Oct 1 | Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read |
| CVE-2026-103273 | GH Ghost TryGhost | 4.3 | Oct 1 | Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token |
| CVE-2026-103269 | GH Ghost TryGhost | 5.3 | Oct 1 | Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts |
| CVE-2026-103267 | GH Ghost TryGhost | 4.3 | Oct 1 | Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite |
| CVE-2026-103265 | FL fleet fleetdm | 4.3 | Oct 1 | Fleet before 4.89.0 Information Disclosure via MDM Command Results |
| CVE-2026-103263 | TO tornado tornadoweb | 5.9 | Oct 1 | Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink |
| CVE-2026-103261 | TO tornado tornadoweb | 5.3 | Oct 1 | Tornado before 6.5.9 Denial of Service via Query String |
| CVE-2026-103260 | N8 n8n n8n-io | 4.0 | Oct 1 | n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node |
| CVE-2026-103258 | N8 n8n n8n-io | 6.8 | Oct 1 | n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation |
| CVE-2026-103254 | N8 n8n n8n-io | 6.3 | Oct 1 | n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation |
| CVE-2026-103245 | N8 n8n n8n-io | 5.3 | Oct 1 | n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification |
| CVE-2026-7176 | EN Entradium Crocantickets | 4.8 | Oct 1 | Multiple vulnerabilities in Entradium by Crocantickets |
| CVE-2026-7175 | EN Entradium Crocantickets | 4.8 | Oct 1 | Multiple vulnerabilities in Entradium by Crocantickets |
| CVE-2026-7174 | EN Entradium Crocantickets | 4.8 | Oct 1 | Multiple vulnerabilities in Entradium by Crocantickets |
| CVE-2026-7173 | EN Entradium Crocantickets | 4.8 | Oct 1 | Multiple vulnerabilities in Entradium by Crocantickets |
| CVE-2026-96256 | GE Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns wpdevteam | 6.4 | Oct 1 | Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute |
| CVE-2026-34190 | PF Pandora FMS Pandora FMS | 5.9 | Oct 1 | CSRF in Alert Command Deletion |
| CVE-2026-34189 | PF Pandora FMS Pandora FMS | 5.9 | Oct 1 | CSRF in Event Response Deletion |
| CVE-2026-83589 | RH Red Hat OpenShift Container Platform 4.12 Red Hat | 6.1 | Oct 1 | Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect |