Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.5	CVE-2026-109936	The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can... Otter BlocksOtter Blocks	NVD	Oct 23 06:17 UTC
CVE-2026-109936The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can... Executive summary The Otter Blocks WordPress plugin, before version 3.2.8, contains a cross-site scripting flaw that the advisory says is rated high severity with a CVSS score of 7.5. The fix is to update the plugin to version 3.2.8 or later. Technical summary The flaw is a cross-site scripting (CWE-79) caused by a regular expression pattern that is not correctly bounded when the plugin rewrites dynamic-content tokens while rendering blocks. The advisory's classification indicates the attacker needs at least Contributor-level access, but the advisory text itself does not explicitly state the attack vector or preconditions beyond the truncated description. Affected versions are stated as before 3.2.8, and the fixed version is 3.2.8. The advisory does not state any workaround, and it does not give detection guidance. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/c9f264ad-0857-…1f-9f20-694469d7bee0 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Otter Blocks Otter Blocks NIST National Vulnerability DatabasePublished Oct 23, 2026 06:17 UTC Read the advisory
	Medium	5.3	CVE-2026-109935	The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing... Otter BlocksOtter Blocks	NVD	Oct 23 06:17 UTC
CVE-2026-109935The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing... Executive summary The Otter Blocks WordPress plugin, before version 3.2.8, fails to enforce its block visibility conditions when a published post is served through the WordPress REST API. The advisory classifies this as sensitive data disclosure with a CVSS score of 5.3 (medium), and the fix is to update the plugin to version 3.2.8. Technical summary The flaw is a sensitive data disclosure issue (CWE-200) in which block visibility conditions are not enforced when a published post is rendered through the WordPress REST API. The advisory describes the result as allowing access to content that should be hidden, but the rest of the text is truncated and does not state the exact attack prerequisites. The affected version range is stated as before 3.2.8, and the fixed version is 3.2.8. The CVSS score is 5.3 (medium) as listed. No workaround is stated, and no detection guidance is stated. Whether exploitation in the wild has been observed is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/f19dbe9c-f172-…b8-8bfc-d21660aaa739 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Otter Blocks Otter Blocks NIST National Vulnerability DatabasePublished Oct 23, 2026 06:17 UTC Read the advisory
	Medium	5.3	CVE-2026-109934	The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating... Otter BlocksOtter Blocks	NVD	Oct 23 06:17 UTC
CVE-2026-109934The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating... Executive summary The Otter Blocks WordPress plugin contains a flaw that can expose data from posts that are not publicly readable. The advisory classifies it as a sensitive data disclosure rated 5.3 (medium) under CVSS. The fix is to update the plugin to version 3.2.8 or later. Technical summary The flaw is a sensitive data disclosure (CWE-200) in which the plugin does not correctly check whether a post is publicly readable before returning its data through a REST API endpoint. The advisory describes the vulnerability as affecting versions before 3.2.8 and lists 3.2.8 as the fixed version. The attack vector, required privileges, and exact conditions for exploitation are not stated in the text provided. Workarounds are not stated. Detection guidance and any evidence of exploitation in the wild are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/f634bde0-bfb0-…f9-9c85-fb72763c5dfd Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Otter Blocks Otter Blocks NIST National Vulnerability DatabasePublished Oct 23, 2026 06:17 UTC Read the advisory
	Medium	6.8	CVE-2026-109933	The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing... Otter BlocksOtter Blocks	NVD	Oct 23 06:17 UTC
CVE-2026-109933The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing... Executive summary The Otter Blocks WordPress plugin contains a cross-site scripting flaw that affects versions before 3.2.8. The advisory rates it medium severity with a CVSS score of 6.8 and recommends updating to version 3.2.8. Technical summary The flaw is a cross-site scripting (XSS) issue, CWE-79, caused by the plugin not properly sanitizing and escaping user-supplied block styling values before writing them into an inline stylesheet. The advisory's description is truncated after 'allowing...', so the exact attack vector and required privileges are not stated in the text provided. The fixed version is 3.2.8, and affected versions are described as before 3.2.8. No workaround is stated. No detection guidance is stated. The CVSS score is listed as 6.8 (medium), and the advisory does not state whether the vulnerability is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/a2a19770-9ee2-…64-9ea6-a882cf0085e9 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects Otter Blocks Otter Blocks NIST National Vulnerability DatabasePublished Oct 23, 2026 06:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee