CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 10:04 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-50276 | DD dd-trace-rb DataDog | 7.5 | Sep 14 | dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-50270 | DD dd-java-agent com.datadoghq | 7.5 | Sep 14 | dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-59960 | AR argos-javascript argos-ci | 7.5 | Sep 14 | Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core |
| CVE-2026-57579 | AL alchemy_cms AlchemyCMS | 7.5 | Sep 14 | Alchemy: Unauthenticated nested page API leaks restricted & unpublished content |
| CVE-2026-55416 | PI pimcore pimcore | 8.8 | Sep 14 | Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization |
| CVE-2026-55072 | PI pimcore pimcore | 8.5 | Sep 14 | Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name |
| CVE-2026-55451 | GE gettext-converter locize | 8.3 | Sep 14 | gettext-converter: Prototype pollution in js2i18next() via crafted translation keys |
| CVE-2026-84445 | GR grpc-go grpc | 8.7 | Sep 14 | gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers |
| CVE-2026-76442 | CS Cisco Secure Email Cisco | 7.5 | Sep 14 | Cisco Secure Email Gateway Security Hardening Release |
| CVE-2026-54156 | NO node-opcua node-opcua | 7.5 | Sep 14 | node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS |
| CVE-2026-54155 | NO node-opcua node-opcua | 7.7 | Sep 14 | node-opcua: Missing nonce verification in UserNameIdentityToken authentication |
| CVE-2026-61701 | LA laravel-magiclink cesargb | 8.8 | Sep 14 | Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution |
| CVE-2026-81301 | FM File Manager Ekia | 8.5 | Sep 14 | Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access |
| CVE-2026-90943 | FI filament-comments parallax | 8.7 | Sep 14 | parallax filament-comments through 3.0.0 Stored XSS via Comment Body |
| CVE-2026-47701 | OP opentelemetry-operator open-telemetry | 7.7 | Sep 14 | OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth |
| CVE-2026-90947 | RH Red Hat Enterprise Linux 6 Red Hat | 7.8 | Sep 14 | Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file |
| CVE-2026-57132 | PR PraisonAI MervinPraison | 8.2 | Sep 14 | PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication |
| CVE-2026-57122 | PR PraisonAI MervinPraison | 8.6 | Sep 14 | PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) |
| CVE-2026-56839 | PR PraisonAI MervinPraison | 7.3 | Sep 14 | PraisonAI Code agent tools fail open without a workspace boundary |
| CVE-2026-57119 | PR PraisonAI MervinPraison | 7.5 | Sep 14 | PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API |
| CVE-2026-57129 | PR praisonaiagents MervinPraison | 7.5 | Sep 14 | PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal |
| CVE-2026-57126 | PR PraisonAI MervinPraison | 8.5 | Sep 14 | praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS |
| CVE-2026-59570 | CC Client Connector Zscaler | 7.5 | Sep 14 | Android ZCC denial of service |
| CVE-2026-59569 | CC Client Connector Zscaler | 8.1 | Sep 14 | Android ZCC VPN API method privilege escalation |
| CVE-2026-25687 | CC Client Connector Zscaler | 8.1 | Sep 14 | ZCC race condition in ZPA tunnel handler |
| CVE-2026-57130 | PR praisonaiagents MervinPraison | 8.1 | Sep 14 | PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters |
| CVE-2026-82427 | AS Apache Storm Nimbus Apache Software Foundation | 7.8 | Sep 14 | Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name |
| CVE-2026-82428 | AS Apache Storm Client Apache Software Foundation | 8.8 | Sep 14 | Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys |
| CVE-2026-82429 | AS Apache Storm Worker Launcher Apache Software Foundation | 7.8 | Sep 14 | Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher |
| CVE-2026-82430 | AS Apache Storm Worker Launcher Apache Software Foundation | 7.8 | Sep 14 | Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant |
| CVE-2026-90789 | LM Leave Management System itsourcecode | 7.3 | Sep 14 | itsourcecode Leave Management System login.php sql injection |
| CVE-2026-82432 | AS Apache Storm Nimbus Apache Software Foundation | 8.1 | Sep 14 | Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides |
| CVE-2026-15600 | RA raty Alior Bank | 8.6 | Sep 14 | SQL Injection in Alior Bank raty PrestaShop module |
| CVE-2026-7848 | RA raty Alior Bank | 8.6 | Sep 14 | SQL Injection in Alior Bank raty PrestaShop module |
| CVE-2026-82438 | AS Apache Storm Webapp Apache Software Foundation | 8.1 | Sep 14 | Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins |
| CVE-2026-90787 | ST StudentManagement Soarkey | 7.3 | Sep 14 | Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management |
| CVE-2026-73195 | AS Apache Syncope Apache Software Foundation | 7.3 | Sep 14 | Apache Syncope: CSV export spreadsheet formula injection |
| CVE-2026-73236 | AS Apache Syncope Apache Software Foundation | 7.5 | Sep 14 | Apache Syncope: Cross-Realm authorization bypass in delegated administration |
| CVE-2026-90949 | RH Red Hat Enterprise Linux 6 Red Hat | 7.8 | Sep 14 | Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch |
| CVE-2026-90948 | RH Red Hat Enterprise Linux 6 Red Hat | 7.8 | Sep 14 | Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions |
| CVE-2026-73178 | AS Apache Syncope Apache Software Foundation | 7.5 | Sep 14 | Apache Syncope: JWT Access Token takeover |
| CVE-2026-90938 | LA LangBot langbot-app | 8.6 | Sep 14 | LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket |
| CVE-2026-90933 | LA laradashboard laradashboard | 7.1 | Sep 14 | laradashboard through 1.2.2 Missing Authorization via License API |
| CVE-2026-90932 | LA laradashboard laradashboard | 7.2 | Sep 14 | LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE |
| CVE-2026-90929 | FI filebrowser filebrowser | 8.1 | Sep 14 | File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup |
| CVE-2024-58383 | FR froxlor froxlor | 7.3 | Sep 14 | Froxlor before 2.2.0 Insecure File Permissions mysql.conf |
| CVE-2026-90715 | GR Gravity marcobambini | 7.3 | Sep 14 | marcobambini Gravity udp json-parser gravity_json.c integer overflow |
| CVE-2026-78336 | AS Apache Syncope Apache Software Foundation | 7.5 | Sep 14 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user |
| CVE-2026-90710 | TA tarzan-cms taisan | 7.3 | Sep 14 | taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery |
| CVE-2026-90708 | CM CMS Yot | 7.3 | Sep 14 | Yot CMS Cookie global.php login sql injection |