CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:37 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116070 New | DO Docker-Proxy dqzboy | 6.5 | Oct 25 | Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config |
| CVE-2026-116069 New | NI niubigeo Albert-Weasker | 6.5 | Oct 25 | NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field |
| CVE-2026-116066 New | FI Firecrawl Firecrawl | 6.8 | Oct 25 | Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service |
| CVE-2026-116047 New | VO Vocechat Privoce | 4.3 | Oct 25 | Privoce Vocechat Query Parameter widget.html cross site scripting |
| CVE-2026-116046 New | SD sdk eventcatalog | 5.3 | Oct 25 | eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal |
| CVE-2026-116045 New | DE designer-mcp 1999AZZAR | 4.3 | Oct 25 | 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal |
| CVE-2026-114740 New | WP WPVR | 4.9 | Oct 25 | WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard |
| CVE-2026-111980 New | GI GiveWP | 5.5 | Oct 25 | GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant |
| CVE-2026-111979 New | GI GiveWP | 6.8 | Oct 25 | GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color |
| CVE-2026-111978 New | GI GiveWP | 6.0 | Oct 25 | GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import |
| CVE-2026-111976 New | GI GiveWP | 5.3 | Oct 25 | GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route |
| CVE-2026-110285 New | WS WP Stripe Checkout | 5.3 | Oct 25 | WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret |
| CVE-2026-94295 New | CG Chikkili- Google Pay India for Woocommerce | 5.3 | Oct 25 | Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature |
| CVE-2026-116044 New | TI TinyFileManager prasathmani | 6.3 | Oct 25 | prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload |
| CVE-2026-115997 New | PI pig pig-mesh | 6.3 | Oct 24 | pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection |
| CVE-2026-115982 New | PH phpIPAM Phpipam | 4.3 | Oct 24 | phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting |
| CVE-2026-115972 New | FH Faveo Helpdesk FaveoSuite | 5.3 | Oct 24 | FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization |
| CVE-2026-115971 New | OP Opptrix Travisun | 5.3 | Oct 24 | Travisun Opptrix preParsing handler webhook Buffer.concat denial of service |
| CVE-2026-114192 New | WP WpEvently Magepeople inc. | 6.5 | Oct 24 | WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability |
| CVE-2026-116020 New | BO BookStack BookStackApp | 5.4 | Oct 24 | BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages |
| CVE-2026-116018 New | CO community-platform ONEARMY | 4.3 | Oct 24 | ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint |
| CVE-2026-116017 New | XI xiaozhi-esp32-server xinnan-tech | 4.3 | Oct 24 | Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint |
| CVE-2026-116015 New | YU yudao-cloud YunaiV | 4.3 | Oct 24 | yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint |
| CVE-2026-116010 New | RO RosarioSIS francoisjacquet | 4.3 | Oct 24 | RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers |
| CVE-2026-116008 New | DA DaybydayCRM Bottelet | 4.3 | Oct 24 | DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign |
| CVE-2026-114705 New | WS WP Social Feed Gallery quadlayers | 6.5 | Oct 24 | WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability |
| CVE-2026-115998 New | CE cervantes CervantesSec | 4.3 | Oct 24 | IDOR: User reads and modifies findings from other people's projects |
| CVE-2026-114194 New | AI Ad Inserter Igor Funa | 6.5 | Oct 24 | WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115994 New | CE cervantes CervantesSec | 5.4 | Oct 24 | BOLA Allows Cross-Project Target Tampering |
| CVE-2026-115993 New | CE cervantes CervantesSec | 6.8 | Oct 24 | Stored XSS in the “Notes” field of project checklists |
| CVE-2026-114693 New | AV All-in-One Video Gallery Plugins360 Labs | 6.5 | Oct 24 | WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-110892 New | SU SureDash Brainstorm Force | 6.5 | Oct 24 | WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability |
| CVE-2026-114190 New | LC LiteSpeed Cache Hai Zheng / Lite Speed Cache | 5.9 | Oct 24 | WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability |
| CVE-2026-115803 New | SC Scada-LTS Scada-lts | 4.3 | Oct 24 | Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization |
| CVE-2026-115802 New | IN InternAgent InternScience | 4.3 | Oct 24 | InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere |
| CVE-2026-108013 New | BP BigFix Platform HCL Software | 6.8 | Oct 24 | HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID) |
| CVE-2026-114429 New | WP WPVR | 6.8 | Oct 24 | WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content |
| CVE-2026-113493 New | GE GeoDirectory | 6.8 | Oct 24 | GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute |
| CVE-2026-113492 New | GE GeoDirectory | 5.3 | Oct 24 | GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action |
| CVE-2026-113491 New | GE GeoDirectory | 6.4 | Oct 24 | GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal |
| CVE-2026-113490 New | GE GeoDirectory | 5.3 | Oct 24 | GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint |
| CVE-2026-113489 New | GE GeoDirectory | 4.3 | Oct 24 | GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR |
| CVE-2026-105199 New | PT Pixel Tag Manager for WooCommerce | 6.8 | Oct 24 | Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID |
| CVE-2026-97353 New | NK News Kit Addons For Elementor | 5.4 | Oct 24 | News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form |
| CVE-2026-97352 New | NK News Kit Addons For Elementor | 4.3 | Oct 24 | News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer |
| CVE-2026-107907 New | MV MAS Videos | 6.5 | Oct 24 | MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist |
| CVE-2026-87835 New | FE Front End Users | 6.5 | Oct 24 | Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment |
| CVE-2026-107887 New | AT Advanced Twenty Seventeen | 5.4 | Oct 24 | Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme |
| CVE-2026-115929 New | CO Compass MongoDB, Inc. | 6.8 | Oct 24 | MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs |
| CVE-2026-115801 New | KH khaiii Kakao | 5.3 | Oct 23 | Kakao khaiii JSON Config File Linear.cpp open out-of-bounds |