CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90488 | XX xxl-job Xuxueli | 6.3 | Sep 12 | Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection |
| CVE-2026-90487 | XX xxl-job Xuxueli | 4.3 | Sep 12 | Xuxueli xxl-job JobGroupController.java privileges management |
| CVE-2026-90486 | OP openstatus openstatusHQ | 6.3 | Sep 12 | openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery |
| CVE-2026-90485 | UN Uninstaller IOBit | 5.5 | Sep 12 | IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference |
| CVE-2026-90557 | FR freeciv freeciv | 6.1 | Sep 12 | Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame |
| CVE-2026-10148 | BF Booking for Appointments and Events Calendar – Amelia melograno | 6.4 | Sep 12 | Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter |
| CVE-2026-90555 | VL vLLM vllm-project | 6.5 | Sep 12 | vLLM before 0.28.0 Denial of Service via Audio Header |
| CVE-2026-90552 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via Playlists_schedules list.json.php |
| CVE-2026-90551 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via video_from_program API |
| CVE-2026-90550 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via mediaSession.json.php |
| CVE-2026-90549 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint |
| CVE-2026-90548 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization in ImageGallery list.json.php |
| CVE-2026-90547 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via getBookmarks.json.php |
| CVE-2026-90546 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via like.json.php |
| CVE-2026-90545 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via commentAddNew.json.php |
| CVE-2026-90544 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via videoAddViewCount.json.php |
| CVE-2026-90543 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php |
| CVE-2026-90542 | AV AVideo WWBN | 5.4 | Sep 12 | WWBN AVideo Missing Authorization via remindMe.json.php |
| CVE-2026-90541 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Unauthenticated Information Disclosure via menus.json.php |
| CVE-2026-90540 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via playListAddVideo.json.php |
| CVE-2026-90539 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authentication via menuItems.json.php |
| CVE-2026-90538 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via playlistsFromUser.json.php |
| CVE-2026-90536 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via adsInfo API Endpoint |
| CVE-2026-90534 | FL Flowise FlowiseAI | 6.5 | Sep 12 | Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method |
| CVE-2026-90533 | FL Flowise FlowiseAI | 6.5 | Sep 12 | Flowise before 3.1.4 Broken Access Control via organizationuser |
| CVE-2026-90474 | MC mcphub samanhappy | 6.8 | Sep 12 | MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass |
| CVE-2026-90473 | MS msgpack-java msgpack | 5.3 | Sep 12 | msgpack-java through 0.9.12 Integer Overflow via MAP32 |
| CVE-2026-90472 | MS msgpack-java msgpack | 5.3 | Sep 12 | msgpack-java through 0.9.12 Stack Overflow via Nested Arrays |
| CVE-2026-89172 | AN AN1044 Microchip | 5.6 | Sep 12 | Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms |
| CVE-2026-11355 | DL DT LMS – elearning, WordPress LMS Plugin designthemes | 5.3 | Sep 12 | DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions |
| CVE-2026-77161 | SM Smart Marketing SMS and Newsletters Forms egoi | 6.5 | Sep 12 | Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name |
| CVE-2026-85198 | MM MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO themeisle | 6.5 | Sep 12 | MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path |
| CVE-2026-17585 | RA Royal Addons for Elementor – Addons and Templates Kit for Elementor wproyal | 5.3 | Sep 12 | Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter |
| CVE-2026-87919 | PX Product XML Feed Manager for WooCommerce | 4.9 | Sep 12 | Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode |
| CVE-2026-87918 | WP WPBot | 5.3 | Sep 12 | WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions |
| CVE-2026-87916 | WP WPBot | 5.3 | Sep 12 | WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure |
| CVE-2026-87894 | RA Rox Appointment Booking | 5.3 | Sep 12 | Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR |
| CVE-2026-87892 | RA Rox Appointment Booking | 5.3 | Sep 12 | Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass |
| CVE-2026-87891 | RA Rox Appointment Booking | 6.5 | Sep 12 | Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API |
| CVE-2026-87797 | SI Sprout Invoices | 4.3 | Sep 12 | Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note |
| CVE-2026-86790 | WH WP Highlight Box | 6.8 | Sep 12 | WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode |
| CVE-2026-84024 | BE BEAR | 4.3 | Sep 12 | BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF |
| CVE-2026-84023 | BE BEAR | 6.5 | Sep 12 | BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF |
| CVE-2026-82847 | ML Masteriyo LMS | 6.8 | Sep 12 | Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights |
| CVE-2026-78152 | SS SureRank SEO | 5.3 | Sep 12 | SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema |
| CVE-2026-77753 | TL Temporary Login Without Password | 5.5 | Sep 12 | Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords |
| CVE-2026-77689 | BF Booking for Appointments and Events Calendar | 5.3 | Sep 12 | Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass |
| CVE-2026-83532 | CM Custom Menu Wizard Widget | 6.8 | Sep 12 | Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes |
| CVE-2026-90467 | AI aiosmtplib cole | 4.0 | Sep 12 | aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses |
| CVE-2026-89268 | QL QloApps Webkul | 5.4 | Sep 12 | QloApps through 1.7.0 Reflected XSS via List Filter Parameters |