CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 04:19 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-89314 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s |
| CVE-2026-89313 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil |
| CVE-2026-89312 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV |
| CVE-2025-58403 New | CC CGM CLININET CGM | 5.1 | Oct 23 | Reflected Cross-Site Scripting (XSS) in CGM CLININET |
| CVE-2025-30054 New | CC CGM CLININET CGM | 9.3 | Oct 23 | Local Privilege Escalation in CGM CLININET |
| CVE-2025-30053 New | CC CGM CLININET CGM | 6.9 | Oct 23 | Missing Authentication in CGM CLININET |
| CVE-2025-30052 New | CC CGM CLININET CGM | 8.8 | Oct 23 | Authentication Bypass via IP Spoofing in CGM CLININET rsyncd |
| CVE-2025-30051 New | CC CGM CLININET CGM | 6.8 | Oct 23 | Insecure File Permissions in CGM CLININET |
| CVE-2025-30050 New | CC CGM CLININET CGM | 9.4 | Oct 23 | Remote Code Execution in CGM CLININET |
| CVE-2025-30049 New | CC CGM CLININET CGM | 8.2 | Oct 23 | Use of Unsalted MD5 Password Hashes in CGM CLININET |
| CVE-2025-30047 New | CC CGM CLININET CGM | 9.4 | Oct 23 | Remote Code Execution via Java Deserialization in CGM CLININET |
| CVE-2025-30046 New | CC CGM CLININET CGM | 9.0 | Oct 23 | Remote Code Execution in CGM CLININET |
| CVE-2025-30045 New | CC CGM CLININET CGM | 8.6 | Oct 23 | Code Injection in CGM CLININET |
| CVE-2025-30043 New | CC CGM CLININET CGM | 7.1 | Oct 23 | Missing Authentication in CGM CLININET |
| CVE-2026-115657 New | KA KNIME Analytics Platform KNIME | 4.8 | Oct 23 | KNIME Analytics Platform logs credentials of configured proxy when used as an executor |
| CVE-2026-112860 New | PD Participants Database xnau webdesign | 9.3 | Oct 23 | WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability |
| CVE-2026-112862 New | PD Participants Database xnau webdesign | 9.8 | Oct 23 | WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability |
| CVE-2026-112835 New | VI VikRentCar e4jvikwp | 7.1 | Oct 23 | WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112837 New | GA GamiPress Ruben Garcia | 8.5 | Oct 23 | WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability |
| CVE-2026-112359 New | WP WPMobile.App Amauri.IO | 7.5 | Oct 23 | WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability |
| CVE-2026-112838 New | VI VikRentCar e4jvikwp | 7.1 | Oct 23 | WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112821 New | KP Knit Pay Knit Pay | 6.5 | Oct 23 | WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability |
| CVE-2026-112825 New | CR Car Rental Manager Magepeople inc. | 6.5 | Oct 23 | WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2026-4952 New | WA WebOrderSystem (AuftragsManager) VertiGIS Ltd. | 5.1 | Oct 23 | Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem |
| CVE-2026-4951 New | WK WebOrderSystem (KundenManager) VertiGIS Ltd. | 5.1 | Oct 23 | Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem |
| CVE-2026-4950 New | WK WebOrderSystem (KundenManager) VertiGIS Ltd. | 4.8 | Oct 23 | Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem |
| CVE-2026-63244 New | Product not mapped yet | 9.8 | Oct 23 | Authentication Bypass Vulnerability |
| CVE-2026-75775 New | RO Router ASUS | 7.7 | Oct 23 | Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted… |
| CVE-2026-93489 New | RO Router ASUS | 8.7 | Oct 23 | Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform… |
| CVE-2026-75779 New | RO Router ASUS | 8.6 | Oct 23 | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick… |
| CVE-2026-63243 New | CS Creative Sound Blaster Katana V2, V2X, SE Creative Labs | 4.3 | Oct 23 | Firmware verification vulnerability |
| CVE-2026-55981 New | CS Creative Sound Blaster Katana V2, V2X, SE Creative Labs | 9.6 | Oct 23 | Firmware verification vulnerability |
| CVE-2026-94268 New | AC Advanced Custom Fields: Extended | 8.1 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action |
| CVE-2026-94267 New | AC Advanced Custom Fields: Extended | 9.0 | Oct 23 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action |
| CVE-2026-94264 New | AC Advanced Custom Fields: Extended | 6.8 | Oct 23 | Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes |
| CVE-2026-94262 New | AC Advanced Custom Fields: Extended | 8.1 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action |
| CVE-2026-113501 New | LC LiteSpeed Cache | 3.1 | Oct 23 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal |
| CVE-2026-113500 New | LC LiteSpeed Cache | 7.5 | Oct 23 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization |
| CVE-2026-113499 New | LC LiteSpeed Cache | 7.5 | Oct 23 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting |
| CVE-2026-113472 New | DP Depicter — Popup & Slider Builder | 5.4 | Oct 23 | Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload |
| CVE-2026-112230 New | PB Popup Builder | 3.7 | Oct 23 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter |
| CVE-2026-112219 New | DM Download Monitor | 4.9 | Oct 23 | Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route |
| CVE-2026-111982 New | UP User Profile Builder | 7.2 | Oct 23 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change |
| CVE-2026-111966 New | UP User Profile Builder | 6.8 | Oct 23 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute |
| CVE-2026-111738 New | SO Speed Optimizer | 5.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option |
| CVE-2026-111737 New | SO Speed Optimizer | 3.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists |
| CVE-2026-110537 New | EA Essential Addons for Elementor | 3.8 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action |
| CVE-2026-110510 New | EA Essential Addons for Elementor | 3.5 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag |
| CVE-2026-109936 New | OB Otter Blocks | 7.5 | Oct 23 | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter |
| CVE-2026-109935 New | OB Otter Blocks | 5.3 | Oct 23 | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API |