CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 12:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-100265 | RI Rider JetBrains | 6.5 | Sep 30 | In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation |
| CVE-2026-100263 | YO YouTrack JetBrains | 6.1 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible |
| CVE-2026-100261 | YO YouTrack JetBrains | 5.4 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission |
| CVE-2026-100260 | YO YouTrack JetBrains | 5.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset |
| CVE-2026-100259 | YO YouTrack JetBrains | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access |
| CVE-2026-100258 | YO YouTrack JetBrains | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
| CVE-2026-100257 | YO YouTrack JetBrains | 4.3 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export |
| CVE-2026-94545 | NE next vercel | 5.3 | Sep 30 | Satori-generated SVG has improper escaping |
| CVE-2026-103397 | OP OpenSave Liquid-co | 5.6 | Sep 30 | OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender |
| CVE-2026-103396 | BB bbs-go mlogclub | 4.3 | Sep 30 | bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount |
| CVE-2026-103243 | LI LightLLM ModelTC | 5.8 | Sep 30 | LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints |
| CVE-2026-102983 | NE netlify @astrojs | 6.3 | Sep 30 | Astro: Netlify Image CDN allowlist bypass enables SSRF |
| CVE-2026-103227 | GP GPAC Gpac | 6.3 | Sep 30 | GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow |
| CVE-2026-103389 | MI MISP MISP | 6.2 | Sep 30 | MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph |
| CVE-2026-103388 | MI MISP MISP | 6.2 | Sep 30 | MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field |
| CVE-2026-103226 | GH Ghostscript Artifex | 6.3 | Sep 30 | Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow |
| CVE-2026-97259 | PW Pay with Vipps for WooCommerce WP Hosting AS | 5.3 | Sep 30 | WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-62084 | US User Submitted Posts Jeff Starr | 6.5 | Sep 30 | WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-103222 | CB C-Blosc2 Blosc | 5.6 | Sep 30 | Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow |
| CVE-2026-103118 | GR GraphicsMagick Graphicsmagick | 4.3 | Sep 30 | GraphicsMagick WPG File wpg.c ExtractPostscript recursion |
| CVE-2026-93547 | VA vaadin vaadin | 5.3 | Sep 30 | Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells |
| CVE-2026-91860 | VA @vaadin/charts vaadin | 6.3 | Sep 30 | Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge |
| CVE-2026-103117 | OP openSIS-Classic OS4ED | 4.7 | Sep 30 | OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection |
| CVE-2026-86778 | MG Maksisoft Gym Maksisoft Technology, IT, and Software Industry and Trade Inc. | 5.3 | Sep 30 | Username Enumeration in Maksisoft Technology's Maksisoft Gym |