CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-84816 | WP WPCS RealMag777 | 7.1 | Sep 10 | WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-81805 | SI SiteSkite SiteSkite | 8.1 | Sep 10 | WordPress SiteSkite plugin <= 2.1.5 - Privilege Escalation vulnerability |
| CVE-2026-81804 | ZB ZHBackup – Backup, Restore & Migration Zain Hassan | 7.5 | Sep 10 | WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability |
| CVE-2026-81803 | RE RepairBuddy Ateeq Rafeeq | 7.5 | Sep 10 | WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-81801 | WP WP-Stateless UDX Usability Dynamics | 8.1 | Sep 10 | WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability |
| CVE-2026-81799 | RR Return Refund and Exchange For WooCommerce WP Swings | 7.5 | Sep 10 | WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability |
| CVE-2026-81796 | WT WP Travel WEN Solutions | 7.3 | Sep 10 | WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability |
| CVE-2026-81795 | PV Page Visits Counter – Lite Denis Botić | 7.1 | Sep 10 | WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-81794 | SP Shirt Product Designer for WooCommerce mlfactory | 7.5 | Sep 10 | WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability |
| CVE-2026-81789 | AP Advanced Product Fields Extended for WooCommerce Studio Wombat | 8.6 | Sep 10 | WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability |
| CVE-2026-81786 | TY Thank You Page Customizer for WooCommerce VillaTheme | 7.5 | Sep 10 | WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-81784 | WC Wise Chat Marcin | 8.1 | Sep 10 | WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability |
| CVE-2026-81783 | MG MailMunch – Grow your Email List mailmunch | 7.1 | Sep 10 | WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability |
| CVE-2026-45747 | SU suricata OISF | 7.5 | Sep 10 | Suricata lua/tls: null dereference in TlsGetCertInfo |
| CVE-2026-46387 | SU suricata OISF | 7.5 | Sep 10 | Suricata http2: decompression bomb can cause denial of service in Suricata |
| CVE-2026-75584 | IO ION-DTN nasa-jpl | 7.5 | Sep 10 | ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion |
| CVE-2026-64838 | IC ICEcoder ICEcoder | 8.3 | Sep 10 | ICEcoder through 8.1 Path Traversal via oldFileName Parameter |
| CVE-2026-64837 | IC ICEcoder ICEcoder | 8.8 | Sep 10 | ICEcoder through 8.1 OS Command Injection via lib/properties.php |
| CVE-2026-64836 | IC ICEcoder ICEcoder | 8.8 | Sep 10 | ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement |
| CVE-2026-6285 | LI LIBRID/LIBREF Ankaref Innovation and Technology Inc. | 7.5 | Sep 10 | Improper Authentication in Ankaref's LIBRID/LIBREF |
| CVE-2026-85217 | FU Fusion Autodesk | 8.6 | Sep 10 | Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop |
| CVE-2026-88895 | CY cyberpanel usmannasir | 7.2 | Sep 10 | CyberPanel before 3.0.5 Authentication Bypass via API |
| CVE-2026-88893 | OP openpanel Openpanel-dev | 7.5 | Sep 10 | OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure |
| CVE-2026-88891 | OP openpanel Openpanel-dev | 8.3 | Sep 10 | OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations |
| CVE-2026-88890 | OP openpanel Openpanel-dev | 8.5 | Sep 10 | OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier |
| CVE-2026-88889 | ME mend-renovate-ce mend | 7.8 | Sep 10 | Renovate before 44.14.7 Command Injection via distributionType |
| CVE-2026-88888 | ME mend-renovate-ce mend | 7.0 | Sep 10 | Renovate before 44.14.7 Command Injection via Mix organization |
| CVE-2026-88887 | ME mend-renovate-ce mend | 8.6 | Sep 10 | Renovate before 44.11.2 Credential Exfiltration via Link Header |
| CVE-2026-88886 | ME mend-renovate-ce mend | 7.8 | Sep 10 | Renovate before 44.14.7 Command Injection via gradle-wrapper |
| CVE-2026-88885 | ME mend-renovate-ce mend | 7.0 | Sep 10 | Renovate before 44.14.7 Command Injection via depName |
| CVE-2026-88883 | ME mend-renovate-ce mend | 7.7 | Sep 10 | Renovate before 44.14.4 TLS Private Key Log Sanitisation |
| CVE-2026-88882 | ME mend-renovate-ce mend | 8.6 | Sep 10 | Renovate before 44.11.2 Credential Exfiltration via Link Header |
| CVE-2026-88881 | ME mend-renovate-ce mend | 8.6 | Sep 10 | Renovate before 44.11.3 Credential Exfiltration via Link Header |
| CVE-2026-88880 | ME mend-renovate-ce mend | 8.6 | Sep 10 | Renovate before 44.11.3 Credential Exfiltration via Link Header |
| CVE-2026-88879 | TR traefik traefik | 8.2 | Sep 10 | Traefik before v2.11.56 Identity Spoofing via Header Alias |
| CVE-2026-88876 | AV AVideo WWBN | 7.5 | Sep 10 | AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD |
| CVE-2026-88874 | AV AVideo WWBN | 7.5 | Sep 10 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass |
| CVE-2026-88873 | AV AVideo WWBN | 7.1 | Sep 10 | WWBN AVideo Cross-Site Request Forgery via logArchive.json.php |
| CVE-2026-88872 | AV AVideo WWBN | 7.1 | Sep 10 | AVideo CustomizeUser setPassword.json.php CSRF |
| CVE-2026-88870 | AV AVideo WWBN | 7.1 | Sep 10 | WWBN AVideo LoginControl PGP Key CSRF via GET Request |
| CVE-2026-88868 | AV AVideo WWBN | 8.7 | Sep 10 | AVideo LiveLinks Stored XSS via title and description fields |
| CVE-2026-88867 | AV AVideo WWBN | 8.7 | Sep 10 | WWBN AVideo Stored XSS via Category Name and Icon Class |
| CVE-2026-88866 | AV AVideo WWBN | 8.7 | Sep 10 | WWBN AVideo LoginControl Stored XSS via User-Agent Header |
| CVE-2026-88865 | AV AVideo WWBN | 8.1 | Sep 10 | AVideo Missing Authorization via getRestream.json.php |
| CVE-2026-88863 | CA capgo.app Cap-go | 8.1 | Sep 10 | capgo.app through 12.207.1 Privilege Escalation via invite_new_user_to_org |
| CVE-2026-88862 | CA capgo.app Cap-go | 8.8 | Sep 10 | Capgo API Key Manager Authentication Bypass via x-limited-key-id |
| CVE-2026-88861 | CA capgo.app Cap-go | 8.3 | Sep 10 | Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization |
| CVE-2026-88915 | MI MISP MISP | 7.1 | Sep 10 | MISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization |
| CVE-2026-85545 | HA HikCentral Access Control Hikvision | 7.1 | Sep 10 | There is an Vulnerability in some HikCentral Access Control versions |
| CVE-2026-9166 | GL GisLab Laboratory Management System GIS Informatics | 7.5 | Sep 10 | LFI in GIS Informatics' GisLab Laboratory Management System |