CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 07:13 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114173 New | OR ortto canva | 5.3 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages |
| CVE-2026-113387 New | OR ortto canva | 8.6 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML |
| CVE-2026-66092 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS in pre-login notice via reachable legacy logon route |
| CVE-2026-66091 New | OP openEQUELLA Apereo Foundation | 6.9 | Oct 29 | Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details |
| CVE-2026-66090 New | OP openEQUELLA Apereo Foundation | 7.1 | Oct 29 | XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read |
| CVE-2026-66089 New | OP openEQUELLA Apereo Foundation | 6.1 | Oct 29 | XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion |
| CVE-2026-66088 New | OP openEQUELLA Apereo Foundation | 9.4 | Oct 29 | Unrestricted Command Execution via system.execute |
| CVE-2026-16889 New | OP openEQUELLA Apereo Foundation | 4.8 | Oct 29 | Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin |
| CVE-2026-21157 New | BI Bixby Samsung Mobile | 8.3 | Oct 29 | Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity |
| CVE-2026-113957 New | CO container Apple | – | Oct 29 | An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an… |
| CVE-2026-118590 New | NI nibabel nipy | 5.3 | Oct 29 | nipy nibabel Header volumeutils.py array_from_file memory allocation |
| CVE-2026-118589 New | ME meshio nschloe | 5.3 | Oct 28 | nschloe meshio VTK Reader _vtk_42.py memory allocation |
| CVE-2026-118586 New | FE feedfinder2 dfm | 5.3 | Oct 28 | dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery |
| CVE-2026-118585 New | IN inventariobasico configuroweb | 3.5 | Oct 28 | configuroweb inventariobasico Add Product addlist.php cross site scripting |
| CVE-2026-86983 New | SW swift-crypto Apple | – | Oct 28 | A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length |
| CVE-2026-118579 New | DI DIR-505 D-Link | 9.8 | Oct 28 | D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor |
| CVE-2026-118578 New | MU MusicFreeDesktop maotoumao | 4.3 | Oct 28 | maotoumao MusicFreeDesktop Request Forwarder information disclosure |
| CVE-2026-82411 New | OP open-object maykinmedia | 6.5 | Oct 28 | Objects API: Cross-object-type authorization bypass on the object history-detail endpoint |
| CVE-2026-85749 New | MA MailWatch mailwatch | 8.1 | Oct 28 | MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail |
| CVE-2026-55561 New | IN InvoicePlane InvoicePlane | 5.3 | Oct 28 | InvoicePlane: Guest user IDOR in quote approval and rejection |
| CVE-2026-75520 New | DO domoticz domoticz | 5.4 | Oct 28 | Domoticz: Missing authorization and path traversal in the udevices Lua parser handler |
| CVE-2026-118577 New | MU MusicFreeDesktop maotoumao | 6.3 | Oct 28 | maotoumao MusicFreeDesktop Request Forwarder server-side request forgery |
| CVE-2026-118538 New | A2 a2ui a2ui-project | 5.5 | Oct 28 | a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes |
| CVE-2026-61575 New | AV AVideo-Encoder WWBN | 4.7 | Oct 28 | AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles |
| CVE-2026-61569 New | AV AVideo-Encoder WWBN | 7.5 | Oct 28 | AVideo-Encoder: pre-authentication streamer-login SQL injection |
| CVE-2026-54453 New | OP OpenCATS opencats | 7.2 | Oct 28 | OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional) |
| CVE-2026-61571 New | AV AVideo-Encoder WWBN | 7.3 | Oct 28 | AVideo-Encoder: missing authentication on control and status endpoints |
| CVE-2026-116641 New | MO MongoDB MongoDB | 6.8 | Oct 28 | The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs |
| CVE-2026-61572 New | AV AVideo-Encoder WWBN | 8.6 | Oct 28 | AVideo-Encoder: unauthenticated full-response server-side request forgery |
| CVE-2026-61573 New | AV AVideo-Encoder WWBN | 6.1 | Oct 28 | AVideo-Encoder: reflected cross-site scripting in the login interface |
| CVE-2026-118537 New | A2 a2ui A2ui | 4.3 | Oct 28 | a2ui Image Player/Video Player/Audio Player Image.js input validation |
| CVE-2026-54455 New | OP OpenCATS opencats | 7.6 | Oct 28 | OpenCATS: Authenticated SQL injection in activity DataGrid date filters |
| CVE-2026-61567 New | AV AVideo-Encoder WWBN | 10.0 | Oct 28 | AVideo-Encoder: unauthenticated command execution through streamer login trust |
| CVE-2026-61564 New | AV AVideo-Encoder WWBN | 10.0 | Oct 28 | AVideo-Encoder: unauthenticated installer PHP code injection |
| CVE-2026-57448 New | BL blombooru mrblomblo | 6.2 | Oct 28 | Blombooru: administrator image-proxy server-side request forgery |
| CVE-2026-93851 New | MA Mattermost Mattermost | 8.0 | Oct 28 | Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post |
| CVE-2026-61546 New | AN anki-mcp-server-addon ankimcp | 8.8 | Oct 28 | AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools |
| CVE-2026-118804 New | BB Bricks Builder Bricks | 7.5 | Oct 28 | Bricks Broken Access Control via query_result Endpoint |
| CVE-2026-118803 New | BT Bricks Theme Bricks | 7.5 | Oct 28 | Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result |
| CVE-2026-118757 New | PD PiWeb Disable payment method / Partial payment for WooCommerce PI Websolution | 6.5 | Oct 28 | PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees |
| CVE-2026-118756 New | GO gopass gopasspw | 5.5 | Oct 28 | gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir |
| CVE-2026-118755 New | PE personal-management-system Volmarg | 7.2 | Oct 28 | Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path |
| CVE-2026-118754 New | DE Dolibarr ERP/CRM Dolibarr | 5.3 | Oct 28 | Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php |
| CVE-2026-118753 New | FR FreeImage danoli3 | 7.8 | Oct 28 | FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing |
| CVE-2026-118752 New | FR FreeImage danoli3 | 7.8 | Oct 28 | FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder |
| CVE-2026-118694 New | PY python-markdown2 trentm | 7.5 | Oct 28 | python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations |
| CVE-2026-118693 New | CH cherrytree giuspen | 4.7 | Oct 28 | CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path |
| CVE-2026-118692 New | CH cherrytree giuspen | 7.0 | Oct 28 | CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action |
| CVE-2026-118691 New | XI xianyu-auto-reply-fix GuDong2003 | 3.7 | Oct 28 | xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message |
| CVE-2026-118690 New | SI signalk-server SignalK | 9.8 | Oct 28 | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs |