CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 11:09 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-93904 New | SW Social Web Suite – Social Media Auto Post, Social Media Auto Publish dejanmarkovic | 7.5 | Oct 29 | Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter |
| CVE-2026-93855 New | SN SendPress Newsletters brewlabs | 7.5 | Oct 29 | SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter |
| CVE-2026-96669 New | FS Food Store – Online Food Delivery & Pickup wpscripts | 7.2 | Oct 29 | Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie |
| CVE-2026-96741 New | DA DSGVO All in one for WP mlfactory | 7.2 | Oct 29 | DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption |
| CVE-2026-109516 New | BF Bot for Telegram on WooCommerce guruteam | 9.8 | Oct 29 | Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token |
| CVE-2026-42949 New | FR Frangoteam frangoteam | 5.6 | Oct 29 | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-40063 New | FR Frangoteam frangoteam | 5.3 | Oct 29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-42922 New | FR Frangoteam frangoteam | 9.8 | Oct 29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809) |
| CVE-2026-118426 New | OS Octopus Server Octopus Deploy | 5.3 | Oct 29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search |
| CVE-2026-113409 New | OR ortto canva | 4.8 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting |
| CVE-2026-114173 New | OR ortto canva | 5.3 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages |
| CVE-2026-113387 New | OR ortto canva | 8.6 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML |
| CVE-2026-66092 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS in pre-login notice via reachable legacy logon route |
| CVE-2026-66091 New | OP openEQUELLA Apereo Foundation | 6.9 | Oct 29 | Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details |
| CVE-2026-66090 New | OP openEQUELLA Apereo Foundation | 7.1 | Oct 29 | XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read |
| CVE-2026-66089 New | OP openEQUELLA Apereo Foundation | 6.1 | Oct 29 | XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion |
| CVE-2026-66088 New | OP openEQUELLA Apereo Foundation | 9.4 | Oct 29 | Unrestricted Command Execution via system.execute |
| CVE-2026-16889 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin |
| CVE-2026-21157 New | BI Bixby Samsung Mobile | 8.3 | Oct 29 | Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity |
| CVE-2026-113957 New | CO container Apple | – | Oct 29 | An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an… |
| CVE-2026-118590 New | NI nibabel nipy | 5.3 | Oct 29 | nipy nibabel Header volumeutils.py array_from_file memory allocation |
| CVE-2026-107058 New | Product not mapped yet | 9.8 | Oct 29 | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state |
| CVE-2026-107015 New | Product not mapped yet | 9.1 | Oct 29 | Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database |
| CVE-2026-107032 New | Product not mapped yet | 9.1 | Oct 29 | Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and… |
| CVE-2026-107042 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via… |
| CVE-2026-107037 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note… |
| CVE-2026-107047 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data |
| CVE-2026-107026 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content |
| CVE-2026-107020 New | Product not mapped yet | 7.5 | Oct 29 | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL |
| CVE-2026-107052 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via… |
| CVE-2026-107029 New | Product not mapped yet | – | Oct 29 | Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting |
| CVE-2026-107035 New | Product not mapped yet | – | Oct 29 | Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into… |
| CVE-2026-107041 New | Product not mapped yet | – | Oct 29 | Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device,… |
| CVE-2026-107040 New | Product not mapped yet | – | Oct 29 | Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow |
| CVE-2026-107039 New | Product not mapped yet | – | Oct 29 | Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to… |
| CVE-2026-107038 New | Product not mapped yet | – | Oct 29 | Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control… |
| CVE-2026-107036 New | Product not mapped yet | – | Oct 29 | Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of… |
| CVE-2026-107034 New | Product not mapped yet | – | Oct 29 | Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data |
| CVE-2026-107033 New | Product not mapped yet | – | Oct 29 | Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's… |
| CVE-2026-107028 New | Product not mapped yet | – | Oct 29 | Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list… |
| CVE-2026-107027 New | Product not mapped yet | – | Oct 29 | Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and… |
| CVE-2026-107025 New | Product not mapped yet | – | Oct 29 | Insecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's data |
| CVE-2026-107019 New | Product not mapped yet | – | Oct 29 | Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries… |
| CVE-2026-107018 New | Product not mapped yet | – | Oct 29 | Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage |
| CVE-2026-107017 New | Product not mapped yet | – | Oct 29 | Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated… |
| CVE-2026-107021 New | Product not mapped yet | – | Oct 29 | Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across… |
| CVE-2026-107023 New | Product not mapped yet | – | Oct 29 | Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content |
| CVE-2026-107046 New | Product not mapped yet | – | Oct 29 | A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted… |
| CVE-2026-107014 New | Product not mapped yet | – | Oct 29 | Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database |
| CVE-2026-107051 New | Product not mapped yet | – | Oct 29 | Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation… |