CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 09:07 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90559 | SN snappy-java xerial | 7.5 | Sep 12 | snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress |
| CVE-2026-90556 | FR freeciv freeciv | 7.8 | Sep 12 | Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load |
| CVE-2026-15451 | MC MemberPress Corporate Accounts MemberPress | 8.8 | Sep 12 | MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation |
| CVE-2026-90554 | VL vLLM vllm-project | 7.5 | Sep 12 | vLLM before 0.28.0 Denial of Service via audio extraction |
| CVE-2026-90553 | VL vLLM vllm-project | 7.8 | Sep 12 | vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor |
| CVE-2026-90537 | AV AVideo WWBN | 8.2 | Sep 12 | WWBN AVideo Scheduler sendEmail Missing Authorization via Token |
| CVE-2026-90535 | FL Flowise FlowiseAI | 7.5 | Sep 12 | Flowise before 3.1.4 Denial of Service via text-to-speech/abort |
| CVE-2026-78175 | TL Tutor LMS – eLearning and online course solution themeum | 8.8 | Sep 12 | Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution |
| CVE-2026-85200 | GM GEO my WP ninjew | 7.5 | Sep 12 | GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion |
| CVE-2026-16482 | RF rtMedia for WordPress, BuddyPress and bbPress rtcamp | 7.5 | Sep 12 | rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter |
| CVE-2026-87888 | YA YayPricing | 8.0 | Sep 12 | YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route |
| CVE-2026-87842 | ZO Zonify | 7.5 | Sep 12 | Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure |
| CVE-2026-87759 | AU Add User Autocomplete | 8.8 | Sep 12 | Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation |
| CVE-2026-84099 | WP wpstorecart | 8.1 | Sep 12 | IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php |
| CVE-2026-84047 | AC Album Cover Finder | 8.6 | Sep 12 | Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action |
| CVE-2026-81742 | BR BE REST Endpoints | 8.8 | Sep 12 | BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation |
| CVE-2026-81429 | EI Export & Import WPBakery Page Builder | 7.1 | Sep 12 | Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF |
| CVE-2026-81090 | GP Gpx2Graphics | 7.2 | Sep 12 | Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF |
| CVE-2026-80494 | YW Yogeta WP Cloud | 8.6 | Sep 12 | Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download |
| CVE-2026-80491 | SF SAMO Forms | 8.6 | Sep 12 | SAMO Forms <= 1.0.0 - Unauthenticated SQLi |
| CVE-2026-77752 | TL Temporary Login Without Password | 7.2 | Sep 12 | Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation |
| CVE-2026-77705 | BF Booking for Appointments and Events Calendar | 7.2 | Sep 12 | Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover |
| CVE-2026-89266 | ST stb_vorbis nothings | 8.2 | Sep 11 | stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands |
| CVE-2026-90456 | MA Malcolm CISA | 8.1 | Sep 11 | Use of default credentials in Malcolm |
| CVE-2026-90444 | MA Malcolm CISA | 8.8 | Sep 11 | OS Command Injection in Malcolm |
| CVE-2026-50013 | HO hoverfly SpectoLabs | 7.5 | Sep 11 | Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode |
| CVE-2026-49846 | LI libks signalwire | 7.5 | Sep 11 | libks has path traversal in kws HTTP parser via URI segment overflow |
| CVE-2026-90460 | KE Keystone OpenStack | 7.6 | Sep 11 | An issue was discovered in OpenStack Keystone before 29.0.3 |
| CVE-2026-54241 | LI libde265 strukturag | 7.4 | Sep 11 | libde265: SAO sequential filter heap buffer overflow via signed integer overflow |
| CVE-2026-54240 | LI libde265 strukturag | 7.4 | Sep 11 | libde265: Pixel accessor signed integer overflow causes heap OOB read/write |
| CVE-2026-44715 | OR org.openmrs.module:legacyui-api openmrs | 8.7 | Sep 11 | OpenMRS has Broken Access Control in HL7 Configuration |
| CVE-2026-54166 | SH shelf.nu Shelf-nu | 7.1 | Sep 11 | Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass |
| CVE-2026-54174 | AP apko chainguard-dev | 8.3 | Sep 11 | melange: Incomplete package integrity verification allows data section substitution |
| CVE-2026-47773 | AR ArduinoBLE arduino-libraries | 7.2 | Sep 11 | ArduinoBLE: Memory corruption via malformed ATT write request |
| CVE-2026-49464 | NL nl-portal-backend-libraries nl-portal | 8.1 | Sep 11 | NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak |
| CVE-2026-81907 | CC Concrete CMS Concrete CMS | 7.1 | Sep 11 | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records |
| CVE-2026-89771 | LI Linux Linux | 7.8 | Sep 11 | ring-buffer: Fix subbuf resize race with ring buffer readers |
| CVE-2026-89769 | LI Linux Linux | 7.4 | Sep 11 | clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path |
| CVE-2026-89767 | LI Linux Linux | 7.8 | Sep 11 | ovl: fix double end_creating() on the casefold-mismatch path |
| CVE-2026-89764 | LI Linux Linux | 7.8 | Sep 11 | rust: devres: fix race between concurrent revokers |
| CVE-2026-89763 | LI Linux Linux | 7.8 | Sep 11 | KEYS: trusted: Fix TPM teardown ordering |
| CVE-2026-89762 | LI Linux Linux | 7.8 | Sep 11 | apparmor: fix cred UAF caused by begin_current_label_crit_section() |
| CVE-2026-89761 | LI Linux Linux | 7.8 | Sep 11 | apparmor: fix out-of-bounds write when null terminating a label vec |
| CVE-2026-89760 | LI Linux Linux | 7.8 | Sep 11 | mm, swap: don't free a hibernation slot that is in the swap cache |
| CVE-2026-89758 | LI Linux Linux | 7.8 | Sep 11 | mm/mempolicy: skip non-present PMDs when queueing folios |
| CVE-2026-89755 | LI Linux Linux | 7.8 | Sep 11 | mm/migrate_device: clear stale mapping after freeing swapcache |
| CVE-2026-89754 | LI Linux Linux | 7.8 | Sep 11 | mm/pagewalk: fix stale walk->action escaping walk_pmd_range() |
| CVE-2026-89750 | LI Linux Linux | 7.8 | Sep 11 | tracing/user_events: Clear copied tracing state before fork duplication |
| CVE-2026-89748 | LI Linux Linux | 7.8 | Sep 11 | tracing: Fix retry exhaustion in simple ring buffer reader swap |
| CVE-2026-89747 | LI Linux Linux | 7.8 | Sep 11 | tracing: Fix use-after-free in trace_pipe read on sub-buffer order change |