CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 02:47 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-81049 | T1 ThinOS 10 Dell | 6.7 | Sep 10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulnerability |
| CVE-2026-81051 | T1 ThinOS 10 Dell | 6.6 | Sep 10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerability |
| CVE-2026-88012 | TR traefik traefik | 5.3 | Sep 10 | Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded |
| CVE-2026-81052 | T1 ThinOS 10 Dell | 6.8 | Sep 10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability |
| CVE-2026-88940 | KN knowns knowns-dev | 5.3 | Sep 10 | knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint |
| CVE-2026-88938 | KN knowns knowns-dev | 6.5 | Sep 10 | knowns through 0.33.0 Path Traversal via code.find MCP tool |
| CVE-2026-88898 | AP AppFlowy-Cloud AppFlowy-IO | 6.5 | Sep 10 | AppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint |
| CVE-2026-88897 | FL flextype flextype | 5.9 | Sep 10 | Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String |
| CVE-2026-88006 | OP open-webui open-webui | 6.5 | Sep 10 | Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange |
| CVE-2026-88005 | OP open-webui open-webui | 6.5 | Sep 10 | Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange |
| CVE-2026-15461 | ZE zephyr zephyrproject | 5.3 | Sep 10 | Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input |
| CVE-2026-81793 | SB Salon booking system Dimitri Grassi | 6.5 | Sep 10 | WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability |
| CVE-2026-81791 | EV EventON Ashan Perera | 6.5 | Sep 10 | WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-81788 | IF IMPress for IDX Broker IDX Broker | 6.3 | Sep 10 | WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability |
| CVE-2026-81787 | IF IMPress for IDX Broker IDX Broker | 6.5 | Sep 10 | WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability |
| CVE-2026-81785 | BU BuddyForms Themekraft | 6.5 | Sep 10 | WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability |
| CVE-2026-81782 | WD WP Docs Fahad Mahmood | 6.5 | Sep 10 | WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-81275 | YO Youzify Youzify | 6.5 | Sep 10 | WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability |
| CVE-2026-78536 | RP Robokassa payment gateway for Woocommerce robokassa | 6.5 | Sep 10 | WordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability |
| CVE-2026-66674 | SC Simple Cloudflare Turnstile Elliot Sowers/ RelyWP | 5.6 | Sep 10 | WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability |
| CVE-2026-66632 | SC Simple Cloudflare Turnstile Elliot Sowers/ RelyWP | 6.5 | Sep 10 | WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability |
| CVE-2026-85310 | GR Groundhogg Adrian Tobey | 6.5 | Sep 10 | WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability |
| CVE-2026-88790 | PR Proma proma-ai | 4.8 | Sep 10 | proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal |
| CVE-2026-12682 | LI LIBRID/LIBREF Ankaref Innovation and Technology Inc. | 5.4 | Sep 10 | Stored XSS in Ankaref's LIBRID/LIBREF |
| CVE-2026-88921 | MI MISP MISP | 5.1 | Sep 10 | MISP: Unescaped HTML Injection in PDF Report Element Rendering |
| CVE-2026-45763 | SU suricata OISF | 5.9 | Sep 10 | Suricata lua: sandbox allocation limit not enforced for new allocations |
| CVE-2026-12683 | LI LIBRID/LIBREF Ankaref Innovation and Technology Inc. | 5.4 | Sep 10 | Stored XSS Yönetim panel in Ankaref's LIBRID/LIBREF |
| CVE-2026-88896 | ES espocrm espocrm | 5.3 | Sep 10 | EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass |
| CVE-2026-88894 | SN snipe-it grokability | 5.4 | Sep 10 | Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout |
| CVE-2026-88892 | OP openpanel Openpanel-dev | 5.0 | Sep 10 | OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch |
| CVE-2026-88884 | ME mend-renovate-ce mend | 5.8 | Sep 10 | Renovate before 44.3.1 Authentication Bypass via Digest Updates |
| CVE-2026-88878 | TR traefik traefik | 5.3 | Sep 10 | Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass |
| CVE-2026-88875 | AV AVideo WWBN | 4.3 | Sep 10 | AVideo Incomplete API Sanitization Information Disclosure |
| CVE-2026-88871 | AV AVideo WWBN | 4.3 | Sep 10 | WWBN AVideo CustomizeUser setSubscribers CSRF via GET |
| CVE-2026-88860 | CA capgo.app Cap-go | 6.3 | Sep 10 | Capgo Authorization Bypass via Stale Channel Permission Overrides |
| CVE-2026-85543 | WS Wi-Fi series camera Hikvision | 4.3 | Sep 10 | Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration… |
| CVE-2026-85544 | DS DS-KD8003 Hikvision | 6.1 | Sep 10 | Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card,… |
| CVE-2026-88038 | CO cookies cookies | 4.8 | Sep 10 | cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options |
| CVE-2026-9161 | WT Website Template DernekPlus | 5.3 | Sep 10 | User Enumeration in DernekPlus' Website Template |
| CVE-2026-17038 | DG drEryk Gabinet drEryk | 6.9 | Sep 10 | Use of Hard-coded Credentials in drEryk Gabinet |
| CVE-2026-88859 | RH Red Hat Enterprise Linux 6 Red Hat | 6.3 | Sep 10 | Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction |
| CVE-2026-84828 | RH Red Hat Enterprise Linux 10 Red Hat | 6.5 | Sep 10 | Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token |
| CVE-2026-78085 | SP SP Property extension for Joomla joomshaper.com | 6.9 | Sep 10 | Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 |
| CVE-2026-78374 | TP T4 Page Builder extension for Joomla joomlart.com | 6.9 | Sep 10 | Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 |
| CVE-2026-78084 | SP SP Property extension for Joomla joomshaper.com | 6.9 | Sep 10 | Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 |
| CVE-2026-78303 | SP SP Property extension for Joomla joomshaper.com | 6.9 | Sep 10 | Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 |
| CVE-2026-15889 | AH Aruba HiSpeed Cache arubadev | 6.4 | Sep 10 | Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content |
| CVE-2026-5399 | RF Redux Framework davidanderson | 6.4 | Sep 10 | Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value |
| CVE-2026-42808 | CO COINES_SDK Bosch Sensortec | 6.8 | Sep 10 | An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the… |
| CVE-2026-42806 | BS BME690 SensorAPI (C) Bosch Sensortec | 4.3 | Sep 10 | An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in… |