CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 06:05 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-78374 | TP T4 Page Builder extension for Joomla joomlart.com | 6.9 | Sep 10 | Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 |
| CVE-2026-78084 | SP SP Property extension for Joomla joomshaper.com | 6.9 | Sep 10 | Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 |
| CVE-2026-78303 | SP SP Property extension for Joomla joomshaper.com | 6.9 | Sep 10 | Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 |
| CVE-2026-15889 | AH Aruba HiSpeed Cache arubadev | 6.4 | Sep 10 | Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content |
| CVE-2026-5399 | RF Redux Framework davidanderson | 6.4 | Sep 10 | Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value |
| CVE-2026-42808 | CO COINES_SDK Bosch Sensortec | 6.8 | Sep 10 | An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function {{coines_read_stream_sensor_data()}} fails to validate the… |
| CVE-2026-42806 | BS BME690 SensorAPI (C) Bosch Sensortec | 4.3 | Sep 10 | An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within the field data parsing logic in… |
| CVE-2026-88265 | RH Red Hat Enterprise Linux 10 Red Hat | 5.6 | Sep 10 | Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown |
| CVE-2026-88264 | CR crun containers | 5.6 | Sep 10 | Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs |
| CVE-2026-88288 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 6.5 | Sep 10 | GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink Creation |
| CVE-2026-88284 | GV GV-LPC2011/LPC2211 - GeoVision Inc. | 4.9 | Sep 10 | GV-LPC2011/LPC2211 - ONVIF SetUser Repeated-Element Stack-Frame Overflow Denial of Service |
| CVE-2026-88283 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 4.9 | Sep 10 | GV-LPC2011/LPC2211 - ONVIF CreateUsers Repeated-Element Stack-Frame Overflow Denial of Service |
| CVE-2026-88281 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 4.9 | Sep 10 | GV-LPC2011/LPC2211 - ONVIF DeleteUsers Repeated-Element Stack Overflow Denial of Service |
| CVE-2026-88280 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 4.9 | Sep 10 | GV-LPC2011/LPC2211 - ONVIF SetUser Stack-Frame Overflow Denial of Service |
| CVE-2026-88279 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 4.9 | Sep 10 | GV-LPC2011/LPC2211 - ONVIF CreateUsers Username/Password Stack-Frame Overflow Denial of Service |
| CVE-2026-88270 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 6.5 | Sep 10 | GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service |
| CVE-2026-88269 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 6.5 | Sep 10 | GV-LPC2011/LPC2211 - SSVR Guest Configuration and Credential Disclosure |
| CVE-2026-88268 | GV GV-LPCLPC2011/2211 GeoVision Inc. | 6.5 | Sep 10 | GV-LPC2011/LPC2211 - SSVR Fragment-Reassembly Stack Overflow Denial of Service |
| CVE-2026-88770 | RH Red Hat Build of Keycloak Red Hat | 6.5 | Sep 10 | Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts |
| CVE-2026-88763 | SI Service Interconnect 2 for RHEL 8 Red Hat | 5.9 | Sep 10 | Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service |
| CVE-2026-82582 | SH SHIRASAGI SHIRASAGI Project | 4.3 | Sep 10 | An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared… |
| CVE-2026-81635 | SH SHIRASAGI SHIRASAGI Project | 5.4 | Sep 10 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the… |
| CVE-2026-0304 | CX Cortex XDR Broker VM Palo Alto Networks | 4.8 | Sep 10 | Cortex XDR Broker VM: Privilege Escalation Vulnerability |
| CVE-2026-19840 | NO Notiqoo | 6.5 | Sep 10 | Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions |
| CVE-2026-0305 | PA Prisma Access Agent Palo Alto Networks | 4.3 | Sep 10 | Prisma Access Agent: Information Disclosure Vulnerability on Linux |
| CVE-2026-0306 | PA Prisma Access Agent Palo Alto Networks | 5.8 | Sep 10 | Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows |
| CVE-2026-0307 | GA GlobalProtect App Palo Alto Networks | 5.9 | Sep 10 | GlobalProtect App: Local Privilege Escalation Vulnerabilities |
| CVE-2026-0309 | PA PAN-OS Palo Alto Networks | 4.0 | Sep 10 | PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration |
| CVE-2026-85645 | FM Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 10web | 6.1 | Sep 10 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting |
| CVE-2026-57822 | AA Apache ActiveMQ Artemis Apache Software Foundation | 6.5 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service |
| CVE-2026-75880 | AA Apache ActiveMQ Artemis Apache Software Foundation | 6.5 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service |
| CVE-2026-4657 | EG Easy Google Fonts sunny_johal | 6.4 | Sep 10 | Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field |
| CVE-2026-15820 | BF Builderall for WordPress builderall | 6.4 | Sep 10 | Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting |
| CVE-2026-18594 | AC Advanced Contact form 7 DB vsourz1td | 4.3 | Sep 10 | Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id' |
| CVE-2026-18386 | WB WP BackItUp Community Edition cssimmon | 4.9 | Sep 10 | WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter |
| CVE-2026-15823 | BF Builderall for WordPress builderall | 4.3 | Sep 10 | Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter |
| CVE-2026-15796 | BF Builderall for WordPress builderall | 6.4 | Sep 10 | Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting |
| CVE-2026-87870 | NF Ninja Forms - Scheduled Exports Saturday Drive | 6.4 | Sep 10 | Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters |
| CVE-2026-84063 | BU BurgerEditor D-ZERO CO.,LTD. | 6.5 | Sep 10 | BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type |
| CVE-2026-84062 | BU BurgerEditor D-ZERO CO.,LTD. | 4.3 | Sep 10 | BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key |
| CVE-2026-52097 | Product not mapped yet | 6.8 | Sep 10 | An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex… |
| CVE-2026-79590 | Product not mapped yet | 6.5 | Sep 10 | A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0 |
| CVE-2026-36392 | Product not mapped yet | 5.4 | Sep 10 | FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2022-26962 | Product not mapped yet | 5.4 | Sep 10 | Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or… |
| CVE-2026-71642 | Product not mapped yet | 4.0 | Sep 10 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the… |
| CVE-2026-87926 | IN inventory-management-system Rizwan17 | 4.3 | Sep 9 | Rizwan17 inventory-management-system Login Page index.php cross site scripting |
| CVE-2026-87924 | IN inventory-management-system Rizwan17 | 6.5 | Sep 9 | Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication |
| CVE-2026-15460 | ZE zephyr zephyrproject | 5.4 | Sep 9 | Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path |
| CVE-2026-87923 | IN inventory-management-system Rizwan17 | 4.3 | Sep 9 | Rizwan17 inventory-management-system List DBOperation.php cross site scripting |
| CVE-2026-88002 | OP open-webui open-webui | 6.5 | Sep 9 | Open WebUI: Any authenticated user can hang the server via a cyclic chat message history |