CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 31, 12:59 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107422 | WW WP w3all phpBB axew3.com | 6.5 | Oct 14 | WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-105874 | SU SureCart Brainstorm Force | 7.1 | Oct 14 | WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-106599 | SU SureCart Brainstorm Force | 8.8 | Oct 14 | WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability |
| CVE-2026-97278 | PO Polylang WP SYNTEX | 7.2 | Oct 14 | WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability |
| CVE-2026-107433 | WO WP OAuth Server miniOrange | 6.5 | Oct 14 | WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability |
| CVE-2026-76655 | HN HPE NonStop SNMP Trap Multiplexer Hewlett Packard Enterprise | 7.5 | Oct 14 | HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability |
| CVE-2026-73798 | HN HPE NonStop DNS 9.2.3 Non Secure Version Hewlett Packard Enterprise | 8.2 | Oct 14 | HPE NonStop DNS 9.2.3 Non Secure Version |
| CVE-2026-73797 | HN HPE NonStop TSQLFIL Hewlett Packard Enterprise | 5.3 | Oct 14 | HPE NonStop TSQLFIL - Memory corruption vulnerability |
| CVE-2026-85298 | AI Application Integration Google Cloud | 7.3 | Oct 14 | Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation |
| CVE-2026-73796 | HN HPE NonStop TSQLEXE Hewlett Packard Enterprise | 4.4 | Oct 14 | HPE NonStop TSQLEXE - Memory Corruption vulnerability |
| CVE-2026-108072 | TR TSplus Remote Access TSplus | 5.4 | Oct 14 | Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation |
| CVE-2026-108071 | TR TSplus Remote Access TSplus | 8.7 | Oct 14 | Improper Multi-Factor Authentication Validation Allows Authentication Bypass |
| CVE-2026-105067 | ME Modern Events Calendar Lite Webnus | 8.5 | Oct 14 | WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability |
| CVE-2026-103358 | ET Email Template Customizer for WooCommerce VillaTheme | 7.5 | Oct 14 | WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability |
| CVE-2026-107431 | JE JetFormBuilder Crocoblock | 7.5 | Oct 14 | WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability |
| CVE-2026-101341 | NS NSD NLnet Labs | 8.7 | Oct 14 | Stack overwrite from specially formatted TXT-DATA RDATA field |
| CVE-2026-101339 | NS NSD NLnet Labs | 8.7 | Oct 14 | Stack overwrite from a specially crafted and formatted HIP RR |
| CVE-2026-101338 | NS NSD NLnet Labs | 8.7 | Oct 14 | Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR |
| CVE-2026-101337 | NS NSD NLnet Labs | 8.7 | Oct 14 | Stack overwrite from specially formatted base64 RDATA field |
| CVE-2026-104795 | RH Red Hat OpenShift Container Platform 4.19 Red Hat | 8.8 | Oct 14 | Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution |
| CVE-2026-108070 | TR TSplus Remote Access TSplus | 8.7 | Oct 14 | Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access |
| CVE-2026-103905 | JT JTL-Shop JTL-Software GmbH | 7.5 | Oct 14 | Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop |
| CVE-2026-97315 | RB Responsive Blocks | 5.4 | Oct 14 | Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email |
| CVE-2026-88998 | TI Tickera | 5.3 | Oct 14 | Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN |
| CVE-2026-82844 | WL WPForms Lite | 5.3 | Oct 14 | WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce |
| CVE-2026-103308 | VP Visma Pay for WooCommerce | 6.5 | Oct 14 | Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint |
| CVE-2026-101301 | WP WPCode | 5.3 | Oct 14 | WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass |
| CVE-2026-103904 | JT JTL-Shop JTL-Software GmbH | 9.3 | Oct 14 | Stored XSS Vulnerability in JTL-Shop |
| CVE-2026-73795 | HN HPE NonStop TMF Auditread2 Hewlett Packard Enterprise | 6.4 | Oct 14 | HPE NonStop TMF Auditread2 - Denial of Service vulnerability |
| CVE-2026-100229 | RH Red Hat Enterprise Linux 10 Red Hat | 6.5 | Oct 14 | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check |
| CVE-2026-88842 | RH Red Hat Hardened Images Red Hat | 3.3 | Oct 14 | Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption |
| CVE-2026-109971 | RH Red Hat Enterprise Linux 10 Red Hat | 4.7 | Oct 14 | Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool |
| CVE-2026-109970 | RH Red Hat Enterprise Linux 10 Red Hat | 4.7 | Oct 14 | Clevis: clevis: pkcs#11 token pin written to world-readable file |
| CVE-2026-109969 | RH Red Hat Enterprise Linux 10 Red Hat | 4.7 | Oct 14 | Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask |
| CVE-2026-100231 | RH Red Hat Enterprise Linux 10 Red Hat | 6.1 | Oct 14 | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters |
| CVE-2026-88829 | RH Red Hat Hardened Images Red Hat | 7.2 | Oct 14 | Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy |
| CVE-2026-90954 | RH Red Hat Hardened Images Red Hat | 7.8 | Oct 14 | Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush |
| CVE-2026-86476 | RH Red Hat Enterprise Linux 10 Red Hat | 8.4 | Oct 14 | Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize |
| CVE-2026-73794 | HN HPE NonStop MODULAR NSJ Hewlett Packard Enterprise | 4.6 | Oct 14 | HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation |
| CVE-2026-73793 | HN HPE NonStop Middleware Hewlett Packard Enterprise | 7.9 | Oct 14 | HPE NonStop Middleware - Secret key handling vulnerability |
| CVE-2026-73792 | HN HPE NonStop Java JToolkit Hewlett Packard Enterprise | 3.8 | Oct 14 | HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability |
| CVE-2026-73791 | HN HPE NonStop Hpjmeter Hewlett Packard Enterprise | 2.0 | Oct 14 | HPE NonStop Hpjmeter - Buffer overflow vulnerability |
| CVE-2026-73790 | HN HPE NonStop iTP WebServer Hewlett Packard Enterprise | 8.2 | Oct 14 | HPE NonStop iTP WebServer - Memory corruption vulnerability |
| CVE-2026-14851 | CO Copart’s online billing service Copart | 9.2 | Oct 14 | Unauthorised disclosure of information on Copart’s online billing service |
| CVE-2026-103671 | AP AmazonPay Plugin (4.0 series) EC-CUBE CO.,LTD. | 4.7 | Oct 14 | External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" |
| CVE-2026-107428 | PV Paid Videochat Turnkey Site VideoWhisper.com | 7.1 | Oct 14 | WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-92392 | CU curl curl | 8.1 | Oct 14 | HTTP/2 upload Use-After-Free |
| CVE-2026-107757 | GC Gallery Custom Links tigroumeow | 4.9 | Oct 14 | Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body |
| CVE-2026-104909 | MB Mang Board kitae-park | 8.1 | Oct 14 | Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter |
| CVE-2026-104764 | PE Post Export Import with Media wpazleen | 7.2 | Oct 14 | Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter |