CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:02 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-80174 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.3 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability |
| CVE-2026-86777 | AL alchemy_cms AlchemyCMS | 5.3 | Sep 9 | AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes |
| CVE-2026-86547 | MR mrubyc mrubyc | 6.2 | Sep 9 | mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER |
| CVE-2026-78377 | LI Library Information and Document Automation Program Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. | 6.1 | Sep 9 | Open Redirect in Yordam Informatics's Library Automation System |
| CVE-2026-19733 | LI Library Information and Document Automation Program Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. | 5.3 | Sep 9 | SSRF in Yordam Informatics's Library Automation System |
| CVE-2025-3271 | DW Documentum Webtop OpenText™ | 4.8 | Sep 9 | DOM-based XSS vulnerability in OpenText™ Documentum Webtop |
| CVE-2026-11838 | LR Library Reservation System Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. | 4.3 | Sep 9 | Improper Authorization in Yordam Informatics' Library Reservation System |
| CVE-2026-79974 | SC Secure Connect Gateway 5.0 - Appliance Dell | 6.4 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability |
| CVE-2026-79967 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.6 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability |
| CVE-2026-79973 | SC Secure Connect Gateway 5.0 - Appliance Dell | 6.3 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Unsynchronized Access to Shared Data in a Multithreaded… |
| CVE-2026-79640 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.4 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an… |
| CVE-2025-46808 | NE neuvector SUSE | 6.8 | Sep 9 | Sensitive information is leaked into NeuVector’s manager container logs |
| CVE-2026-80124 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.5 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File… |
| CVE-2026-80177 | SC Secure Connect Gateway 5.0 - Appliance Dell | 6.5 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an… |
| CVE-2026-80055 | SC Secure Connect Gateway 5.0 - Appliance Dell | 4.4 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an… |
| CVE-2026-17149 | PM Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred saadiqbal | 6.4 | Sep 9 | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute |
| CVE-2026-19778 | WG WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping aukejomm | 6.5 | Sep 9 | WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter |
| CVE-2026-19729 | RH Red Hat build of Keycloak 26.4 Red Hat | 4.9 | Sep 9 | Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters |
| CVE-2026-19802 | CC Checkout Custom Fields Builder for WooCommerce stylemix | 4.3 | Sep 9 | Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter |
| CVE-2026-87747 | EC Enterprise Cloud Database Ragic | 4.9 | Sep 9 | Ragic｜Enterprise Cloud Database - Arbitrary File Read |
| CVE-2026-85117 | CF Contact Form 7 Captcha | 6.5 | Sep 9 | Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation |
| CVE-2026-83537 | WE WP Express Checkout | 5.3 | Sep 9 | WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment |
| CVE-2026-80440 | HU Hustle | 4.8 | Sep 9 | Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders |
| CVE-2026-19855 | CL CleanTalk | 6.5 | Sep 9 | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text |
| CVE-2025-7062 | H5 h5p-nodejs-library Lumi Education UG | 5.2 | Sep 9 | Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education |
| CVE-2026-85418 | OF Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | 5.4 | Sep 9 | Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget |
| CVE-2026-85133 | WC WPLP Cookie Consent | 5.4 | Sep 9 | WPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions |
| CVE-2026-85132 | WC WPLP Cookie Consent | 4.3 | Sep 9 | WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan |
| CVE-2026-85037 | SP Sunshine Photo Cart | 5.3 | Sep 9 | Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR |
| CVE-2026-84222 | KI Kirki | 5.3 | Sep 9 | Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter |
| CVE-2026-84113 | QW Quentn WP | 4.1 | Sep 9 | Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter |
| CVE-2026-83541 | SE Sina Extension for Elementor | 6.8 | Sep 9 | Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget |
| CVE-2026-82848 | ML Masteriyo LMS | 5.3 | Sep 9 | Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure |
| CVE-2026-82185 | WC WPLP Cookie Consent | 4.3 | Sep 9 | WPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset |
| CVE-2026-82184 | WC WPLP Cookie Consent | 5.3 | Sep 9 | WPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update |
| CVE-2026-81741 | GC Groundhogg — CRM, Newsletters, and Marketing Automation | 4.7 | Sep 9 | Groundhogg < 4.7.2 - Open Redirect via 'redirect_to' Parameter |
| CVE-2026-81022 | SU SupportCandy | 5.3 | Sep 9 | SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak |
| CVE-2026-81021 | SU SupportCandy | 5.3 | Sep 9 | SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure |
| CVE-2026-80341 | PP Payment Plugins for PayPal WooCommerce | 5.9 | Sep 9 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR |
| CVE-2026-80340 | PP Payment Plugins for PayPal WooCommerce | 5.3 | Sep 9 | Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay |
| CVE-2026-80339 | PP Payment Plugins for Stripe WooCommerce | 5.3 | Sep 9 | Payment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay |
| CVE-2026-75861 | UG Ultimate Gift Cards for WooCommerce | 6.5 | Sep 9 | Ultimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption |
| CVE-2026-18042 | WT WP Travel | 5.3 | Sep 9 | WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation |
| CVE-2025-15690 | CM Content Mask | 6.8 | Sep 9 | Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles |
| CVE-2026-75905 | WR WP Recipe Maker brechtvds | 4.3 | Sep 9 | WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode |
| CVE-2026-8615 | IR ilGhera Reviso Exporter for WooCommerce ghera74 | 4.3 | Sep 9 | ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function |
| CVE-2026-84908 | WF WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell getwpfunnels | 5.3 | Sep 9 | WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action |
| CVE-2026-19946 | AS Awesome Support – WordPress HelpDesk & Support Plugin awesomesupport | 4.3 | Sep 9 | Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter |
| CVE-2026-21113 | VV Visual Voicemail Samsung Mobile | 5.5 | Sep 9 | Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission |
| CVE-2026-21112 | ST Samsung Tips Samsung Mobile | 5.5 | Sep 9 | Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege |