CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 08:59 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-100103 | PH P4 (Helix Core) Perfoce | 10.0 | Oct 5 | Authentication bypass via default auth token in P4Search |
| CVE-2017-20285 | Product not mapped yet | 9.1 | Oct 5 | YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes |
| CVE-2026-37719 | Product not mapped yet | 9.8 | Oct 5 | An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component |
| CVE-2026-88424 | Product not mapped yet | 9.8 | Oct 5 | FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter() |
| CVE-2026-88391 | Product not mapped yet | 9.8 | Oct 5 | Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no… |
| CVE-2026-88393 | Product not mapped yet | 9.8 | Oct 5 | WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export |
| CVE-2026-88395 | Product not mapped yet | 9.8 | Oct 5 | GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter |
| CVE-2026-105215 | ZI zitadel zitadel | 9.1 | Oct 4 | ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback |
| CVE-2026-105209 | ZI zitadel zitadel | 9.6 | Oct 4 | ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment |
| CVE-2026-105207 | ZI zitadel zitadel | 9.8 | Oct 4 | ZITADEL before 4.17.3 Account Takeover via External IdP Linking |
| CVE-2026-103355 | UE Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Unlimited Elements | 9.3 | Oct 4 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability |
| CVE-2026-105135 | MI MindSearch InternLM | 10.0 | Oct 4 | InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection |
| CVE-2026-105134 In wildKEV | AH AhsayCBS Ahsay | 10.0 | Oct 4 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection |
| CVE-2026-105105 | AI AIT-Core NASA-AMMOS | 9.8 | Oct 3 | Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration |
| CVE-2026-71885 | BC BC-JAVA Legion of the Bouncy Castle Inc. | 9.2 | Oct 3 | MLS X.509 credential not bound to the LeafNode signature key |
| CVE-2026-92084 | BB Beaver Builder Page Builder – Drag and Drop Website Builder beaverbuilder | 9.1 | Oct 3 | Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output |
| CVE-2026-87115 | VS VikAppointments Services Booking Calendar e4jvikwp | 9.1 | Oct 3 | VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter |
| CVE-2026-105080 | CO ConvertX C4illin | 9.9 | Oct 3 | In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre |
| CVE-2026-84411 | RO RouterOS MikroTik | 9.8 | Oct 2 | MikroTik RouterOS Integer Underflow |
| CVE-2026-95102 | MO monta.app Monta | 9.4 | Oct 2 | Monta monta.app Missing Authentication for Critical Function |
| CVE-2026-75937 | AP AnywhereUSB Plus Family Digi International | 9.4 | Oct 2 | OS Command Injection in Digi Accelerated Linux (DAL OS) |
| CVE-2026-82042 | UT UTMStack UTMStack | 9.8 | Oct 2 | UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter |
| CVE-2026-82041 | UT UTMStack UTMStack | 9.9 | Oct 2 | UTMStack < 11.2.16 Missing Authorization via Command WebSocket |
| CVE-2026-104019 | SA sagemaker-distribution AWS | 9.0 | Oct 2 | OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio |
| CVE-2026-103956 | LO loom AWS | 10.0 | Oct 2 | Missing authentication for critical function in Loom for AWS |
| CVE-2023-54405 | CV CVM H3C | 9.8 | Oct 2 | H3C CVM Unauthenticated File Upload via fileUpload/upload Token |
| CVE-2026-102795 | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 2 | Apache Traffic Server: SNI to Host header matching policy is not properly enforced |
| CVE-2026-104849 | TI tinypool tinylibs | 9.5 | Oct 2 | Tinypool: Prototype Pollution Gadget to RCE in run() options |
| CVE-2026-104848 | TI tinypool tinylibs | 9.5 | Oct 2 | Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution |
| CVE-2026-103630 | CH Chrome Google | 9.6 | Oct 2 | Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-103626 | CH Chrome Google | 9.6 | Oct 2 | Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute… |
| CVE-2026-103628 | CH Chrome Google | 9.6 | Oct 2 | Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-103648 | IM image-downloader demsking | 9.1 | Oct 2 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader |
| CVE-2026-104846 | SE seroval lxsmnsyc | 9.8 | Oct 2 | Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) |
| CVE-2026-90970 | GA GitLab AI Gateway GitLab | 9.9 | Oct 2 | Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway |
| CVE-2026-19652 | DM Divi Membership DiviEngine | 9.8 | Oct 2 | Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter |
| CVE-2026-83632 | AT Apache Thrift Apache Software Foundation | 9.2 | Oct 2 | Apache Thrift: C++ THttpTransport grows its line buffer without bound |
| CVE-2026-104611 | AC AC9 Tenda | 9.1 | Oct 2 | Tenda AC9 POST Request fast_setting_internet_set stack-based overflow |
| CVE-2026-104610 | HG HG10 Tenda | 10.0 | Oct 2 | Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow |
| CVE-2026-91135 | AT Apache Thrift Apache Software Foundation | 9.2 | Oct 2 | Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction) |
| CVE-2026-86325 | MM MGate MB3170 Series Moxa | 9.4 | Oct 2 | A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface |
| CVE-2026-103877 | AD Apache Directory LDAP API Apache Software Foundation | 9.8 | Oct 2 | Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements |
| CVE-2026-94541 | WA WPMobile.App – Android and iOS App Builder amauric | 9.8 | Oct 2 | WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter |
| CVE-2026-97637 | JA JSON API Auth parorrey | 9.8 | Oct 2 | JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response |
| CVE-2026-93029 | CP cPanel Webpros | 9.0 | Oct 2 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface |
| CVE-2026-93697 | CP cPanel Webpros | 9.0 | Oct 2 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface |
| CVE-2026-93698 | CP cPanel Webpros | 9.9 | Oct 2 | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin |
| CVE-2026-15896 | SF Super Forms – Drag & Drop Form Builder WebRehab | 9.1 | Oct 2 | Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter |
| CVE-2026-19660 | DM Divi Membership DiviEngine | 9.8 | Oct 2 | Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter |
| CVE-2026-14378 | DP DevKit Pro dplugins | 9.8 | Oct 2 | DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow |