| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-110455 | CVE-2026-110455 | Ubiquiti Inc | UniFi Protect AI Key | High | 8.1 | 2026-10-14 05:00:58 | Deep Dive |
| CVE-2026-110454 | CVE-2026-110454 | Ubiquiti Inc | UniFi Protect AI Key | Medium | 5.3 | 2026-10-14 04:54:22 | Deep Dive |
| CVE-2026-106931 | CVE-2026-106931 | EG Secure Solutions Inc. | SiteGuard Server Edition for Apache httpd | High | 8.5 | 2026-10-14 04:45:08 | Deep Dive |
| CVE-2026-105429 | NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution | NetBird | NetBird | High | 8.0 | 2026-10-14 04:33:45 | Deep Dive |
| CVE-2026-101926 | Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter | hyyan | Hyyan WooCommerce Polylang Integration | Medium | 6.5 | 2026-10-14 04:28:12 | Deep Dive |
| CVE-2026-103369 | Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX | joaoromao | Social Share Buttons & Analytics Plugin – GetSocial.io | Medium | 6.4 | 2026-10-14 04:28:11 | Deep Dive |
| CVE-2026-101924 | NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String | ice00 | NewStatPress | High | 7.2 | 2026-10-14 04:28:11 | Deep Dive |
| CVE-2026-110453 | CVE-2026-110453 | NixOS | Nix | Medium | 4.3 | 2026-10-14 04:15:47 | Deep Dive |
| CVE-2026-110452 | CVE-2026-110452 | NixOS | Nix | Medium | 4.0 | 2026-10-14 04:12:28 | Deep Dive |
| CVE-2026-110451 | CVE-2026-110451 | NixOS | Nix | Medium | 4.3 | 2026-10-14 04:08:10 | Deep Dive |
| CVE-2026-110450 | CVE-2026-110450 | NixOS | Nix | High | 8.0 | 2026-10-14 04:03:13 | Deep Dive |
| CVE-2026-110449 | CVE-2026-110449 | NixOS | Nix | High | 7.5 | 2026-10-14 03:59:11 | Deep Dive |
| CVE-2026-87855 | JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method | ntbyk | JTL-Connector for WooCommerce | Critical | 9.8 | 2026-10-14 03:40:07 | Deep Dive |
| CVE-2026-100153 | NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field) | ice00 | NewStatPress | High | 7.2 | 2026-10-14 03:40:07 | Deep Dive |
| CVE-2026-95808 | Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter | 10web | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | High | 7.5 | 2026-10-14 03:40:06 | Deep Dive |
| CVE-2026-97471 | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token | themefusion | Avada (Fusion) Builder | Medium | 5.3 | 2026-10-14 03:40:06 | Deep Dive |
| CVE-2026-97398 | FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute | foliovision | FV Flowplayer Video Player | High | 7.2 | 2026-10-14 03:40:06 | Deep Dive |
| CVE-2026-83592 | Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values | doctorwp | Contact Form DB for Enfold | High | 7.2 | 2026-10-14 03:40:05 | Deep Dive |
| CVE-2026-100185 | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field | wpwax | Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium | 6.4 | 2026-10-14 03:40:05 | Deep Dive |
| CVE-2026-95816 | Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter | edgarrojas | Smart Forms – when you need more than just a contact form | High | 7.2 | 2026-10-14 03:40:03 | Deep Dive |