CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 04:27 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92712 | RC ReactPress – Create React App for WordPress rockiger | 6.4 | Sep 30 | ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter |
| CVE-2025-14564 | VU Viable URL Media Uploader ahsangadit | 6.4 | Sep 30 | Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
| CVE-2026-93908 | RE Real Estate Manager – Property Listing and Agent Management rameez_iqbal | 6.4 | Sep 30 | Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter |
| CVE-2026-92872 | PG Pgpool-II Pgpool Global Development Group | 4.3 | Sep 30 | Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information |
| CVE-2026-93462 | BA baserCMS baserCMS User Community | 5.3 | Sep 30 | A missing authentication for critical function vulnerability exists in baserCMS |
| CVE-2026-6173 | BP Bold Page Builder boldthemes | 6.4 | Sep 30 | Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter |
| CVE-2026-16596 | WD WP Directory Kit wpdirectorykit | 6.5 | Sep 30 | WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter |
| CVE-2026-6170 | BP Bold Page Builder boldthemes | 6.4 | Sep 30 | Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute |
| CVE-2026-6171 | BP Bold Page Builder boldthemes | 6.4 | Sep 30 | Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute |
| CVE-2026-14876 | SS Smart Slider 3 nextendweb | 6.4 | Sep 30 | Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block |
| CVE-2026-11895 | HM HT Mega Addons for Elementor – Elementor Widgets & Template Builder devitemsllc | 6.4 | Sep 30 | HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting |
| CVE-2026-88037 | BP Bold Page Builder boldthemes | 6.4 | Sep 30 | Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title |
| CVE-2026-6172 | BP Bold Page Builder boldthemes | 6.4 | Sep 30 | Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter |
| CVE-2026-93464 | BA baserCMS baserCMS User Community | 5.4 | Sep 30 | A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS |
| CVE-2026-93460 | BA baserCMS baserCMS User Community | 5.4 | Sep 30 | A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS |
| CVE-2026-93463 | BA baserCMS baserCMS User Community | 5.4 | Sep 30 | A cross-site scripting vulnerability via script validation bypass exists in baserCMS |
| CVE-2026-92869 | PG Pgpool-II Pgpool Global Development Group | 6.5 | Sep 30 | An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination |
| CVE-2026-92868 | PG Pgpool-II Pgpool Global Development Group | 6.5 | Sep 30 | An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication |
| CVE-2026-97316 | BL Broken Link Notifier | 5.8 | Sep 30 | Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass |
| CVE-2026-96886 | CB Course Booking System | 5.3 | Sep 30 | Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export |
| CVE-2026-94274 | YA YayReviews | 5.3 | Sep 30 | YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API |
| CVE-2026-93580 | IP InPost PL | 5.3 | Sep 30 | InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook |
| CVE-2026-92424 | CE Content Egg | 6.8 | Sep 30 | Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue |
| CVE-2026-91072 | EI EWWW Image Optimizer | 4.4 | Sep 30 | EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler |
| CVE-2026-91051 | EI EWWW Image Optimizer | 6.6 | Sep 30 | EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta |
| CVE-2026-90953 | IO Image Optimizer | 4.3 | Sep 30 | Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks |
| CVE-2026-89190 | RI Robin Image Optimizer | 4.3 | Sep 30 | Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax |
| CVE-2026-87777 | HR Hostinger Reach | 6.8 | Sep 30 | Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute |
| CVE-2026-86789 | CB Connections Business Directory | 5.3 | Sep 30 | Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes |
| CVE-2026-85576 | AI All in One Files Upload | 4.3 | Sep 30 | All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update |
| CVE-2026-85415 | AP Audio Player Block | 6.8 | Sep 30 | Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL |
| CVE-2026-85001 | EM EmbedPress | 6.8 | Sep 30 | EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute |
| CVE-2026-83560 | NU New User Approve | 5.3 | Sep 30 | New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass |
| CVE-2026-80333 | SE Solace Extra | 5.3 | Sep 30 | Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes |
| CVE-2026-75824 | UF User Frontend | 5.3 | Sep 30 | WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled |
| CVE-2026-100143 | FA FluentCart A New Era of eCommerce | 6.5 | Sep 30 | FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email |
| CVE-2026-102912 | OL Online Leave Management System SourceCodester | 4.7 | Sep 30 | SourceCodester Online Leave Management System page reports sql injection |
| CVE-2026-102906 | GI github-mcp-server 0xshariq | 6.3 | Sep 30 | 0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection |
| CVE-2026-86556 | UA U30 Air ZTE | 5.3 | Sep 30 | An information disclosure vulnerability in ZTE U30 Air product |
| CVE-2026-102847 | HO HospitalManagement gedelumbung | 4.3 | Sep 30 | gedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting |
| CVE-2026-81310 | IS Image Scanner Driver for Linux (fi Series) PFU Limited | 6.6 | Sep 30 | Image Scanner Driver for Linux contains a link following vulnerability |
| CVE-2026-78229 | IS Image Scanner Driver for Linux (fi Series) PFU Limited | 6.7 | Sep 30 | Image Scanner Driver for Linux contains an OS command injection vulnerability |
| CVE-2026-102846 | HO HospitalManagement gedelumbung | 4.7 | Sep 30 | gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization |
| CVE-2026-102845 | HO HospitalManagement gedelumbung | 5.3 | Sep 30 | gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure |
| CVE-2026-102843 | HO HospitalManagement gedelumbung | 4.7 | Sep 30 | gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal |
| CVE-2026-102842 | HO HospitalManagement gedelumbung | 6.3 | Sep 30 | gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload |
| CVE-2026-103057 | AI AiSOC beenuar | 4.3 | Sep 30 | AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints |
| CVE-2026-103053 | AI AiSOC beenuar | 5.4 | Sep 30 | AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API |
| CVE-2026-102805 | ST stb Nothings | 6.5 | Sep 30 | Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow |
| CVE-2026-102804 | ST stb Nothings | 6.5 | Sep 30 | Nothings stb stb_hexwave.h hexwave_init integer overflow |