CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 21:48 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111021 New | اپ افزونه پیامک ووکامرس | Persian WooCommerce SMS | 7.1 | Oct 28 | Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter |
| CVE-2026-105972 New | MC Menu Cart for WooCommerce | 7.5 | Oct 28 | WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute |
| CVE-2026-15323 New | PD Product Designer for WooCommerce WordPress | Lumise King-Theme | 7.5 | Oct 28 | Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload |
| CVE-2026-104384 New | AQ Aquila EagleCloud | 8.7 | Oct 28 | Insufficiently protected credentials in EagleCloud Aquila on-premises version |
| CVE-2026-1928 New | RM Rank Math SEO – AI SEO Tools to Dominate SEO Rankings rankmath | 8.8 | Oct 28 | Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution |
| CVE-2026-116613 New | AT Animated Text Block – Add Typing and Looping Text Effects bplugins | 7.5 | Oct 28 | Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute |
| CVE-2026-111255 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.5 | Oct 28 | affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter |
| CVE-2026-111314 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.2 | Oct 28 | affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter |
| CVE-2026-97019 New | AF AMP for WP – Accelerated Mobile Pages mohammed_kaludi | 7.2 | Oct 28 | AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute |
| CVE-2026-109999 New | AM AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot nalam-1 | 7.2 | Oct 28 | AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter |
| CVE-2026-118378 New | TA tabularis TabularisDB | 7.8 | Oct 28 | Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name |
| CVE-2026-118377 New | PO pos mewebstudio | 7.5 | Oct 28 | mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks |
| CVE-2026-118375 New | LL llama.cpp ggml-org | 8.1 | Oct 28 | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() |
| CVE-2026-117609 New | RT rtl_433 merbanan | 7.1 | Oct 28 | rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder |
| CVE-2026-117607 New | XE xerteonlinetoolkits thexerteproject | 7.2 | Oct 28 | Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import |
| CVE-2015-20129 New | CR CrushFTP CrushFTP | 8.8 | Oct 28 | CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ |
| CVE-2014-125138 New | CE Cart Engine C97net | 8.8 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields |
| CVE-2013-20007 New | WA WAG200G Linksys | 7.2 | Oct 28 | Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi |
| CVE-2026-110747 New | JA jackson-dataformat-protobuf FasterXML | 7.5 | Oct 28 | jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload |
| CVE-2026-104895 New | JA jackson-dataformat-smile FasterXML | 7.5 | Oct 28 | jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service |
| CVE-2026-104016 New | JA jackson-dataformat-protobuf FasterXML | 7.5 | Oct 27 | jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError |
| CVE-2026-118338 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118356 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118315 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118330 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118341 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118347 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118314 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a… |
| CVE-2026-118335 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a… |
| CVE-2026-118346 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118304 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118345 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118313 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118334 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118311 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118343 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted… |
| CVE-2026-118359 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118327 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118349 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118353 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118358 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118336 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML… |
| CVE-2026-118328 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML… |
| CVE-2026-118351 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118307 New | CH Chrome Google | 8.8 | Oct 27 | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118352 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118354 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML… |
| CVE-2026-118329 New | CH Chrome Google | 8.8 | Oct 27 | Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a… |
| CVE-2026-118320 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-118317 New | CH Chrome Google | 8.8 | Oct 27 | Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |