CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 00:44 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82943 New | SO SOEM RT-Labs AB | 6.5 | Oct 26 | Out-of-Bounds Read via Unchecked Length Values |
| CVE-2026-95664 New | AC Apache Camel Apache Software Foundation | 5.4 | Oct 26 | Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions |
| CVE-2026-101259 New | AC Apache Camel Apache Software Foundation | 5.3 | Oct 26 | Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions |
| CVE-2026-115425 New | OF OPNsense firewall OPNsense | 5.6 | Oct 26 | Multiple cross-site scripting (XSS) in OPNsense |
| CVE-2026-103300 New | EW Eurobank WooCommerce Payment Gateway | 5.3 | Oct 26 | Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback |
| CVE-2026-111974 New | GI GiveWP | 5.3 | Oct 26 | GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency |
| CVE-2026-116224 New | BE benotes fr0tt | 4.3 | Oct 26 | fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery |
| CVE-2026-116223 New | EA EasyImage icret | 6.5 | Oct 26 | icret EasyImage del.php privileges management |
| CVE-2026-103319 New | OP OPay Payment Gateway for WooCommerce | 5.3 | Oct 26 | OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key |
| CVE-2026-103381 New | MF Mintpay for WooCommerce | 6.5 | Oct 26 | Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery |
| CVE-2026-103306 New | OP Online Payments with iK Pay Gateway | 5.3 | Oct 26 | iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback |
| CVE-2026-103298 New | CP CCAvenue Payment Gateway for WooCommerce | 5.3 | Oct 26 | CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery |
| CVE-2026-116124 New | LI libgsf GNOME | 6.3 | Oct 26 | GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow |
| CVE-2026-116120 New | NO NocoDB Nocodb | 5.6 | Oct 26 | NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources |
| CVE-2026-116119 New | NO NocoDB Nocodb | 5.5 | Oct 26 | NocoDB Password-Reset Flow users.service.ts race condition |
| CVE-2026-116118 New | ZC Zcode Z.ai | 6.3 | Oct 26 | Z.ai Zcode Sed Command Filter os command injection |
| CVE-2026-116113 New | GO GouGuOA Gouguoa | 6.3 | Oct 26 | GouGuOA Api.php chunkUpload unrestricted upload |
| CVE-2026-116109 New | CO Continue continuedev | 6.3 | Oct 26 | continuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection |
| CVE-2026-116108 New | OP OpenBB openbq-org | 4.3 | Oct 26 | openbq-org OpenBB Local API Server api_settings.py access control |
| CVE-2026-116107 New | PS Product Sets Plugin Datafeedr | 5.4 | Oct 26 | Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization |
| CVE-2026-116104 New | NN Neural Network Libraries Sony | 6.3 | Oct 26 | Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection |
| CVE-2026-116103 New | NN Neural Network Libraries Sony | 6.3 | Oct 26 | Sony Neural Network Libraries Encode Param encode_decode_param.py load_param_in_txt code injection |
| CVE-2026-116102 New | DO docker-mcp QuantGeekDev | 6.3 | Oct 26 | QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection |
| CVE-2026-116101 New | OC Online Cake Ordering System itsourcecode | 6.3 | Oct 26 | itsourcecode Online Cake Ordering System deletetransac.php sql injection |
| CVE-2026-116097 New | CL CloudClassroom-PHP-Project Cloudclassroom-php-project | 4.3 | Oct 25 | CloudClassroom-PHP-Project addnewstudent.php cross site scripting |
| CVE-2026-116096 New | LL llama.cpp ggml-org | 5.3 | Oct 25 | ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write |
| CVE-2026-116095 New | SM smg smg-project | 5.3 | Oct 25 | smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation |
| CVE-2026-115627 New | AS ash_postgres ash-project | 6.0 | Oct 25 | AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows |
| CVE-2026-115635 New | AS ash_postgres ash-project | 6.0 | Oct 25 | AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set |
| CVE-2026-114214 New | AS ash ash-project | 6.0 | Oct 25 | Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records |
| CVE-2026-116063 New | DE DedeCMS Dedecms | 4.7 | Oct 25 | DedeCMS update_guide.php require_once code injection |
| CVE-2026-116058 New | AC Activiti Alfresco | 6.3 | Oct 25 | Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection |
| CVE-2026-116057 New | KO KodExplorer KodCloud | 6.3 | Oct 25 | KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload |
| CVE-2026-116056 New | KO KodExplorer KodCloud | 6.3 | Oct 25 | KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery |
| CVE-2026-116055 New | PI Performance Indicator System SourceCodester | 6.3 | Oct 25 | SourceCodester Performance Indicator System deleteproduct.php sql injection |
| CVE-2026-116053 New | MY mycli dbcli | 5.3 | Oct 25 | dbcli mycli Whitelist source.py source_special_command_is_safe os command injection |
| CVE-2026-116185 New | CO core openremote | 5.0 | Oct 25 | OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos |
| CVE-2026-116206 New | YE yeswiki YesWiki | 6.4 | Oct 25 | YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax |
| CVE-2026-116205 New | YE yeswiki YesWiki | 5.3 | Oct 25 | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax |
| CVE-2026-116203 New | YE yeswiki YesWiki | 6.1 | Oct 25 | YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters |
| CVE-2026-116202 New | YE yeswiki YesWiki | 5.4 | Oct 25 | YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload |
| CVE-2026-116200 New | SN snipe-it grokability | 5.9 | Oct 25 | Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap() |
| CVE-2026-116198 New | SN snipe-it grokability | 4.3 | Oct 25 | Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store |
| CVE-2026-116196 New | RC rclone rclone | 5.3 | Oct 25 | Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url |
| CVE-2026-116195 New | RC rclone rclone | 6.1 | Oct 25 | Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim |
| CVE-2026-116194 New | RC rclone rclone | 6.8 | Oct 25 | Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback |
| CVE-2026-116193 New | RC rclone rclone | 5.3 | Oct 25 | Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests |
| CVE-2026-116192 New | RC rclone rclone | 5.9 | Oct 25 | rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots |
| CVE-2026-116188 New | RC rclone rclone | 5.3 | Oct 25 | rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow |
| CVE-2026-116187 New | RC rclone rclone | 5.0 | Oct 25 | Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads |