CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:26 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-59783 | ZA Zabbix Zabbix | 2.3 | Oct 5 | Server DoS via binary items |
| CVE-2026-105289 | FE feelcrm-os feelec-yishu | 3.5 | Oct 5 | feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting |
| CVE-2026-104808 | MM Mitel MiVoice Office 400 Mitel | 1.9 | Oct 5 | Mitel MiVoice Office 400 stored Cross-Site Scripting |
| CVE-2026-104807 | MM Mitel MiVoice Office 400 Mitel | 1.9 | Oct 5 | Mitel MiVoice Office 400 stored Cross-Site Scripting |
| CVE-2026-105245 | SG sglang sgl-project | 3.7 | Oct 5 | sgl-project sglang HTTP Endpoint http_server.py server_info cleartext transmission |
| CVE-2026-105237 | LI litemall linlinjava | 3.7 | Oct 5 | linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication |
| CVE-2026-105188 | HR Human Resource Management System code-projects | 3.5 | Oct 5 | code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting |
| CVE-2026-105179 | DR Drug Recommendation System SourceCodester | 2.7 | Oct 5 | SourceCodester Drug Recommendation System Password add_user.php missing encryption |
| CVE-2026-105173 | HR Human Resource Management code-projects | 3.5 | Oct 5 | code-projects Human Resource Management Event Creation EventStore.php cross site scripting |
| CVE-2026-105164 | CF cFS NASA | 2.7 | Oct 4 | NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds |
| CVE-2026-105217 | CO cockpit cockpit-hq | 3.1 | Oct 4 | Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php |
| CVE-2026-105214 | ZI zitadel zitadel | 2.3 | Oct 4 | Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification |
| CVE-2026-105156 | YZ YzmCMS Yzmcms | 3.7 | Oct 4 | YzmCMS MD5 system.func.php password weak password hash |
| CVE-2026-104119 | SS Simple Shopping Cart | 3.5 | Oct 4 | Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials |
| CVE-2026-105099 | CC CoinEx Crypto Omega Solution | 3.5 | Oct 4 | Omega Solution CoinEx Crypto Ticket Attachment Upload ticket cross site scripting |
| CVE-2026-105130 | LA laradashboard laradashboard | 3.7 | Oct 3 | LaraDashboard 1.4.0 before 1.4.8 Race Condition Bypasses Per-IP Registration Limit |
| CVE-2026-105125 | LA laradashboard laradashboard | 3.7 | Oct 3 | LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint |
| CVE-2026-96962 | PR Pie Register | 3.7 | Oct 3 | Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code |
| CVE-2026-86834 | ME MetForm | 3.7 | Oct 3 | MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration |
| CVE-2026-80518 | WU WP Ultimate CSV Importer | 3.7 | Oct 3 | WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path |
| CVE-2026-80517 | WU WP Ultimate CSV Importer | 3.5 | Oct 3 | WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload |
| CVE-2026-105051 | DA Denuvo Anti-Tamper Irdeto | 1.9 | Oct 2 | Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel) |
| CVE-2026-105043 | SI Simulink MathWorks | 3.6 | Oct 2 | MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution |
| CVE-2026-104994 | TR Trivy aquasec | 2.5 | Oct 2 | Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root |
| CVE-2026-104855 | WA wasmtime bytecodealliance | 2.0 | Oct 2 | Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state |
| CVE-2026-39601 | BC Booking Calendar WPdevelop | 3.7 | Oct 2 | WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability |
| CVE-2026-104436 | ZE zebra ZcashFoundation | 3.7 | Oct 2 | Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length |
| CVE-2026-104424 | ZE zebra ZcashFoundation | 3.7 | Oct 2 | Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate |
| CVE-2026-104415 | GH Ghost TryGhost | 3.1 | Oct 2 | Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API |
| CVE-2026-102002 | OB Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE themeisle | 3.1 | Oct 2 | Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget |
| CVE-2026-91023 | MO Motors | 3.1 | Oct 2 | Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured |
| CVE-2026-103923 | KA KaTeX KaTeX | 2.1 | Oct 1 | KaTeX: Existing prototype pollution can bypass trust restrictions |
| CVE-2026-21833 | AI AION HCL Software | 3.7 | Oct 1 | HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833) |
| CVE-2026-67172 | HB HCL BigFix Service Management HCL Software | 3.7 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-42356 | HS HTTP Server Apache | 3.7 | Oct 1 | Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories |
| CVE-2026-56599 | HB HCL BigFix Service Management HCL Software | 2.2 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-103686 | DO dom-sanitizer rhukster | 3.5 | Oct 1 | rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting |
| CVE-2026-66253 | IC iControl HCL Software | 3.1 | Oct 1 | HCL iControl is affected by a Session Timeout vulnerability |
| CVE-2026-66249 | IC iControl HCL Software | 3.1 | Oct 1 | HCL iControl is affected by a Missing Secure Attribute vulnerability |
| CVE-2026-66248 | IC iControl HCL Software | 3.1 | Oct 1 | HCL iControl is affected by an Improper Error Handling vulnerability |
| CVE-2026-94220 | AA Apache APISIX Apache Software Foundation | 2.1 | Oct 1 | Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin |
| CVE-2026-103290 | GH Ghost TryGhost | 3.8 | Oct 1 | Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize |
| CVE-2026-103287 | GH Ghost TryGhost | 2.7 | Oct 1 | Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook |
| CVE-2026-87973 | ID If-So Dynamic Content | 3.1 | Oct 1 | If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name |
| CVE-2026-76144 | GS Genian SSL PNS (frodo-core) Genians, Inc | 1.8 | Oct 1 | Genians, Inc Genian SSL PNS Unrestricted File Upload |
| CVE-2026-101887 | BL bluez-alsa arkq | 3.5 | Oct 1 | BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS |
| CVE-2026-103585 | MM MediaWiki MediaSearch extension The Wikimedia Foundation | 1.2 | Sep 30 | attacker-controlled javascript license URL via XSS |
| CVE-2026-103584 | MC MediaWiki CommonsMetadata extension The Wikimedia Foundation | 1.1 | Sep 30 | attacker-controlled javascript license URL via XSS |
| CVE-2026-102138 | CO Core Kiteworks | 3.3 | Sep 30 | Kiteworks Core Server-Side Request Forgery (SSRF) |
| CVE-2026-103440 | MP MediaWiki PageTriage extension The Wikimedia Foundation | 1.2 | Sep 30 | pagetriagelist discloses suppressed reviewer usernames |