CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 20:29 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110633 | MU MyReport Updater Report One | 7.8 | Oct 14 | MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service |
| CVE-2026-110632 | MU MyReport Updater Report One | 8.1 | Oct 14 | Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE |
| CVE-2026-110631 | KO komodo moghtech | 9.8 | Oct 14 | Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration |
| CVE-2026-110630 | LA laravel-crm venturedrake | 6.5 | Oct 14 | VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment |
| CVE-2026-110629 | LA laravel-crm venturedrake | 6.5 | Oct 14 | VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions |
| CVE-2026-110628 | KA kan kanbn | 8.6 | Oct 14 | Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment |
| CVE-2026-110627 | CL clipbucket-v5 MacWarrior | 4.7 | Oct 14 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter |
| CVE-2026-110626 | CL clipbucket-v5 MacWarrior | 6.1 | Oct 14 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php |
| CVE-2026-110625 | CL clipbucket-v5 MacWarrior | 6.1 | Oct 14 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php |
| CVE-2026-110624 | PA papermerge-core papermerge | 3.1 | Oct 14 | Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all |
| CVE-2026-110623 | PA papermerge-core papermerge | 7.5 | Oct 14 | Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API |
| CVE-2026-110622 | PA papermerge-core papermerge | 7.5 | Oct 14 | Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints |
| CVE-2026-110621 | SW swetrix Swetrix | 8.8 | Oct 14 | Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId |
| CVE-2026-110620 | FO formbricks formbricks | 6.8 | Oct 14 | Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId |
| CVE-2026-110619 | FR frp fatedier | 4.8 | Oct 14 | frp 0.41.0 through 0.71.1 Missing Authentication for pprof Debug Endpoints |
| CVE-2026-110618 | SM SmsForwarder pppscn | 8.1 | Oct 14 | SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API |
| CVE-2026-110617 | WE we-mp-rss rachelos | 4.8 | Oct 14 | we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint |
| CVE-2026-110616 | NU NullHub nullclaw | 8.1 | Oct 14 | NullHub through 2026.5.29 Missing Authentication for /api Management API |
| CVE-2026-110615 | JS jshERP jishenghua | 7.1 | Oct 14 | jshERP through 3.6 Missing Authorization via /user/batchSetStatus |
| CVE-2026-110614 | CI citrus Yiuman | 6.5 | Oct 14 | Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter |
| CVE-2026-110613 | YO youlai-mall youlaitech | 6.5 | Oct 14 | youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List |
| CVE-2026-110612 | VL vlife wwwlike | 9.8 | Oct 14 | vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil |
| CVE-2026-110611 | RE rebuild getrebuild | 5.9 | Oct 14 | REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid |
| CVE-2026-110610 | RU ruoyi-vue-pro YunaiV | 5.4 | Oct 14 | ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl |
| CVE-2026-110609 | SK skyeye dromara | 6.5 | Oct 14 | Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter |
| CVE-2026-110608 | BJ BizSpring Java Mall BizSpring | 5.4 | Oct 14 | BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive |
| CVE-2026-110607 | BJ BizSpring Java Mall BizSpring | 6.5 | Oct 14 | BizSpring Shop through commit cf22d39daaf1 Payment Bypass via test_post_pay Endpoint |
| CVE-2026-110606 | LI libdxfrw LibreCAD | 3.3 | Oct 14 | LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader |
| CVE-2026-110605 | LI libschrift tomolt | 5.5 | Oct 14 | libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line |
| CVE-2026-110604 | MI Mini-XML Michael R Sweet | 3.6 | Oct 14 | Mini-XML 4.0.0 through 4.0.6 Stack Out-of-Bounds Write via mxml_strtod() |
| CVE-2026-110603 | LA LASzip rapidlasso | 6.3 | Oct 14 | LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header |
| CVE-2026-110602 | LI libmspack kyz | 6.3 | Oct 14 | libmspack through 0.11alpha Uninitialized Pointer Free via kwajd_open Error Path |
| CVE-2026-110601 | LI libsixel saitoha | 6.3 | Oct 14 | libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF |
| CVE-2026-110600 | XL xlsxio brechtsanders | 5.5 | Oct 14 | xlsxio through 0.2.37 NULL Pointer Dereference via Worksheet Relationship Without Id |
| CVE-2026-110599 | LS l-smash l-smash | 7.1 | Oct 14 | L-SMASH through 2.14.5 Double Free in HEVC and H.264 Importer Probe |
| CVE-2026-110598 | LI libpff libyal | 6.1 | Oct 14 | Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value |
| CVE-2026-110597 | TI tinyexr syoyo | 6.1 | Oct 14 | Tinyexr through 3.2.0 Heap Out-of-Bounds Read via ParseEXRMultipartHeaderFromMemory |
| CVE-2026-110596 | QU quirc dlbeer | 5.5 | Oct 14 | quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search |
| CVE-2026-110595 | BO BottleCRM MicroPyramid | 4.3 | Oct 14 | BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import |
| CVE-2026-110594 | BO BottleCRM MicroPyramid | 4.9 | Oct 14 | BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex |
| CVE-2026-110593 | BO BottleCRM MicroPyramid | 5.4 | Oct 14 | BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail |
| CVE-2026-110592 | BO BottleCRM MicroPyramid | 3.5 | Oct 14 | BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template |
| CVE-2026-110591 | AS ASM OW2 | 5.5 | Oct 14 | OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer |
| CVE-2026-110270 | AS ASM OW2 | 5.5 | Oct 14 | OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter |
| CVE-2026-110263 | AS ASM OW2 | 5.5 | Oct 14 | OW2 ASM 3.0 before 9.11 Uncontrolled Recursion in SignatureReader |
| CVE-2026-110262 | AS ASM OW2 | 3.3 | Oct 14 | OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter |
| CVE-2026-110261 | AS ASM OW2 | 5.5 | Oct 14 | OW2 ASM 3.0 before 9.11 Excessive CPU Consumption via ClassWriter COMPUTE_FRAMES |
| CVE-2026-110260 | AS ASM OW2 | 5.5 | Oct 14 | OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers |
| CVE-2026-110259 | AS ASM OW2 | 5.5 | Oct 14 | OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions() |
| CVE-2026-110258 | AS ASM OW2 | 5.5 | Oct 14 | OW2 ASM 3.0 before 9.11 Excessive Memory Allocation via Multiple RET Instructions |