CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 00:04 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90566 | IN inventory-management-system Rizwan17 | 7.3 | Sep 13 | Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorization |
| CVE-2026-90526 | SR School Registration and Fee System SourceCodester | 7.3 | Sep 13 | SourceCodester School Registration and Fee System save_class.php sql injection |
| CVE-2026-90524 | TO Tourism-Management-System jaychouchannel | 7.3 | Sep 13 | jaychouchannel Tourism-Management-System Update Endpoint missing authentication |
| CVE-2026-90523 | TO Tourism-Management-System jaychouchannel | 7.3 | Sep 13 | jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management |
| CVE-2026-90522 | TO Tourism-Management-System jaychouchannel | 7.3 | Sep 13 | jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery |
| CVE-2026-90783 | MK MKVToolNix Moritz Bunkus | 7.8 | Sep 13 | MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound |
| CVE-2026-90780 | SI sipp SIPp | 7.5 | Sep 13 | SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content |
| CVE-2026-90779 | SI sipp SIPp | 7.5 | Sep 13 | SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter |
| CVE-2026-90778 | SI sipp SIPp | 7.5 | Sep 13 | SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag |
| CVE-2026-90777 | ES espnet espnet | 8.8 | Sep 13 | ESPnet before 202609 Remote Code Execution via Unsafe Deserialization |
| CVE-2026-90776 | NO nodemailer nodemailer | 7.5 | Sep 13 | Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing |
| CVE-2026-90516 | SR School Registration and Fee System SourceCodester | 7.3 | Sep 13 | SourceCodester School Registration and Fee System pay_report.php sql injection |
| CVE-2026-90515 | SR School Registration and Fee System SourceCodester | 7.3 | Sep 13 | SourceCodester School Registration and Fee System delete_stud.php sql injection |
| CVE-2026-90514 | SR School Registration and Fee System SourceCodester | 7.3 | Sep 13 | SourceCodester School Registration and Fee System save_stud.php sql injection |
| CVE-2026-90774 | RU rustypaste orhun | 7.5 | Sep 13 | rustypaste before 0.18.1 Path Traversal via filename header |
| CVE-2026-90772 | AM amundsen-frontend amundsen-io | 7.6 | Sep 13 | Amundsen Frontend through 4.3.0 Stored XSS via Description |
| CVE-2026-90770 | SP spug openspug | 8.8 | Sep 13 | Spug through 3.4.0 Remote Code Execution via ping_check |
| CVE-2026-90769 | OP open-notebook lfnovo | 7.7 | Sep 13 | Open Notebook before 1.11.0 Server-Side Request Forgery via link-source |
| CVE-2026-90768 | CA CAPEv2 kevoreilly | 8.1 | Sep 13 | CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check |
| CVE-2026-90562 | LA LangBot langbot-app | 8.1 | Sep 13 | LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key |
| CVE-2026-90561 | ST strapi strapi | 8.7 | Sep 13 | Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG |
| CVE-2026-90510 | OR orion-visor dromara | 8.3 | Sep 13 | dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key |
| CVE-2026-90509 | OR orion-visor dromara | 7.3 | Sep 13 | dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials |
| CVE-2026-90504 | WA WARP-Clash-API vvbbnn00 | 7.3 | Sep 13 | vvbbnn00 WARP-Clash-API authorized missing authentication |
| CVE-2026-90498 | VH vhr lenve | 7.3 | Sep 13 | lenve vhr vhr.sql default credentials |
| CVE-2026-89080 | RS Really Simple Security | 7.5 | Sep 13 | Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion |
| CVE-2026-86406 | UR User Registration & Membership | 7.5 | Sep 13 | User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase |
| CVE-2026-80071 | UR User Registration & Membership | 7.2 | Sep 13 | User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator |
| CVE-2026-90678 | HA HAProxy HAProxy | 7.5 | Sep 13 | An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5 |
| CVE-2026-90495 | FO Feng Office Fengoffice | 7.3 | Sep 13 | Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection |
| CVE-2026-90493 | ID Internet Download Manager Tonec | 8.8 | Sep 13 | Tonec Internet Download Manager Kernel Driver idmwfp.sys access control |
| CVE-2026-90668 | UN UnrealIRCd UnrealIRCd | 7.5 | Sep 13 | The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory… |
| CVE-2026-37008 | CR CrewAI CrewAI | 8.1 | Sep 13 | CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275 |
| CVE-2026-29811 | CY CyberPanel CyberPanel | 7.7 | Sep 13 | CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query… |
| CVE-2026-36453 | RH Rhymix Rhymix | 7.4 | Sep 13 | Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1 |
| CVE-2026-52297 | FF FFmpeg FFmpeg | 7.1 | Sep 13 | FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c |
| CVE-2026-52296 | FF FFmpeg FFmpeg | 7.1 | Sep 13 | FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c |
| CVE-2026-90651 | SF Socket Firewall Socket | 8.1 | Sep 12 | Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default |
| CVE-2026-90648 | WA wabt WebAssembly | 7.1 | Sep 12 | wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack |
| CVE-2026-90647 | AV ASE2000 V2 Communication Test Set Kalkitech | 7.4 | Sep 12 | ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task… |
| CVE-2026-90616 | FL Flatpak Flatpak | 7.4 | Sep 12 | In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the… |
| CVE-2026-90560 | ZS zstd-jni luben | 8.2 | Sep 12 | zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress |
| CVE-2026-90559 | SN snappy-java xerial | 7.5 | Sep 12 | snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress |
| CVE-2026-90556 | FR freeciv freeciv | 7.8 | Sep 12 | Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load |
| CVE-2026-15451 | MC MemberPress Corporate Accounts MemberPress | 8.8 | Sep 12 | MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation |
| CVE-2026-90554 | VL vLLM vllm-project | 7.5 | Sep 12 | vLLM before 0.28.0 Denial of Service via audio extraction |
| CVE-2026-90553 | VL vLLM vllm-project | 7.8 | Sep 12 | vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor |
| CVE-2026-90537 | AV AVideo WWBN | 8.2 | Sep 12 | WWBN AVideo Scheduler sendEmail Missing Authorization via Token |
| CVE-2026-90535 | FL Flowise FlowiseAI | 7.5 | Sep 12 | Flowise before 3.1.4 Denial of Service via text-to-speech/abort |
| CVE-2026-78175 | TL Tutor LMS – eLearning and online course solution themeum | 8.8 | Sep 12 | Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution |