CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 13:23 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109258 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation |
| CVE-2026-109247 | FR FreeRDP FreeRDP | 3.1 | Oct 12 | FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName |
| CVE-2026-109241 | FR FreeRDP FreeRDP | 3.1 | Oct 12 | FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel |
| CVE-2026-109240 | FR FreeRDP FreeRDP | 3.1 | Oct 12 | FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer |
| CVE-2026-81856 | HE hex hexpm | 2.3 | Oct 12 | Terminal escape sequence injection in Hex via unneutralized server-supplied output |
| CVE-2026-108901 | MM MPOS M6 PLUS Shenzhen HCC Technology | 3.5 | Oct 12 | Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer |
| CVE-2026-96618 | HE hex hexpm | 2.1 | Oct 12 | Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror |
| CVE-2026-109195 | RH Red Hat Quay 3 Red Hat | 3.1 | Oct 12 | Quay: repository auto-prune policy uuid idor in quay api |
| CVE-2026-108898 | WF WF2409E Netis | 3.5 | Oct 12 | Netis WF2409E Wireless Settings cross site scripting |
| CVE-2026-103526 | TH Thelia Thelia | 3.7 | Oct 12 | In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated… |
| CVE-2026-105081 | IM ImageMagick ImageMagick | 3.6 | Oct 12 | ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName |
| CVE-2026-108815 | ID idcCMS Idccms | 3.5 | Oct 12 | idcCMS member_deal.php cross site scripting |
| CVE-2026-108809 | CR Call Recording Software Eleveo | 3.5 | Oct 12 | Eleveo Call Recording Software logout session expiration |
| CVE-2026-108808 | CR Call Recording Software Eleveo | 2.6 | Oct 12 | Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings |
| CVE-2025-15703 | HI HireZoot | 3.5 | Oct 12 | WP Job Openings < 4.0.0 - Admin+ Stored XSS |
| CVE-2026-108802 | RU RuoYi y_project | 3.5 | Oct 12 | y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting |
| CVE-2026-21131 | SF Samsung Flow Samsung Mobile | 2.1 | Oct 12 | Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device |
| CVE-2026-108981 | NG ngx_cache_purge denji | 3.6 | Oct 12 | ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user… |
| CVE-2026-18418 | ZE zephyr zephyrproject | 3.4 | Oct 11 | Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name |
| CVE-2026-108857 | TE Text Embeddings Inference Hugging Face | 3.3 | Oct 11 | Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging |
| CVE-2026-108851 | PH phpMyFAQ thorsten | 3.3 | Oct 11 | phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool |
| CVE-2026-108754 | GP gpt-load tbphp | 3.3 | Oct 11 | GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger |
| CVE-2026-108745 | CL CloudBeaver DBeaver | 3.1 | Oct 11 | CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet |
| CVE-2026-108741 | SH Shepherd shepherd-agents | 3.1 | Oct 11 | Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker |
| CVE-2026-108736 | SP speedtest-tracker alexjustesen | 3.7 | Oct 11 | Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing |
| CVE-2026-108723 | AN answer-me-with-html QingYunA | 2.5 | Oct 11 | answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding |
| CVE-2026-108566 | IC icms2 InstantSoft | 3.5 | Oct 11 | InstantSoft icms2 Private Message index.tpl.php index cross site scripting |
| CVE-2026-107694 | DA Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | 2.7 | Oct 11 | Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint |
| CVE-2026-107507 | SQ Squadeno | 2.7 | Oct 11 | Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit |
| CVE-2026-104684 | EG Envira Gallery | 2.7 | Oct 11 | Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode |
| CVE-2026-104682 | EG Envira Gallery | 2.7 | Oct 11 | Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route |
| CVE-2026-104681 | EG Envira Gallery | 2.7 | Oct 11 | Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field |
| CVE-2026-108603 | SL slide-maker addsumtech | 3.3 | Oct 10 | slide-maker through 5.8.0 Path Traversal via generate_images_openai.py |
| CVE-2026-108594 | ME mealie mealie-recipes | 3.5 | Oct 10 | Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch |
| CVE-2026-108505 | ZU Z80 Ultra ZTE | 3.3 | Oct 10 | Information disclosure vulnerability in ZTE Z80 Ultra product |
| CVE-2026-108503 | ZU Z80 Ultra ZTE | 3.3 | Oct 10 | Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product |
| CVE-2026-104006 | SC SpeedyCache – Cache, Optimization, Performance softaculous | 3.7 | Oct 10 | SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check |
| CVE-2026-108502 | ZU Z80 Ultra ZTE | 3.3 | Oct 10 | Information disclosure vulnerability in ZTE Z80 Ultra product |
| CVE-2026-105977 | PF Portfolio Filter Gallery | 2.2 | Oct 10 | Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail |
| CVE-2026-104754 | RM Rank Math SEO | 3.5 | Oct 10 | Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL |
| CVE-2026-104742 | AP AI Puffer – AI Chatbot, AI Writer & Automation senols | 3.1 | Oct 10 | AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action |
| CVE-2026-104741 | AP AI Puffer – AI Chatbot, AI Writer & Automation senols | 3.1 | Oct 10 | AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint |
| CVE-2026-107848 | CO contao contao | 3.5 | Oct 9 | Contao: Cross-site request forgery in custom backend actions |
| CVE-2026-104116 | IL illumos-gate illumos | 1.9 | Oct 9 | Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones |
| CVE-2026-104117 | IL illumos-gate illumos | 1.9 | Oct 9 | Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership |
| CVE-2026-101130 | AF affinity canva | 3.6 | Oct 9 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading… |
| CVE-2026-101094 | AF affinity canva | 3.6 | Oct 9 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files,… |
| CVE-2026-96395 | AF affinity canva | 3.6 | Oct 9 | The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity… |
| CVE-2026-96394 | AF affinity canva | 2.9 | Oct 9 | The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook… |
| CVE-2026-96393 | AF affinity canva | 3.6 | Oct 9 | The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer… |