CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 15:06 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-50543 New | XI xibo-cms xibosignage | 4.3 | Oct 28 | Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices |
| CVE-2026-50539 New | XI xibo-cms xibosignage | 6.5 | Oct 28 | Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments |
| CVE-2026-112356 New | GK GFI KerioConnect GFI USA, LLC | 6.1 | Oct 28 | GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter |
| CVE-2026-115402 New | OV ovpn-dco-win OpenVPN | 5.7 | Oct 28 | OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path |
| CVE-2026-50541 New | XI xibo-cms xibosignage | 6.5 | Oct 28 | Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export |
| CVE-2026-59959 New | SA sail HappySeaFox | 4.8 | Oct 28 | SAIL: WebP decoder division by zero through malformed animated canvas metadata |
| CVE-2026-93516 New | XO xorg-x11-server x.org | 5.5 | Oct 28 | .Org Server XInput Passive Grab Use-After-Free |
| CVE-2026-116404 New | RF Redux Framework David Anderson | 6.5 | Oct 28 | WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability |
| CVE-2026-115957 New | WD WP Discussion Board WP Discussion Board | 6.5 | Oct 28 | WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-55369 New | WA waline walinejs | 6.5 | Oct 28 | Waline login accepts a non-string email as a match-all MongoDB query |
| CVE-2026-93515 New | XO xorg-x11-server X.org | 6.8 | Oct 28 | .Org Server Present Extension Use-After-Free |
| CVE-2026-67077 New | BA BigFix AEX HCL Software | 4.2 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-67079 New | BA BigFix AEX HCL Software | 6.4 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-67080 New | BA BigFix AEX HCL Software | 6.5 | Oct 28 | HCL BigFix AEX is affected by multiple security vulnerabilities. |
| CVE-2026-81472 New | IS iDRAC Service Module for ESXi Dell | 4.2 | Oct 28 | Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an… |
| CVE-2026-102799 New | IE iCagenda extension for Joomla icagenda.com | 5.3 | Oct 28 | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16 |
| CVE-2026-116855 New | MA My auctions allegro wphocus | 5.4 | Oct 28 | WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability |
| CVE-2026-115223 New | SP Smart Popup by Supsystic | 4.9 | Oct 28 | Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block |
| CVE-2026-110508 New | EA Essential Addons for Elementor | 5.3 | Oct 28 | Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification |
| CVE-2026-106648 New | RE Royal Elementor Addons | 5.3 | Oct 28 | Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes |
| CVE-2026-103330 New | SQ Sadad QA Payment | 5.3 | Oct 28 | Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass |
| CVE-2026-103313 New | BG BitPay Gateway for WooCommerce | 5.3 | Oct 28 | BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler |
| CVE-2026-101274 New | Product not mapped yet | 6.9 | Oct 28 | When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an… |
| CVE-2026-101273 New | Product not mapped yet | 5.3 | Oct 28 | Giftcard enumeration |
| CVE-2026-87879 New | AC Acronis Cyber Protect 17 Acronis | 5.9 | Oct 28 | Sensitive information disclosure due to improper token validation |
| CVE-2026-87878 New | AC Acronis Cyber Protect 17 Acronis | 6.3 | Oct 28 | Linux binaries have executable stack attribute enabled |
| CVE-2026-87099 New | AC Acronis Cyber Protect 17 Acronis | 5.7 | Oct 28 | Cross-site scripting (XSS) vulnerability due to improper input validation |
| CVE-2026-87880 New | AC Acronis Cyber Protect 17 Acronis | 6.8 | Oct 28 | Sensitive information disclosure due to missing SSL certificate verification affecting one component |
| CVE-2026-87101 New | AC Acronis Cyber Protect 17 Acronis | 6.2 | Oct 28 | Sensitive information disclosure due to improper token validation |
| CVE-2026-87097 New | AC Acronis Cyber Protect 17 Acronis | 5.3 | Oct 28 | Sensitive information disclosure due to insufficiently protected credentials |
| CVE-2026-86383 New | PD PowerProtect Data Domain Dell | 6.8 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20,… |
| CVE-2026-86386 New | PD PowerProtect Data Domain Management Center Dell | 4.3 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-86388 New | PD PowerProtect Data Domain Dell | 5.3 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-92665 New | PD PowerProtect Data Domain Dell | 5.3 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-105457 New | LM Liman MYS HAVELSAN Inc. | 6.5 | Oct 28 | Authenticated Arbitrary Local File Read via Path Traversal in HAVELSAN's Liman MYS |
| CVE-2026-86390 New | PD PowerProtect Data Domain Dell | 6.5 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-86391 New | PD PowerProtect Data Domain Management Center Dell | 6.4 | Oct 28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions… |
| CVE-2026-86392 New | PD PowerProtect Data Domain Dell | 4.9 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-16020 New | DF DefterAsist Financial Advisor Platform Fazile BACAK | 5.4 | Oct 28 | Stored XSS Fazile BACAK's DefterAsist Financial Advisor Platform |
| CVE-2026-90720 New | PD PowerProtect Data Domain Dell | 6.7 | Oct 28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through… |
| CVE-2026-118435 New | Product not mapped yet | 5.4 | Oct 28 | Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation |
| CVE-2026-85655 New | EM Enable Media Replace shortpixel | 4.3 | Oct 28 | Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow |
| CVE-2026-101935 New | EK Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search echoplugins | 6.1 | Oct 28 | Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter |
| CVE-2026-109975 New | CB Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox cozythemes | 6.4 | Oct 28 | Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute |
| CVE-2026-76005 New | WI WP Inventory Manager chuck1982 | 6.5 | Oct 28 | WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute |
| CVE-2026-118169 New | HE Hustle – Email Marketing, Lead Generation, Optins, Popups wpmudev | 4.9 | Oct 28 | Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter |
| CVE-2026-104743 New | TA Tainacan tainacan | 4.9 | Oct 28 | Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment |
| CVE-2026-76780 New | BA BeyondSEO – AI SEO to Improve Rankings, Listings & Online Visibility rankingcoach | 6.3 | Oct 28 | BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation |
| CVE-2026-110185 New | BF Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More bitpressadmin | 5.9 | Oct 28 | Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters |
| CVE-2026-116750 New | VC VikRentCar Car Rental Management System e4jvikwp | 6.5 | Oct 28 | VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute |