CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 07:05 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-78375 | SP SP Page Builder (Free and Pro) extension for Joomla joomshaper.com | 8.6 | Sep 14 | Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 |
| CVE-2026-90707 | OP Open5GS Open5gs | 8.3 | Sep 14 | Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free |
| CVE-2026-20773 | PI PingFederate Ping Identity | 8.5 | Sep 14 | Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint |
| CVE-2026-87779 | AS Apache Syncope Apache Software Foundation | 7.5 | Sep 14 | Apache Syncope: AES Secret Key disclosure via log output |
| CVE-2026-8821 | MA Mattermost Mattermost | 7.1 | Sep 14 | Playbooks run owner channel membership permission bypass |
| CVE-2026-89180 | EF EFence Thinking Software Technology | 7.5 | Sep 14 | Thinking Software Technology｜EFence - SQL Injection |
| CVE-2026-72524 | AD Apache Doris Apache Software Foundation | 8.8 | Sep 14 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables |
| CVE-2026-90894 | PD Parallels Desktop for Mac Parallels | 7.8 | Sep 14 | Parallels Desktop local privilege escalation via appliance extract argument injection |
| CVE-2026-90895 | MI MISP MISP | 8.4 | Sep 14 | MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection |
| CVE-2026-90701 | ON online-clinic-management-system subhajitkhan | 7.3 | Sep 14 | subhajitkhan online-clinic-management-system listdoctor.php sql injection |
| CVE-2026-12518 | LO Logi Options+ Logitech | 8.5 | Sep 14 | Local privilege escalation in the Logi Options+ updater service on Windows |
| CVE-2026-71198 | GL Glance OpenStack | 7.0 | Sep 14 | In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image |
| CVE-2026-82794 | SV SV-CPT-MC310 Contec Co., Ltd. | 8.8 | Sep 14 | SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings |
| CVE-2026-82793 | CA CAN-2-USB Contec Co., Ltd. | 7.2 | Sep 14 | Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit |
| CVE-2026-82765 | FX FXA3000 Contec Co., Ltd. | 8.1 | Sep 14 | Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series |
| CVE-2026-82791 | CA CAN-2-USB Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit |
| CVE-2026-90691 | HA HexStrike AI 0x4m4 | 8.3 | Sep 14 | 0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal |
| CVE-2026-82789 | CH CONPROSYS HMI System(CHS) Contec | 8.8 | Sep 14 | An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS) |
| CVE-2026-82780 | CP CPS-TM341G5MB-ADSC1-931 Contec Co., Ltd | 8.8 | Sep 14 | Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series |
| CVE-2026-82779 | CP CPS-TM341G5MB-ADSC1-931 Contec Co., Ltd | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series |
| CVE-2026-82777 | CT Configurable type CPS-PCS341[][]-DS1-1201 Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series |
| CVE-2026-82774 | MC M2M Controller Configurable type CPS-MCS341* Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series |
| CVE-2026-82772 | EC ECE1000 Contec Co., Ltd. | 8.8 | Sep 14 | Buffer overflow vulnerability exists in Contec EC1000 series |
| CVE-2026-82770 | RP RP-WAH-SR1 Contec Co., Ltd. | 8.8 | Sep 14 | Buffer overflow vulnerability exists in Contec RP-WAH-SR Series |
| CVE-2026-82768 | SG SGA1000 Contec Co., Ltd. | 8.1 | Sep 14 | Path traversal vulnerability exists in SGA1000 |
| CVE-2026-82766 | SG SGA1000 Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000 |
| CVE-2026-82762 | FX FXA3000 Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 series |
| CVE-2026-68955 | TI The installer for Rakuten Kobo Desktop Application (Windows version) Rakuten Kobo Inc. | 7.8 | Sep 14 | The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries |
| CVE-2026-90690 | HA HexStrike AI 0x4m4 | 7.3 | Sep 14 | 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection |
| CVE-2026-88852 | SF Snippets (Free) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 |
| CVE-2026-85190 | QI Quick Index (Free, Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 |
| CVE-2026-85189 | MF Modals (Free, Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 |
| CVE-2026-90689 | W2 W20E Tenda | 8.8 | Sep 14 | Tenda W20E formDelWebAuthWhiteUser stack-based overflow |
| CVE-2026-85195 | AA Articles Anywhere (Free, Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 |
| CVE-2026-88853 | MP Modals (Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 |
| CVE-2026-85191 | TA Tabs & Accordions (Free, Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 |
| CVE-2026-90620 | HA HexStrike AI 0x4m4 | 7.3 | Sep 14 | 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication |
| CVE-2026-90619 | HA HexStrike AI 0x4m4 | 7.3 | Sep 14 | 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection |
| CVE-2026-90618 | PE PentestAgent GH05TCREW | 7.3 | Sep 14 | GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injection |
| CVE-2026-90617 | PE PentestAgent GH05TCREW | 7.3 | Sep 14 | GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection |
| CVE-2023-50461 | DI direct_mail TYPO3 | 8.8 | Sep 14 | An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3 |
| CVE-2023-46273 | IE IQ Engine extremenetworks | 8.8 | Sep 14 | Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send |
| CVE-2023-45858 | PN PRTG Network Monitor Paessler | 8.6 | Sep 14 | A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files |
| CVE-2026-23789 | E8 Exynos 850 firmware Samsung | 7.8 | Sep 14 | An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930,… |
| CVE-2026-31278 | B2 BioStar 2 supremainc | 7.7 | Sep 14 | An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service… |
| CVE-2026-33963 | E1 Exynos 1330 firmware Samsung | 7.5 | Sep 14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 |
| CVE-2023-32803 | CA ca-certificates Amazon | 7.5 | Sep 14 | The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store |
| CVE-2023-28148 | PN PRTG Network Monitor Paessler | 7.2 | Sep 14 | A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520 |
| CVE-2026-90603 | OP Open-Generative-AI Anil-matcha | 7.3 | Sep 13 | Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload |
| CVE-2026-15891 | ZE zephyr zephyrproject | 7.5 | Sep 13 | NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway |