CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 21:29 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-103439 | MW MediaWiki Wikbase extension The Wikimedia Foundation | 0.3 | Sep 30 | Various rawParams() and escaped() updates to prevent XSS in Wikibase extension |
| CVE-2026-103438 | MW MediaWiki Wikistories extension The Wikimedia Foundation | 0.3 | Sep 30 | Various rawParams() and escaped() updates to prevent XSS in Wikistories extension |
| CVE-2026-103437 | MR MediaWiki ReadingLists extension The Wikimedia Foundation | 1.1 | Sep 30 | ReadingLists imported metadata permits JavaScript URL XSS |
| CVE-2026-103445 | MP MediaWiki Page_Forms extension The Wikimedia Foundation | 1.2 | Sep 30 | Stored XSS through PageForms #autoedit redirect links |
| CVE-2026-103444 | MW MediaWiki WikiForum extension The Wikimedia Foundation | 1.1 | Sep 30 | Stored XSS through system messages in WikiForum |
| CVE-2026-103443 | MC MediaWiki Collection (Book) extension The Wikimedia Foundation | 1.1 | Sep 30 | API permits session-seeded javascript URL XSS |
| CVE-2026-103436 | AP apcupsd apcupsd | 3.7 | Sep 30 | apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi |
| CVE-2026-100271 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects |
| CVE-2026-100270 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations |
| CVE-2026-100268 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates |
| CVE-2026-100264 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
| CVE-2026-27085 | AW Astra WordPress Theme Brainstorm Force | 2.7 | Sep 30 | WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability |
| CVE-2026-103012 | AN @anthropic-ai/claude-code Anthropic | 2.0 | Sep 30 | Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise… |
| CVE-2026-102587 | MO Moodle Moodle | 2.7 | Sep 30 | Moodle: user list filters bypass profile field visibility |
| CVE-2026-102583 | MO Moodle Moodle | 2.7 | Sep 30 | Moodle: incorrect capability check in ai generate image web service |
| CVE-2026-94297 | ML Media Library Organizer | 2.7 | Sep 30 | Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation |
| CVE-2026-88791 | SR Safe Redirect Manager | 3.4 | Sep 30 | Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules |
| CVE-2026-82127 | SS Schema & Structured Data for WP & AMP | 3.5 | Sep 30 | Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields |
| CVE-2026-102844 | HO HospitalManagement gedelumbung | 2.7 | Sep 30 | gedelumbung HospitalManagement laporan_data_pasien.php detail authorization |
| CVE-2026-51936 | SQ SQLCipher Zetetic | 2.1 | Sep 30 | Zetetic SQLCipher before 4.15.0 allows SQL injection |
| CVE-2026-71189 | TM TMS7 Toptech Systems | 3.5 | Sep 29 | Toptech TMS7 and TopHAT Cross-site Scripting |
| CVE-2026-69662 | TM TMS7 Toptech Systems | 3.7 | Sep 29 | Toptech TMS7 and TopHAT Eval Injection |