CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 13:30 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116613 New | AT Animated Text Block – Add Typing and Looping Text Effects bplugins | 7.5 | Oct 28 | Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute |
| CVE-2026-111255 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.5 | Oct 28 | affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter |
| CVE-2026-111314 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.2 | Oct 28 | affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter |
| CVE-2026-97019 New | AF AMP for WP – Accelerated Mobile Pages mohammed_kaludi | 7.2 | Oct 28 | AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute |
| CVE-2026-109999 New | AM AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot nalam-1 | 7.2 | Oct 28 | AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter |
| CVE-2026-118378 New | TA tabularis TabularisDB | 7.8 | Oct 28 | Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name |
| CVE-2026-118377 New | PO pos mewebstudio | 7.5 | Oct 28 | mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks |
| CVE-2026-118375 New | LL llama.cpp ggml-org | 8.1 | Oct 28 | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() |
| CVE-2026-117609 New | RT rtl_433 merbanan | 7.1 | Oct 28 | rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder |
| CVE-2026-117607 New | XE xerteonlinetoolkits thexerteproject | 7.2 | Oct 28 | Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import |
| CVE-2015-20129 New | CR CrushFTP CrushFTP | 8.8 | Oct 28 | CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ |
| CVE-2014-125138 New | CE Cart Engine C97net | 8.8 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields |
| CVE-2013-20007 New | WA WAG200G Linksys | 7.2 | Oct 28 | Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi |
| CVE-2026-110747 New | JA jackson-dataformat-protobuf FasterXML | 7.5 | Oct 28 | jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload |
| CVE-2026-104895 New | JA jackson-dataformat-smile FasterXML | 7.5 | Oct 28 | jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service |
| CVE-2026-104016 New | JA jackson-dataformat-protobuf FasterXML | 7.5 | Oct 27 | jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError |
| CVE-2026-118338 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-59158 New | NU nuxt-ollama thoda-dev | 7.5 | Oct 27 | Nuxt Ollama: public runtime configuration discloses the configured cloud API key |
| CVE-2026-58257 New | GR GRR JeromeDevome | 7.2 | Oct 27 | GRR vulnerable to Arbitrary File Read and Deletion |
| CVE-2026-58255 New | CR Cronicle jhuckaby | 8.8 | Oct 27 | Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401 |
| CVE-2026-58205 New | GR GRR JeromeDevome | 8.1 | Oct 27 | GRR has a Reflected XSS issue |
| CVE-2026-57190 New | AS asterisk asterisk | 7.0 | Oct 27 | Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field |
| CVE-2026-62765 New | ME Microsoft Edge (Chromium-based) Microsoft | 7.5 | Oct 27 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-57191 New | AS asterisk asterisk | 8.2 | Oct 27 | Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing |
| CVE-2026-57186 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser |
| CVE-2026-57200 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE |
| CVE-2026-57195 New | AS asterisk asterisk | 7.5 | Oct 27 | Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication |
| CVE-2026-85898 New | ME Microsoft Edge (Chromium-based) Microsoft | 8.8 | Oct 27 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-83831 New | ME Microsoft Edge (Chromium-based) Microsoft | 8.8 | Oct 27 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-116693 New | DD dd-trace-js DataDog | 8.7 | Oct 27 | dd-trace: ReDOS in URL query string obfuscation |
| CVE-2026-112351 New | SU SureLine Sunhillo Corporation | 8.8 | Oct 27 | Sunhillo SureLine OS Command Injection via networkDiag.cgi |
| CVE-2026-112350 New | SU SureLine Sunhillo Corporation | 7.5 | Oct 27 | Sunhillo SureLine Path Traversal via radarUpdater.cgi |
| CVE-2026-116690 New | ML mlflow mlflow | 7.5 | Oct 27 | MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source |
| CVE-2026-116688 New | CK ckeditor5 ckeditor | 8.1 | Oct 27 | CKEditor: Cross-site scripting (XSS) in the engine package |
| CVE-2026-112355 New | ME MembershipWorks MembershipWorks | 7.5 | Oct 27 | MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API |
| CVE-2026-116683 New | TE terraform-provider-ctfd ctfer-io | 7.1 | Oct 27 | CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values |
| CVE-2026-115413 New | AW aws-api-mcp-server AWS | 7.8 | Oct 27 | AWS API MCP Server OAuth Token Audience Validation Bypass |
| CVE-2026-57202 New | AS asterisk asterisk | 8.1 | Oct 27 | Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes |
| CVE-2026-57188 New | AS asterisk asterisk | 7.1 | Oct 27 | Asterisk: Stack buffer overflow in res_xmpp XMPP namespace prefix handling |
| CVE-2026-116682 New | FI filebrowser gtsteffaniak | 8.6 | Oct 27 | FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory |
| CVE-2026-88812 New | XO xorg-x11-server X.org | 7.8 | Oct 27 | X.Org Server XKB SetGeometry TextDoodad Double Free |
| CVE-2026-102814 New | RV RE305 v3 TP-Link Systems Inc. | 8.7 | Oct 27 | Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305 |
| CVE-2026-108303 New | CM Certificate Manager Tanium | 8.8 | Oct 27 | Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. |
| CVE-2026-116656 New | EN Enforce Tanium | 7.5 | Oct 27 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
| CVE-2026-108306 New | EN end-user-cx Tanium | 7.8 | Oct 27 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| CVE-2026-108329 New | TR Threat Response Tanium | 8.8 | Oct 27 | Tanium addressed an unauthorized code execution vulnerability in Threat Response. |
| CVE-2026-108304 New | EN end-user-cx Tanium | 7.8 | Oct 27 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| CVE-2026-87086 New | PR Provision Tanium | 7.5 | Oct 27 | Tanium addressed a denial of service vulnerability in Provision. |
| CVE-2026-116649 New | EN Enforce Tanium | 7.1 | Oct 27 | Tanium addressed an improper output sanitization vulnerability in Enforce. |
| CVE-2026-116647 New | CO Comply Tanium | 7.1 | Oct 27 | Tanium addressed an improper output sanitization vulnerability in Comply. |