CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 19:54 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118037 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing |
| CVE-2026-118036 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering |
| CVE-2026-118035 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing |
| CVE-2026-118040 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing |
| CVE-2026-118039 New | TD Telerik Document Processing Libraries Progress Software | 7.5 | Oct 28 | XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing |
| CVE-2026-118038 New | TD Telerik Document Processing Libraries Progress Software | 7.1 | Oct 28 | Path Traversal in Telerik Document Processing Libraries AI Agent Tools |
| CVE-2026-67073 New | BA BigFix AEX HCL Software | 8.6 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-102790 New | IE iCagenda extension for Joomla icagenda.com | 8.6 | Oct 28 | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 |
| CVE-2026-118485 New | AX Axel Axel Download Accelerator | 8.1 | Oct 28 | Axel Download Accelerator Path Traversal via URL Filename Decoding |
| CVE-2026-6064 New | AA Avast Antivirus Gen Digital | 7.3 | Oct 28 | Norton, Avast, and AVG local privilege escalation via link following in Data Shredder |
| CVE-2026-110541 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-110540 New | PD PowerProtect Data Domain Management Center Dell | 7.1 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-103779 New | PD PowerProtect Data Domain Dell | 8.3 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-112198 New | ND NoviGest Desktop App Tactis | 8.3 | Oct 28 | Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App |
| CVE-2026-87102 New | AC Acronis Cyber Protect 17 Acronis | 7.4 | Oct 28 | Sensitive information disclosure and manipulation due to improper token validation |
| CVE-2025-30414 New | AC Acronis Cyber Protect 17 Acronis | 7.1 | Oct 28 | Local privilege escalation due to improper authentication |
| CVE-2026-87103 New | AC Acronis Cyber Protect 17 Acronis | 7.4 | Oct 28 | Sensitive information disclosure and manipulation due to improper token validation |
| CVE-2026-86377 New | PD PowerProtect Data Domain Dell | 7.6 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86378 New | PD PowerProtect Data Domain Dell | 8.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86379 New | PD PowerProtect Data Domain Management Center Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-86380 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86385 New | PD PowerProtect Data Domain Dell | 8.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability |
| CVE-2026-86389 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86393 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86394 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86395 New | PD PowerProtect Data Domain Virtual Edition Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0… |
| CVE-2026-86396 New | PD PowerProtect Data Domain Dell | 8.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86398 New | PD PowerProtect Data Domain Dell | 8.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86399 New | PD PowerProtect Data Domain Dell | 7.2 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-92797 New | ME Memberpress MemberPress | 8.8 | Oct 28 | Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter |
| CVE-2026-63286 New | AC AXIS Camera Station 5 Axis Communications AB | 7.1 | Oct 28 | Database backups are vulnerable to offline attacks |
| CVE-2026-111111 New | PS Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons bdthemes | 7.2 | Oct 28 | Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape |
| CVE-2026-109384 New | TI The Innovative Form Builder – IvyForms melograno | 8.8 | Oct 28 | The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload |
| CVE-2026-111120 New | VC VikRentCar Car Rental Management System e4jvikwp | 8.8 | Oct 28 | VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task |
| CVE-2026-110662 New | MA MxChat – AI Chatbot & Content Generation for WordPress mxchat | 7.2 | Oct 28 | MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating |
| CVE-2026-109381 New | EB Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar magepeopleteam | 7.2 | Oct 28 | Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter |
| CVE-2026-111577 New | GO GoSMTP | 7.2 | Oct 28 | GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings |
| CVE-2026-111021 New | اپ افزونه پیامک ووکامرس | Persian WooCommerce SMS | 7.1 | Oct 28 | Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter |
| CVE-2026-105972 New | MC Menu Cart for WooCommerce | 7.5 | Oct 28 | WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute |
| CVE-2026-15323 New | PD Product Designer for WooCommerce WordPress | Lumise King-Theme | 7.5 | Oct 28 | Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload |
| CVE-2026-104384 New | AQ Aquila EagleCloud | 8.7 | Oct 28 | Insufficiently protected credentials in EagleCloud Aquila on-premises version |
| CVE-2026-1928 New | RM Rank Math SEO – AI SEO Tools to Dominate SEO Rankings rankmath | 8.8 | Oct 28 | Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution |
| CVE-2026-116613 New | AT Animated Text Block – Add Typing and Looping Text Effects bplugins | 7.5 | Oct 28 | Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute |
| CVE-2026-111255 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.5 | Oct 28 | affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter |
| CVE-2026-111314 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.2 | Oct 28 | affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter |
| CVE-2026-97019 New | AF AMP for WP – Accelerated Mobile Pages mohammed_kaludi | 7.2 | Oct 28 | AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute |
| CVE-2026-109999 New | AM AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot nalam-1 | 7.2 | Oct 28 | AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter |
| CVE-2026-118378 New | TA tabularis TabularisDB | 7.8 | Oct 28 | Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name |
| CVE-2026-118377 New | PO pos mewebstudio | 7.5 | Oct 28 | mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks |
| CVE-2026-118375 New | LL llama.cpp ggml-org | 8.1 | Oct 28 | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() |