CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 12:23 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82794 | SV SV-CPT-MC310 Contec Co., Ltd. | 8.8 | Sep 14 | SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings |
| CVE-2026-82793 | CA CAN-2-USB Contec Co., Ltd. | 7.2 | Sep 14 | Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit |
| CVE-2026-82765 | FX FXA3000 Contec Co., Ltd. | 8.1 | Sep 14 | Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series |
| CVE-2026-82791 | CA CAN-2-USB Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit |
| CVE-2026-90691 | HA HexStrike AI 0x4m4 | 8.3 | Sep 14 | 0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal |
| CVE-2026-82789 | CH CONPROSYS HMI System(CHS) Contec | 8.8 | Sep 14 | An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS) |
| CVE-2026-82780 | CP CPS-TM341G5MB-ADSC1-931 Contec Co., Ltd | 8.8 | Sep 14 | Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series |
| CVE-2026-82779 | CP CPS-TM341G5MB-ADSC1-931 Contec Co., Ltd | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series |
| CVE-2026-82777 | CT Configurable type CPS-PCS341[][]-DS1-1201 Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series |
| CVE-2026-82774 | MC M2M Controller Configurable type CPS-MCS341* Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series |
| CVE-2026-82772 | EC ECE1000 Contec Co., Ltd. | 8.8 | Sep 14 | Buffer overflow vulnerability exists in Contec EC1000 series |
| CVE-2026-82770 | RP RP-WAH-SR1 Contec Co., Ltd. | 8.8 | Sep 14 | Buffer overflow vulnerability exists in Contec RP-WAH-SR Series |
| CVE-2026-82768 | SG SGA1000 Contec Co., Ltd. | 8.1 | Sep 14 | Path traversal vulnerability exists in SGA1000 |
| CVE-2026-82766 | SG SGA1000 Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000 |
| CVE-2026-82762 | FX FXA3000 Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 series |
| CVE-2026-68955 | TI The installer for Rakuten Kobo Desktop Application (Windows version) Rakuten Kobo Inc. | 7.8 | Sep 14 | The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries |
| CVE-2026-90690 | HA HexStrike AI 0x4m4 | 7.3 | Sep 14 | 0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection |
| CVE-2026-88852 | SF Snippets (Free) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0 |
| CVE-2026-85190 | QI Quick Index (Free, Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5 |
| CVE-2026-85189 | MF Modals (Free, Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0 |
| CVE-2026-90689 | W2 W20E Tenda | 8.8 | Sep 14 | Tenda W20E formDelWebAuthWhiteUser stack-based overflow |
| CVE-2026-85195 | AA Articles Anywhere (Free, Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0 |
| CVE-2026-88853 | MP Modals (Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0 |
| CVE-2026-85191 | TA Tabs & Accordions (Free, Pro) extension for Joomla regularlabs.com | 7.5 | Sep 14 | Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0 |
| CVE-2026-90620 | HA HexStrike AI 0x4m4 | 7.3 | Sep 14 | 0x4m4 HexStrike AI API Command Endpoint hexstrike_server.py missing authentication |
| CVE-2026-90619 | HA HexStrike AI 0x4m4 | 7.3 | Sep 14 | 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection |
| CVE-2026-90618 | PE PentestAgent GH05TCREW | 7.3 | Sep 14 | GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injection |
| CVE-2026-90617 | PE PentestAgent GH05TCREW | 7.3 | Sep 14 | GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection |
| CVE-2023-50461 | DI direct_mail TYPO3 | 8.8 | Sep 14 | An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3 |
| CVE-2023-46273 | IE IQ Engine extremenetworks | 8.8 | Sep 14 | Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send |
| CVE-2023-45858 | PN PRTG Network Monitor Paessler | 8.6 | Sep 14 | A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files |
| CVE-2026-23789 | E8 Exynos 850 firmware Samsung | 7.8 | Sep 14 | An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930,… |
| CVE-2026-31278 | B2 BioStar 2 supremainc | 7.7 | Sep 14 | An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service… |
| CVE-2023-32803 | CA ca-certificates Amazon | 7.5 | Sep 14 | The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store |
| CVE-2026-33963 | E1 Exynos 1330 firmware Samsung | 7.5 | Sep 14 | An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680 |
| CVE-2023-28148 | PN PRTG Network Monitor Paessler | 7.2 | Sep 14 | A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520 |
| CVE-2026-90603 | OP Open-Generative-AI Anil-matcha | 7.3 | Sep 13 | Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload |
| CVE-2026-15891 | ZE zephyr zephyrproject | 7.5 | Sep 13 | NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway |
| CVE-2026-90601 | GR graphiti getzep | 7.3 | Sep 13 | getzep graphiti REST API main.py improper authentication |
| CVE-2026-90593 | EM embedded-graphics Embedded-graphics | 7.3 | Sep 13 | embedded-graphics image_raw.rs draw_sub_image integer overflow |
| CVE-2026-88802 | ME MDJM Event Management | 7.5 | Sep 13 | MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion |
| CVE-2026-88793 | YE YouTube Embed | 8.8 | Sep 13 | YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server |
| CVE-2026-85129 | HC Hoo Companion | 8.8 | Sep 13 | Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import |
| CVE-2026-74933 | GE GenieWords | 8.8 | Sep 13 | GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite |
| CVE-2026-90579 | CC Cheshire Cat AI cheshire-cat-ai | 7.3 | Sep 13 | cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication |
| CVE-2026-90566 | IN inventory-management-system Rizwan17 | 7.3 | Sep 13 | Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorization |
| CVE-2026-90526 | SR School Registration and Fee System SourceCodester | 7.3 | Sep 13 | SourceCodester School Registration and Fee System save_class.php sql injection |
| CVE-2026-90524 | TO Tourism-Management-System jaychouchannel | 7.3 | Sep 13 | jaychouchannel Tourism-Management-System Update Endpoint missing authentication |
| CVE-2026-90523 | TO Tourism-Management-System jaychouchannel | 7.3 | Sep 13 | jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges management |
| CVE-2026-90522 | TO Tourism-Management-System jaychouchannel | 7.3 | Sep 13 | jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery |