CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 20:26 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107100 New | RA Royal Addons for Elementor | 5.3 | Oct 28 | Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content |
| CVE-2026-107098 New | RA Royal Addons for Elementor | 6.8 | Oct 28 | Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting |
| CVE-2026-107097 New | RA Royal Addons for Elementor | 5.3 | Oct 28 | Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe |
| CVE-2026-106003 New | CR Court Reservation | 5.3 | Oct 28 | Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion |
| CVE-2026-106002 New | CR Court Reservation | 5.3 | Oct 28 | Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion |
| CVE-2026-105997 New | BP Booking Package | 5.3 | Oct 28 | Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient |
| CVE-2026-104694 New | TA Thrive Automator | 6.8 | Oct 28 | Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter |
| CVE-2026-103382 New | CF Casso Flow | 5.3 | Oct 28 | Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation |
| CVE-2026-103372 New | PA Payconiq | 5.3 | Oct 28 | Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure |
| CVE-2026-103331 New | UP UniPAY Payment Gateway For WooCommerce | 5.3 | Oct 28 | UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret |
| CVE-2026-109236 New | CE Customer Email Verification for WooCommerce zorem | 4.8 | Oct 28 | Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter |
| CVE-2026-115522 New | AD Agent Development Kit (ADK) for Python Google | 5.3 | Oct 28 | Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python |
| CVE-2026-111727 New | AB Appointment Booking Calendar codepeople | 6.4 | Oct 28 | Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter |
| CVE-2026-118275 New | A2 a2ui a2ui-project | 5.3 | Oct 28 | a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption |
| CVE-2026-118384 New | MT mtools GNU | 6.1 | Oct 28 | GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c |
| CVE-2026-118274 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui Binder generic-binder.ts resource consumption |
| CVE-2026-118273 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui data-model.ts DataModel.set resource consumption |
| CVE-2026-107745 New | AE AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini tigroumeow | 4.2 | Oct 28 | AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter |
| CVE-2026-109209 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC |
| CVE-2026-109974 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute |
| CVE-2026-107625 New | UM Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimatemember | 6.4 | Oct 28 | Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field |
| CVE-2026-115624 New | GR GROWI GROWI, Inc. | 5.3 | Oct 28 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature |
| CVE-2026-109848 New | GR GROWI GROWI, Inc. | 4.2 | Oct 28 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key |
| CVE-2026-105272 New | GR GROWI GROWI, Inc. | 4.2 | Oct 28 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key |
| CVE-2026-118376 New | WE WeKnora Tencent | 5.3 | Oct 28 | WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses |
| CVE-2026-118374 New | LI LibreSSL OpenBSD | 5.9 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response |
| CVE-2026-118370 New | LI libexpat libexpat | 5.9 | Oct 28 | libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes |
| CVE-2026-117610 New | LI libexpat libexpat | 5.9 | Oct 28 | libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser |
| CVE-2026-117608 New | AS assimp assimp | 6.1 | Oct 28 | Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow |
| CVE-2026-117606 New | NE NexoPOS Blair2004 | 5.4 | Oct 28 | NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions |
| CVE-2026-117605 New | NO nopCommerce nopSolutions | 4.3 | Oct 28 | nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers |
| CVE-2014-125137 New | CE Cart Engine C97net | 6.5 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php |
| CVE-2014-125136 New | CE Cart Engine C97net | 5.9 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup |
| CVE-2013-20009 New | WA WAG200G Linksys | 4.8 | Oct 28 | Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter |
| CVE-2013-20008 New | WA WAG200G Linksys | 6.8 | Oct 28 | Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password |
| CVE-2026-118272 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure |
| CVE-2026-118271 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui data-context Resolver data-context.ts resource consumption |
| CVE-2026-118129 New | CH Chitchatter jeremyckahn | 6.3 | Oct 27 | jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication |
| CVE-2026-50571 New | WE websub w3c | 5.7 | Oct 27 | WebSub: Reflected script execution through intent-verification challenges |
| CVE-2026-22063 New | ES E-Series SANtricity OS Controller Software NetApp | 6.0 | Oct 27 | CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products |
| CVE-2026-58496 New | TH thorvg thorvg | 4.3 | Oct 27 | ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API |
| CVE-2026-118128 New | A2 a2a-js a2aproject | 6.5 | Oct 27 | a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition |
| CVE-2026-57203 New | AS asterisk asterisk | 6.9 | Oct 27 | Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location |
| CVE-2026-57192 New | AS asterisk asterisk | 6.0 | Oct 27 | Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch |
| CVE-2026-116774 New | RU russh Eugeny | 4.3 | Oct 27 | russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) |
| CVE-2026-116773 New | RU russh Eugeny | 4.3 | Oct 27 | russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets |
| CVE-2026-116695 New | CR crass rgrove | 5.3 | Oct 27 | Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass |
| CVE-2026-116694 New | OP opentelemetry-python open-telemetry | 6.3 | Oct 27 | OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation |
| CVE-2026-116691 New | ML mlflow mlflow | 6.5 | Oct 27 | MLflow CrewAI autologging records LLM provider API keys in logged trace spans |
| CVE-2026-116689 New | FO follow-redirects follow-redirects | 5.9 | Oct 27 | follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects |