CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 14:54 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-75983 | EE Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce arraytics | 7.5 | Sep 15 | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter |
| CVE-2026-91004 | OF Online Faculty Clearance System SourceCodester | 7.3 | Sep 15 | SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection |
| CVE-2026-90880 | DS DSL-3782 D-Link | 7.4 | Sep 15 | D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection |
| CVE-2026-90879 | FI FilePress zyx0814 | 7.3 | Sep 15 | zyx0814 FilePress Publish search.php sql injection |
| CVE-2026-90877 | OF Online Faculty Clearance System SourceCodester | 7.3 | Sep 15 | SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection |
| CVE-2026-90876 | OF Online Faculty Clearance System SourceCodester | 7.3 | Sep 15 | SourceCodester Online Faculty Clearance System delete_requirement.php sql injection |
| CVE-2026-90858 | ON online-clinic-management-system subhajitkhan | 7.3 | Sep 15 | subhajitkhan online-clinic-management-system adminappview.php session_start authorization |
| CVE-2026-90856 | CN College Notes Gallery Management System SourceCodester | 7.3 | Sep 15 | SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management |
| CVE-2026-90855 | OF Online Food Ordering System katojkalemba | 7.3 | Sep 15 | SourceCodester/katojkalemba Online Food Ordering System order.php sql injection |
| CVE-2026-90854 | OF Online Food Ordering System katojkalemba | 7.3 | Sep 15 | SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection |
| CVE-2026-88262 | XC xClick bizwell | 8.7 | Sep 15 | Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass |
| CVE-2026-90852 | ZS zstd-jni luben | 7.3 | Sep 15 | luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free |
| CVE-2026-90849 | CN College Notes Gallery Management System SourceCodester | 7.3 | Sep 15 | SourceCodester College Notes Gallery Management System login.php sql injection |
| CVE-2026-91771 | WA wandb wandb | 8.8 | Sep 15 | Weights & Biases wandb before 0.29.0 Path Traversal via File Download |
| CVE-2026-90846 | DE Daily Expense Tracker System PHPGurukul | 7.3 | Sep 15 | PHPGurukul Daily Expense Tracker System forgot-password.php sql injection |
| CVE-2026-91752 | LI libextractor GNU | 7.5 | Sep 15 | GNU libextractor before 1.15 Stack Overflow via OLE2 |
| CVE-2026-91751 | FL flextype flextype | 8.3 | Sep 15 | Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API |
| CVE-2026-90844 | DE Daily Expense Tracker System PHPGurukul | 7.3 | Sep 15 | PHPGurukul Daily Expense Tracker System Login index.php sql injection |
| CVE-2026-90843 | WE WebMap SabyasachiRana | 8.3 | Sep 15 | SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection |
| CVE-2026-79411 | Product not mapped yet | 8.8 | Sep 15 | Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission… |
| CVE-2026-88616 | Product not mapped yet | 8.8 | Sep 15 | An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask,… |
| CVE-2026-52484 | Product not mapped yet | 8.8 | Sep 15 | An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi… |
| CVE-2026-88619 | Product not mapped yet | 8.1 | Sep 15 | 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module |
| CVE-2026-79410 | Product not mapped yet | 8.1 | Sep 15 | Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate… |
| CVE-2026-79425 | Product not mapped yet | 8.1 | Sep 15 | An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST… |
| CVE-2026-79551 | Product not mapped yet | 7.5 | Sep 15 | Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key |
| CVE-2026-51134 | Product not mapped yet | 7.5 | Sep 15 | The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml |
| CVE-2025-66974 | Product not mapped yet | 7.5 | Sep 15 | An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an… |
| CVE-2026-90841 | BD Blood Donor Management System PHPGurukul | 7.3 | Sep 14 | PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection |
| CVE-2026-90840 | BD Blood Donor Management System PHPGurukul | 7.3 | Sep 14 | PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication |
| CVE-2026-91200 | DE devspace devspace | 8.8 | Sep 14 | DevSpace through 6.3.21 Path Traversal via tar extraction |
| CVE-2026-91145 | AC Activiti Activiti | 7.1 | Sep 14 | Activiti through 7.1.0.M6 Expression Injection via Mail Task |
| CVE-2026-91144 | ZF zfile zfile-dev | 7.5 | Sep 14 | ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint |
| CVE-2026-91143 | GO goproxy snail007 | 7.2 | Sep 14 | goproxy through 15.3 Authentication Bypass via CONNECT |
| CVE-2026-12756 | BA Business Automation Workflow containers and traditional IBM | 7.1 | Sep 14 | Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 |
| CVE-2026-13275 | MQ MQ IBM | 7.1 | Sep 14 | IBM MQ Managed File Transfer is vulnerable to XML external entity injection |
| CVE-2026-13285 | MQ MQ IBM | 7.1 | Sep 14 | IBM MQ Managed File Transfer is vulnerable to XML external entity injection |
| CVE-2026-13293 | MQ MQ IBM | 8.8 | Sep 14 | IBM MQ Java messaging is vulnerable to remote code execution |
| CVE-2026-13287 | MQ MQ IBM | 7.1 | Sep 14 | IBM MQ Managed File Transfer is vulnerable to XML external entity injection |
| CVE-2026-90896 | ET Ecommerce Template MarcosCamara01 | 8.2 | Sep 14 | Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII |
| CVE-2026-19290 | SF Sterling File Gateway IBM | 7.5 | Sep 14 | IBM Sterling File Gateway is Vulnerable to Improper Access Control |
| CVE-2026-68489 | PE Plesk extension "Node.js Toolkit" WebPros | 8.7 | Sep 14 | Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom… |
| CVE-2026-28960 | IO iOS Apple | 7.5 | Sep 14 | A denial-of-service issue was addressed with improved validation |
| CVE-2026-84631 | MA macOS Apple | 7.8 | Sep 14 | This issue was addressed with additional entitlement checks |
| CVE-2026-84563 | MA macOS Apple | 7.5 | Sep 14 | A logic issue was addressed with improved checks |
| CVE-2026-43686 | MA macOS Apple | 8.8 | Sep 14 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-84575 | MA macOS Apple | 7.8 | Sep 14 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-64701 | MA macOS Apple | 7.8 | Sep 14 | A permissions issue was addressed with additional restrictions |
| CVE-2026-84543 | MA macOS Apple | 7.5 | Sep 14 | An out-of-bounds access issue was addressed with improved bounds checking |
| CVE-2026-86895 | IO iOS Apple | 7.5 | Sep 14 | An information disclosure issue was addressed with improved state management |