| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-110457 | UniFi Protect AI Key路径遍历漏洞 | Ubiquiti Inc | UniFi Protect AI Key | Low | 3.7 | 2026-10-14 05:12:18 | Deep Dive |
| CVE-2026-110456 | UniFi Protect AI Key improper access control | Ubiquiti Inc | UniFi Protect AI Key | Medium | 5.3 | 2026-10-14 05:06:56 | Deep Dive |
| CVE-2026-110455 | UniFi Protect AI Key命令注入漏洞 | Ubiquiti Inc | UniFi Protect AI Key | High | 8.1 | 2026-10-14 05:00:58 | Deep Dive |
| CVE-2026-110454 | UniFi Protect AI Key不当访问控制漏洞 | Ubiquiti Inc | UniFi Protect AI Key | Medium | 5.3 | 2026-10-14 04:54:22 | Deep Dive |
| CVE-2026-106931 | SiteGuard Server OS命令注入漏洞 | EG Secure Solutions Inc. | SiteGuard Server Edition for Apache httpd | High | 8.5 | 2026-10-14 04:45:08 | Deep Dive |
| CVE-2026-105429 | NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution | NetBird | NetBird | High | 8.0 | 2026-10-14 04:33:45 | Deep Dive |
| CVE-2026-101926 | Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter | hyyan | Hyyan WooCommerce Polylang Integration | Medium | 6.5 | 2026-10-14 04:28:12 | Deep Dive |
| CVE-2026-103369 | Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX | joaoromao | Social Share Buttons & Analytics Plugin – GetSocial.io | Medium | 6.4 | 2026-10-14 04:28:11 | Deep Dive |
| CVE-2026-101924 | NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String | ice00 | NewStatPress | High | 7.2 | 2026-10-14 04:28:11 | Deep Dive |
| CVE-2026-110453 | Nix <2.35.3 沙箱绕过漏洞 | NixOS | Nix | Medium | 4.3 | 2026-10-14 04:15:47 | Deep Dive |
| CVE-2026-110452 | Nix < 2.35.3 安装器所有权配置错误漏洞 | NixOS | Nix | Medium | 4.0 | 2026-10-14 04:12:28 | Deep Dive |
| CVE-2026-110451 | Nix/Lix macOS座套沙箱逃逸 | NixOS | Nix | Medium | 4.3 | 2026-10-14 04:08:10 | Deep Dive |
| CVE-2026-110450 | Nix/Lix提权漏洞 | NixOS | Nix | High | 8.0 | 2026-10-14 04:03:13 | Deep Dive |
| CVE-2026-110449 | Nix/Lix漏洞：整数溢出致越界写 | NixOS | Nix | High | 7.5 | 2026-10-14 03:59:11 | Deep Dive |
| CVE-2026-87855 | JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method | ntbyk | JTL-Connector for WooCommerce | Critical | 9.8 | 2026-10-14 03:40:07 | Deep Dive |
| CVE-2026-100153 | NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field) | ice00 | NewStatPress | High | 7.2 | 2026-10-14 03:40:07 | Deep Dive |
| CVE-2026-95808 | Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter | 10web | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | High | 7.5 | 2026-10-14 03:40:06 | Deep Dive |
| CVE-2026-97471 | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token | themefusion | Avada (Fusion) Builder | Medium | 5.3 | 2026-10-14 03:40:06 | Deep Dive |
| CVE-2026-97398 | FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute | foliovision | FV Flowplayer Video Player | High | 7.2 | 2026-10-14 03:40:06 | Deep Dive |
| CVE-2026-83592 | Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values | doctorwp | Contact Form DB for Enfold | High | 7.2 | 2026-10-14 03:40:05 | Deep Dive |