CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 16:51 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-91933 | FL Flowise FlowiseAI | 7.1 | Sep 15 | Flowise before 3.1.4 Authorization Bypass via openai-realtime |
| CVE-2026-91932 | FL Flowise FlowiseAI | 8.5 | Sep 15 | Flowise before 3.1.4 Remote Code Execution via cwd Parameter |
| CVE-2026-91931 | FL Flowise FlowiseAI | 8.5 | Sep 15 | Flowise before 3.1.4 Remote Code Execution via Custom MCP npx |
| CVE-2026-91930 | FL Flowise FlowiseAI | 7.5 | Sep 15 | Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover |
| CVE-2026-91929 | FL Flowise FlowiseAI | 7.1 | Sep 15 | Flowise before 3.1.4 Cross-Tenant Authorization Bypass |
| CVE-2024-14029 | TO tornado tornadoweb | 7.5 | Sep 15 | Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding |
| CVE-2023-54397 | TO tornado tornadoweb | 7.5 | Sep 15 | Tornado before 6.3.3 HTTP Request Smuggling via Content-Length |
| CVE-2026-54077 | AR arcadedb ArcadeData | 7.1 | Sep 15 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users |
| CVE-2026-54076 | AR arcadedb ArcadeData | 8.1 | Sep 15 | ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) |
| CVE-2026-91848 | WU WuzhiCMS Wuzhicms | 7.3 | Sep 15 | WuzhiCMS index.php getDataOfJson sql injection |
| CVE-2026-59973 | AD adapters @frontmcp | 8.5 | Sep 15 | mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi |
| CVE-2026-87791 | DE design-scuole-wordpress-theme Developers Italia | 8.7 | Sep 15 | Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme |
| CVE-2026-85013 | RH Red Hat Enterprise Linux 10 Red Hat | 7.3 | Sep 15 | Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters |
| CVE-2026-55178 | GE geolens geolens-io | 7.5 | Sep 15 | GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data |
| CVE-2026-53966 | XW xwiki-platform xwiki | 7.1 | Sep 15 | XWiki Platform: Privilege escalation from edit to script right through Live Data editing |
| CVE-2026-53957 | MC mcp-server @contentful | 7.7 | Sep 15 | Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint |
| CVE-2026-54167 | PI pipelines-as-code tektoncd | 8.2 | Sep 15 | Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header |
| CVE-2026-57586 | AG agent-coderag naranor | 8.6 | Sep 15 | CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution |
| CVE-2026-89025 | HH Hirschmann HiOS Switch Platform Belden | 7.5 | Sep 15 | Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request |
| CVE-2026-90650 | MH MotoPress Hotel Booking jetmonsters | 7.2 | Sep 15 | MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' |
| CVE-2026-16141 | PH phosphor-net-ipmid OpenBMC | 8.1 | Sep 15 | OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value |
| CVE-2026-16140 | PH phosphor-net-ipmid OpenBMC | 8.8 | Sep 15 | OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1 |
| CVE-2026-14805 | CB Consulting - Business, Finance WordPress Theme StylemixThemes | 8.8 | Sep 15 | Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX |
| CVE-2026-92076 | FI Firefox Mozilla | 8.8 | Sep 15 | Incorrect boundary conditions in the Networking component |
| CVE-2026-92074 | FI Firefox Mozilla | 8.8 | Sep 15 | Mitigation bypass in the Popup Blocker component |
| CVE-2026-92073 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation in the Enterprise Policies component |
| CVE-2026-92072 | FI Firefox Mozilla | 8.0 | Sep 15 | Incorrect boundary conditions in the Safe Browsing component |
| CVE-2026-92067 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Widget: Gtk component |
| CVE-2026-92065 | FI Firefox Mozilla | 8.8 | Sep 15 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component |
| CVE-2026-92064 | FI Firefox Mozilla | 8.8 | Sep 15 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component |
| CVE-2026-92062 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation in the Session Restore component |
| CVE-2026-92060 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Internationalization component |
| CVE-2026-92058 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Graphics component |
| CVE-2026-92056 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Graphics: Text component |
| CVE-2026-92055 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation in the DevTools component |
| CVE-2026-92054 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation in the Memory component |
| CVE-2026-92053 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation in the Graphics: CanvasWebGL component |
| CVE-2026-92052 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component |
| CVE-2026-92049 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Widget: Win32 component |
| CVE-2026-92047 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation in the Crash Reporting component |
| CVE-2026-92046 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Graphics component |
| CVE-2026-92044 | FI Firefox Mozilla | 7.5 | Sep 15 | Information disclosure in the Networking: HTTP component |
| CVE-2026-92043 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Audio/Video component |
| CVE-2026-92042 | FI Firefox Mozilla | 7.5 | Sep 15 | Race condition in the DOM: Content Processes component |
| CVE-2026-92040 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the JavaScript: WebAssembly component |
| CVE-2026-92033 | FM Firefox Mobile Mozilla | 8.8 | Sep 15 | Privilege escalation in Firefox for Android |
| CVE-2026-92029 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the SVG component |
| CVE-2026-92028 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the DOM: Core & HTML component |
| CVE-2026-92027 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the DOM: Streams component |
| CVE-2026-92026 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Networking component |