CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:08 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-15323 New | PD Product Designer for WooCommerce WordPress | Lumise King-Theme | 7.5 | Oct 28 | Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload |
| CVE-2026-109236 New | CE Customer Email Verification for WooCommerce zorem | 4.8 | Oct 28 | Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter |
| CVE-2026-115522 New | AD Agent Development Kit (ADK) for Python Google | 5.3 | Oct 28 | Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python |
| CVE-2026-104384 New | AQ Aquila EagleCloud | 8.7 | Oct 28 | Insufficiently protected credentials in EagleCloud Aquila on-premises version |
| CVE-2026-104383 New | AQ Aquila EagleCloud | 9.4 | Oct 28 | Code injection in EagleCloud Aquila on-premises version |
| CVE-2026-99100 New | LI Linux Linux | – | Oct 28 | wifi: p54: validate firmware record lengths |
| CVE-2026-118276 New | A2 a2ui a2ui-project | 3.5 | Oct 28 | a2ui-project a2ui Parser expression_parser.ts formatString resource consumption |
| CVE-2026-111727 New | AB Appointment Booking Calendar codepeople | 6.4 | Oct 28 | Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter |
| CVE-2026-1928 New | RM Rank Math SEO – AI SEO Tools to Dominate SEO Rankings rankmath | 8.8 | Oct 28 | Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution |
| CVE-2026-116613 New | AT Animated Text Block – Add Typing and Looping Text Effects bplugins | 7.5 | Oct 28 | Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute |
| CVE-2026-111255 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.5 | Oct 28 | affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter |
| CVE-2026-118275 New | A2 a2ui a2ui-project | 5.3 | Oct 28 | a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption |
| CVE-2026-118384 New | MT mtools GNU | 6.1 | Oct 28 | GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c |
| CVE-2026-118274 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui Binder generic-binder.ts resource consumption |
| CVE-2026-118273 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui data-model.ts DataModel.set resource consumption |
| CVE-2026-107745 New | AE AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini tigroumeow | 4.2 | Oct 28 | AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter |
| CVE-2026-109209 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC |
| CVE-2026-111314 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.2 | Oct 28 | affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter |
| CVE-2026-97019 New | AF AMP for WP – Accelerated Mobile Pages mohammed_kaludi | 7.2 | Oct 28 | AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute |
| CVE-2026-109999 New | AM AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot nalam-1 | 7.2 | Oct 28 | AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter |
| CVE-2026-109974 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute |
| CVE-2026-84999 New | PR Pie Register Premium Pie Register | 9.8 | Oct 28 | Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler |
| CVE-2026-107625 New | UM Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimatemember | 6.4 | Oct 28 | Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field |
| CVE-2026-115624 New | GR GROWI GROWI, Inc. | 5.3 | Oct 28 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature |
| CVE-2026-109848 New | GR GROWI GROWI, Inc. | 4.2 | Oct 28 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key |
| CVE-2026-105272 New | GR GROWI GROWI, Inc. | 4.2 | Oct 28 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key |
| CVE-2026-118378 New | TA tabularis TabularisDB | 7.8 | Oct 28 | Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name |
| CVE-2026-118377 New | PO pos mewebstudio | 7.5 | Oct 28 | mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks |
| CVE-2026-118376 New | WE WeKnora Tencent | 5.3 | Oct 28 | WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses |
| CVE-2026-118375 New | LL llama.cpp ggml-org | 8.1 | Oct 28 | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() |
| CVE-2026-118374 New | LI LibreSSL OpenBSD | 5.9 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response |
| CVE-2026-118373 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host() |
| CVE-2026-118372 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path |
| CVE-2026-118371 New | LI LibreSSL OpenBSD | 3.7 | Oct 28 | LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line |
| CVE-2026-118370 New | LI libexpat libexpat | 5.9 | Oct 28 | libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes |
| CVE-2026-117610 New | LI libexpat libexpat | 5.9 | Oct 28 | libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser |
| CVE-2026-117609 New | RT rtl_433 merbanan | 7.1 | Oct 28 | rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder |
| CVE-2026-117608 New | AS assimp assimp | 6.1 | Oct 28 | Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow |
| CVE-2026-117607 New | XE xerteonlinetoolkits thexerteproject | 7.2 | Oct 28 | Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import |
| CVE-2026-117606 New | NE NexoPOS Blair2004 | 5.4 | Oct 28 | NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions |
| CVE-2026-117605 New | NO nopCommerce nopSolutions | 4.3 | Oct 28 | nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers |
| CVE-2015-20129 New | CR CrushFTP CrushFTP | 8.8 | Oct 28 | CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/ |
| CVE-2014-125138 New | CE Cart Engine C97net | 8.8 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields |
| CVE-2014-125137 New | CE Cart Engine C97net | 6.5 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php |
| CVE-2014-125136 New | CE Cart Engine C97net | 5.9 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup |
| CVE-2013-20009 New | WA WAG200G Linksys | 4.8 | Oct 28 | Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter |
| CVE-2013-20008 New | WA WAG200G Linksys | 6.8 | Oct 28 | Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password |
| CVE-2013-20007 New | WA WAG200G Linksys | 7.2 | Oct 28 | Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi |
| CVE-2026-118272 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure |
| CVE-2026-106013 New | JX Jupiter X Core artbees | 9.8 | Oct 28 | Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter |