CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 11:09 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116393 New | OE Optima Express iHomefinder, Inc. | 7.5 | Oct 28 | WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability |
| CVE-2026-116404 New | RF Redux Framework David Anderson | 6.5 | Oct 28 | WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability |
| CVE-2026-111850 New | BU BuddyPress BuddyPress | 8.5 | Oct 28 | WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability |
| CVE-2026-115612 New | SL SliceWP iova.mihai | 7.1 | Oct 28 | WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115591 New | CF Contact Form by Supsystic Supsystic | 7.5 | Oct 28 | WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability |
| CVE-2026-115593 New | UE Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Unlimited Elements | 7.1 | Oct 28 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115596 New | EP eCommerce Product Catalog impleCode | 7.1 | Oct 28 | WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-111411 New | FA FunnelKit Automations Aman | 9.3 | Oct 28 | WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability |
| CVE-2026-115607 New | DT DXP ToolKit Crowd Favorite | 9.3 | Oct 28 | WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability |
| CVE-2026-115957 New | WD WP Discussion Board WP Discussion Board | 6.5 | Oct 28 | WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115606 New | DT DXP ToolKit Crowd Favorite | 7.1 | Oct 28 | WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115609 New | GE GetPaid Stiofan | 7.1 | Oct 28 | WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-55369 New | WA waline walinejs | 6.5 | Oct 28 | Waline login accepts a non-string email as a match-all MongoDB query |
| CVE-2026-115904 New | AP App topluyo | 9.6 | Oct 28 | Topluyo Desktop for Linux has an OS Command Injection issue |
| CVE-2026-93515 New | XO xorg-x11-server X.org | 6.8 | Oct 28 | .Org Server Present Extension Use-After-Free |
| CVE-2026-21830 New | BA BigFix AEX HCL Software | 3.7 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-118037 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing |
| CVE-2026-118036 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering |
| CVE-2026-118035 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing |
| CVE-2026-118040 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing |
| CVE-2026-118039 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing |
| CVE-2026-118038 New | TD Telerik Document Processing Libraries Progress Software | 7.1 | Oct 28 | Path Traversal in Telerik Document Processing Libraries AI Agent Tools |
| CVE-2026-67077 New | BA BigFix AEX HCL Software | 4.2 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-67079 New | BA BigFix AEX HCL Software | 6.4 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-67080 New | BA BigFix AEX HCL Software | 6.5 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-67073 New | BA BigFix AEX HCL Software | 8.6 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-67074 New | BA BigFix AEX HCL Software | 9.1 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-102790 New | IE iCagenda extension for Joomla icagenda.com | 8.6 | Oct 28 | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 |
| CVE-2026-81472 New | IS iDRAC Service Module for ESXi Dell | 4.2 | Oct 28 | Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an… |
| CVE-2026-114278 New | EC Eclipse Che Eclipse Foundation | 9.8 | Oct 28 | Unauthenticated Command Injection via kubeconfig Username in che-machine-exec |
| CVE-2026-102799 New | IE iCagenda extension for Joomla icagenda.com | 5.3 | Oct 28 | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 |
| CVE-2026-118485 New | AX Axel Axel Download Accelerator | 8.1 | Oct 28 | Axel Download Accelerator Path Traversal via URL Filename Decoding |
| CVE-2026-116855 New | MA My auctions allegro wphocus | 5.4 | Oct 28 | WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability |
| CVE-2026-118477 New | KA Kalifast EISGE | 9.8 | Oct 28 | KaliFast Project Management Platform ei_git_repo_url OS Command Injection |
| CVE-2026-6064 New | AA Avast Antivirus Gen Digital | 7.3 | Oct 28 | Norton, Avast, and AVG local privilege escalation via link following in Data Shredder |
| CVE-2026-115223 New | SP Smart Popup by Supsystic | 4.9 | Oct 28 | Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block |
| CVE-2026-110508 New | EA Essential Addons for Elementor | 5.3 | Oct 28 | Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification |
| CVE-2026-106648 New | RE Royal Elementor Addons | 5.3 | Oct 28 | Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes |
| CVE-2026-103330 New | SQ Sadad QA Payment | 5.3 | Oct 28 | Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass |
| CVE-2026-103313 New | BG BitPay Gateway for WooCommerce | 5.3 | Oct 28 | BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler |
| CVE-2026-99216 New | LI Linux Linux | – | Oct 28 | Drivers: hv: Don't reset VMBus connection state on error/exit paths |
| CVE-2026-99215 New | LI Linux Linux | – | Oct 28 | power: supply: core: prevent unregistering a power supply while a callback runs |
| CVE-2026-99214 New | LI Linux Linux | – | Oct 28 | drm/vc4: hdmi: Move packet RAM enable to PM runtime |
| CVE-2026-99213 New | LI Linux Linux | – | Oct 28 | vsock: treat TCP_CLOSING as once-established |
| CVE-2026-99212 New | LI Linux Linux | – | Oct 28 | net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure |
| CVE-2026-99211 New | LI Linux Linux | – | Oct 28 | netlink: reset skb headers before unicast and multicast filtering |
| CVE-2026-99210 New | LI Linux Linux | – | Oct 28 | accel/rocket: clear rdev on device init failure |
| CVE-2026-99209 New | LI Linux Linux | – | Oct 28 | drm/xe: skip eviction of a BO with no resource |
| CVE-2026-99208 New | LI Linux Linux | – | Oct 28 | drm/xe/oa: Zero OA buffer at allocation |
| CVE-2026-99207 New | LI Linux Linux | – | Oct 28 | scsi: target: Disable interrupts while holding delayed_cmd_lock |