CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 23:17 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115332 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Subscription Filter Keys |
| CVE-2026-115331 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters |
| CVE-2026-115330 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics |
| CVE-2026-115328 New | JS json-scada riclolsen | 8.8 | Oct 22 | JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API |
| CVE-2026-115325 New | NE netmaker gravitl | 8.3 | Oct 22 | Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup |
| CVE-2026-115324 New | ME mem0 mem0ai | 8.1 | Oct 22 | mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store |
| CVE-2026-115323 New | EV evershop evershopcommerce | 7.3 | Oct 22 | EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API |
| CVE-2025-71434 New | EC E-cology Weaver Network Co., Ltd. | 8.2 | Oct 22 | Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list |
| CVE-2024-58396 New | CA CPAS Audit Management System YouDataSum | 7.5 | Oct 22 | YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId |
| CVE-2024-58393 New | RU Readymade Unilevel Ecommerce MLM i-Netsolution | 8.2 | Oct 22 | i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php |
| CVE-2022-51024 New | KA Kavita Kareadita | 7.5 | Oct 22 | Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint |
| CVE-2022-51023 New | PH PHPOK PHPOK | 8.2 | Oct 22 | PHPOK < 5.4.081 SQL Injection via api.php sort Parameter |
| CVE-2022-51021 New | NO NotificationX WPDeveloper | 8.2 | Oct 22 | NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint |
| CVE-2021-48017 New | BS BSCW Server OrbiTeam | 7.5 | Oct 22 | OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi |
| CVE-2021-48015 New | JE JeeWMS erzhongxmu | 7.5 | Oct 22 | JeeWMS Path Traversal via showOrDownByurl.do |
| CVE-2021-48013 New | EC E-cology Weaver Network Co., Ltd. | 7.5 | Oct 22 | Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload |
| CVE-2019-25779 New | DI Diarise WooThemes | 7.5 | Oct 22 | WooThemes Diarise 1.5.9 Local File Disclosure via download.php |
| CVE-2019-25778 New | SE SeaCMS SeaCMS | 8.2 | Oct 22 | SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter |
| CVE-2018-25439 New | ME MetInfo MetInfo | 7.5 | Oct 22 | MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter |
| CVE-2018-25438 New | GR Group-Office Intermesh | 7.5 | Oct 22 | Intermesh Group-Office < 3.5.5 Path Traversal via compress.php |
| CVE-2017-20289 New | AW Ad Widget Broadstreet | 7.5 | Oct 22 | Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter |
| CVE-2017-20287 New | JS Javo Spot Javo Themes | 7.5 | Oct 22 | Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter |
| CVE-2026-111079 New | RH Red Hat Enterprise Linux 10 Red Hat | 7.4 | Oct 22 | Goose: goose: shell history and environment leak via terminal integration |
| CVE-2026-112313 New | AE ACF Extended ACF Extended | 7.1 | Oct 22 | WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112820 New | AC Academist Core Elated-Themes | 8.1 | Oct 22 | WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability |
| CVE-2026-112085 New | WE webpack-dev-server webpack-dev-server | 8.2 | Oct 22 | webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades |
| CVE-2026-115253 New | WA WatchGuard Agent WatchGuard | 7.3 | Oct 22 | WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering |
| CVE-2026-111851 New | RE Royal Elementor Addons WProyal | 7.6 | Oct 22 | WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability |
| CVE-2026-112312 New | AE ACF Extended ACF Extended | 7.5 | Oct 22 | WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability |
| CVE-2026-111830 New | WM WP Mailster WP Mailster | 7.1 | Oct 22 | WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112242 New | PB Profile Builder Cozmoslabs | 8.8 | Oct 22 | WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability |
| CVE-2026-112379 New | CF Contact Form Email Codepeople | 7.1 | Oct 22 | WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-93471 New | ES esaml arekinath | 8.7 | Oct 22 | Unbounded SAML message decompression in esaml allows memory exhaustion |
| CVE-2026-86696 New | ES esaml arekinath | 8.2 | Oct 22 | Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion |
| CVE-2026-105270 New | ES esaml arekinath | 8.7 | Oct 22 | Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion |
| CVE-2026-114177 New | XE Xpro Elementor Addons Xpro | 8.8 | Oct 22 | WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-97328 New | WE WebP Express | 7.5 | Oct 22 | WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser |
| CVE-2026-111958 New | RM Royal MCP | 7.5 | Oct 22 | Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token |
| CVE-2026-109987 New | PI PixelYourSite | 7.2 | Oct 22 | PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie |
| CVE-2026-109927 New | HF HIPAA Forms | 7.2 | Oct 22 | CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role |
| CVE-2026-114221 New | NO NT OneAPP NewType Infortech | 7.4 | Oct 22 | NewType Infortech｜NT OneAPP - Credential Disclosure |
| CVE-2026-114219 New | NO NT OneAPP NewType Infortech | 7.4 | Oct 22 | NewType Infortech｜NT OneAPP - Hard-coded Credentials |
| CVE-2026-110353 New | HA HAProxy HAProxy | 7.5 | Oct 22 | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame |
| CVE-2026-110354 New | HA HAProxy HAProxy | 7.5 | Oct 22 | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request |
| CVE-2026-114730 New | WE Webmail Roundcube | 7.2 | Oct 22 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass |
| CVE-2026-114577 New | PH php-travel-agency-system oretnom23 | 7.3 | Oct 22 | oretnom23 php-travel-agency-system Insertion insert.php sql injection |
| CVE-2026-114727 New | WE Webmail Roundcube | 8.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images |
| CVE-2026-114724 New | WE Webmail Roundcube | 7.4 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize() |
| CVE-2026-114664 New | FR frappe frappe | 7.1 | Oct 22 | Frappe before 16.33.0 Blind SQL Injection via get_events |
| CVE-2026-114663 New | VY vyper vyperlang | 8.4 | Oct 22 | Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments |