CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 09:32 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-75507 New | GR graphql-core graphql-python | 7.5 | Oct 22 | GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule |
| CVE-2026-75508 New | GR graphql-core graphql-python | 7.5 | Oct 22 | GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit |
| CVE-2026-94482 New | NE next.js vercel | 8.2 | Oct 22 | Next.js: Denial of Service in App Router using Server Actions |
| CVE-2026-115453 New | ET Ecommerce Template MarcosCamara01 | 7.1 | Oct 22 | Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries |
| CVE-2026-115450 New | ET Ecommerce Template MarcosCamara01 | 7.1 | Oct 22 | Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier |
| CVE-2026-115482 New | LS lsquic litespeedtech | 7.5 | Oct 22 | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK… |
| CVE-2026-61791 New | OC OCO-Server schorschii | 7.4 | Oct 22 | OCO-Server: Stored XSS through agent hostnames in command buttons |
| CVE-2026-16477 New | CX CleanShot X MTW | 8.4 | Oct 22 | Insecure Deserialization of .cleanshot Files in CleanShot X |
| CVE-2026-114510 New | FL flexible-graphrag stevereiner | 7.1 | Oct 22 | Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content |
| CVE-2026-111181 New | BO body-parser body-parser | 7.5 | Oct 22 | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body |
| CVE-2026-113872 New | MU multer multer | 7.5 | Oct 22 | multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown |
| CVE-2026-85079 New | EM EmberZNet Silicon Labs | 7.5 | Oct 22 | Out-of-bounds write in Zigbee Simple_Desc_req handling |
| CVE-2026-94502 New | EM EmberZNet Silicon Labs | 7.5 | Oct 22 | Out-of-bounds write in Zigbee Publish Price Matrix handling |
| CVE-2026-66279 New | CS Connect SDK Silicon Labs | 7.2 | Oct 22 | Dis-connect vulnerability in Connect Stack |
| CVE-2026-92709 New | RS rsyslog rsyslog | 8.1 | Oct 22 | Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE |
| CVE-2026-113582 New | AA Apache Abdera Apache Software Foundation | 7.5 | Oct 22 | Apache Abdera: XML external entity expansion in Atom document parsing |
| CVE-2026-112822 New | WC Workreap Core AmentoTech | 8.5 | Oct 22 | WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability |
| CVE-2026-115332 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Subscription Filter Keys |
| CVE-2026-115331 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters |
| CVE-2026-115330 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics |
| CVE-2026-115328 New | JS json-scada riclolsen | 8.8 | Oct 22 | JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API |
| CVE-2026-115325 New | NE netmaker gravitl | 8.3 | Oct 22 | Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup |
| CVE-2026-115324 New | ME mem0 mem0ai | 8.1 | Oct 22 | mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store |
| CVE-2026-115323 New | EV evershop evershopcommerce | 7.3 | Oct 22 | EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API |
| CVE-2025-71434 New | EC E-cology Weaver Network Co., Ltd. | 8.2 | Oct 22 | Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list |
| CVE-2024-58396 New | CA CPAS Audit Management System YouDataSum | 7.5 | Oct 22 | YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId |
| CVE-2024-58393 New | RU Readymade Unilevel Ecommerce MLM i-Netsolution | 8.2 | Oct 22 | i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php |
| CVE-2022-51024 New | KA Kavita Kareadita | 7.5 | Oct 22 | Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint |
| CVE-2022-51023 New | PH PHPOK PHPOK | 8.2 | Oct 22 | PHPOK < 5.4.081 SQL Injection via api.php sort Parameter |
| CVE-2022-51021 New | NO NotificationX WPDeveloper | 8.2 | Oct 22 | NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint |
| CVE-2021-48017 New | BS BSCW Server OrbiTeam | 7.5 | Oct 22 | OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi |
| CVE-2021-48015 New | JE JeeWMS erzhongxmu | 7.5 | Oct 22 | JeeWMS Path Traversal via showOrDownByurl.do |
| CVE-2021-48013 New | EC E-cology Weaver Network Co., Ltd. | 7.5 | Oct 22 | Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload |
| CVE-2019-25779 New | DI Diarise WooThemes | 7.5 | Oct 22 | WooThemes Diarise 1.5.9 Local File Disclosure via download.php |
| CVE-2019-25778 New | SE SeaCMS SeaCMS | 8.2 | Oct 22 | SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter |
| CVE-2018-25439 New | ME MetInfo MetInfo | 7.5 | Oct 22 | MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter |
| CVE-2018-25438 New | GR Group-Office Intermesh | 7.5 | Oct 22 | Intermesh Group-Office < 3.5.5 Path Traversal via compress.php |
| CVE-2017-20289 New | AW Ad Widget Broadstreet | 7.5 | Oct 22 | Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter |
| CVE-2017-20287 New | JS Javo Spot Javo Themes | 7.5 | Oct 22 | Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter |
| CVE-2026-111079 New | RH Red Hat Enterprise Linux 10 Red Hat | 7.4 | Oct 22 | Goose: goose: shell history and environment leak via terminal integration |
| CVE-2026-112313 New | AE ACF Extended ACF Extended | 7.1 | Oct 22 | WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112820 New | AC Academist Core Elated-Themes | 8.1 | Oct 22 | WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability |