CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 12:23 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102112 | CO Core Kiteworks | 7.8 | Sep 30 | Kiteworks Core Local Privilege Escalation |
| CVE-2026-102113 | CO Core Kiteworks | 7.8 | Sep 30 | Kiteworks Core Local Privilege Escalation |
| CVE-2026-102114 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core OS Command Injection |
| CVE-2026-102116 | EP Email Protection Gateway Kiteworks | 7.2 | Sep 30 | Kiteworks Email Protection Gateway Path Traversal |
| CVE-2026-102117 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core Remote Code Execution |
| CVE-2026-102118 | CO Core Kiteworks | 7.8 | Sep 30 | Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation |
| CVE-2026-102119 | EP Email Protection Gateway Kiteworks | 7.2 | Sep 30 | Kiteworks Email Protection Gateway Path Traversal |
| CVE-2026-102120 | CO Core Kiteworks | 8.8 | Sep 30 | Kiteworks Core OS Command Injection |
| CVE-2026-102121 | SD Secure Data Forms Kiteworks | 8.6 | Sep 30 | Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2026-102123 | CO Core Kiteworks | 7.4 | Sep 30 | Kiteworks Core Path Traversal |
| CVE-2026-102125 | CO Core Kiteworks | 8.8 | Sep 30 | Kiteworks Core Sandbox Escape |
| CVE-2026-102126 | CO Core Kiteworks | 8.1 | Sep 30 | Kiteworks Core Stored Cross-site Scripting (XSS) |
| CVE-2026-102127 | EP Email Protection Gateway Kiteworks | 7.0 | Sep 30 | Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference |
| CVE-2026-102128 | EP Email Protection Gateway Kiteworks | 7.5 | Sep 30 | Kiteworks Email Protection Gateway Improper Authentication |
| CVE-2026-102129 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core Incorrect Privilege Assignment |
| CVE-2026-102130 | EP Email Protection Gateway Kiteworks | 7.2 | Sep 30 | Kiteworks Email Protection Gateway Remote Code Execution |
| CVE-2026-102131 | EP Email Protection Gateway Kiteworks | 7.2 | Sep 30 | Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity |
| CVE-2026-102132 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core Privilege Escalation through Improper Access Control |
| CVE-2026-103000 | PY pypdf py-pdf | 7.5 | Sep 30 | pypdf: Possible large memory usage when retrieving alphabetical page labels |
| CVE-2026-102101 | CO Core Kiteworks | 8.1 | Sep 30 | Kiteworks Core deserialization of untrusted data |
| CVE-2026-102999 | PY pypdf py-pdf | 7.5 | Sep 30 | pypdf: Possible long runtimes with large amount of embedded files |
| CVE-2026-102142 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core Remote Code Execution through Server-Side Template Injection |
| CVE-2026-102143 | EP Email Protection Gateway Kiteworks | 7.5 | Sep 30 | Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type |
| CVE-2026-102100 | CO Core Kiteworks | 8.7 | Sep 30 | Kiteworks Core stored XSS |
| CVE-2026-102150 | SD Secure Data Forms Kiteworks | 7.2 | Sep 30 | Kiteworks Secure Data Forms Missing Authentication for Critical Function |
| CVE-2026-102998 | PY pypdf py-pdf | 7.5 | Sep 30 | pypdf: Possible long runtimes when generating appearance streams |
| CVE-2026-102097 | EP Email Protection Gateway Kiteworks | 7.2 | Sep 30 | Kiteworks Email Protection Gateway remote code execution |
| CVE-2026-102096 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core OS command injection |
| CVE-2026-102099 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core arbitrary file write |
| CVE-2026-102094 | EP Email Protection Gateway Kiteworks | 7.2 | Sep 30 | Kiteworks Email Protection Gateway unsafe reflection |
| CVE-2026-102093 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core improper privilege management |
| CVE-2026-102092 | CO Core Kiteworks | 8.7 | Sep 30 | Kiteworks Core stored XSS |
| CVE-2026-102997 | PY pypdf py-pdf | 7.5 | Sep 30 | pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) |
| CVE-2026-102091 | SD Secure Data Forms Kiteworks | 7.5 | Sep 30 | Kiteworks Secure Data Forms server-side request forgery |
| CVE-2026-102098 | CO Core Kiteworks | 7.2 | Sep 30 | Kiteworks Core SQL Injection |
| CVE-2026-102089 | EP Email Protection Gateway Kiteworks | 7.2 | Sep 30 | Kiteworks Email Protection Gateway path traversal |
| CVE-2026-102996 | PY pypdf py-pdf | 7.5 | Sep 30 | pypdf: Possible large memory usage when parsing font data |
| CVE-2026-102995 | PY pypdf py-pdf | 7.5 | Sep 30 | pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2) |
| CVE-2026-102994 | PY pypdf py-pdf | 7.5 | Sep 30 | pypdf: Possible long runtimes/large memory usage when parsing indirect objects |
| CVE-2026-102993 | PY pypdf py-pdf | 7.5 | Sep 30 | pypdf: Possible large memory usage when retrieving Roman page labels |
| CVE-2026-102990 | BA basic-ftp patrickjuchli | 8.2 | Sep 30 | basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) |
| CVE-2026-101885 | ZE ZeroClaw zeroclaw-labs | 7.8 | Sep 30 | ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path |
| CVE-2026-101884 | OW OpenClaw Windows Node OpenClaw | 7.5 | Sep 30 | OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override |
| CVE-2026-101882 | OW OpenClaw Windows Node OpenClaw | 8.8 | Sep 30 | OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set |
| CVE-2026-101880 | OW OpenClaw Windows Node OpenClaw | 8.8 | Sep 30 | OpenClaw Windows Node before 2026.7.1 Authorization Bypass |
| CVE-2026-102392 | EP Extra Product Options For WooCommerce | Custom Product Addons and Fields ThemeHigh | 7.2 | Sep 30 | WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability |
| CVE-2026-102391 | JE JetFormBuilder jetmonsters | 7.1 | Sep 30 | WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-102377 | PG Photo Gallery by 10Web 10Web | 8.8 | Sep 30 | WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability |
| CVE-2026-102376 | BR Branda WPMU DEV | 7.1 | Sep 30 | WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-100510 | PA Post and Page Builder by BoldGrid BoldGrid | 7.1 | Sep 30 | WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability |