CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 02:22 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-51922 | Product not mapped yet | 9.8 | Oct 2 | agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py) |
| CVE-2026-51898 | Product not mapped yet | 9.8 | Oct 2 | sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute |
| CVE-2026-51918 | Product not mapped yet | 9.8 | Oct 2 | FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code () |
| CVE-2026-51915 | Product not mapped yet | 9.8 | Oct 2 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller |
| CVE-2026-51911 | Product not mapped yet | 9.8 | Oct 2 | vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py) |
| CVE-2026-51906 | Product not mapped yet | 9.1 | Oct 2 | In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary… |
| CVE-2026-86345 | RH Red Hat Directory Server 11 Red Hat | 9.0 | Oct 1 | 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result |
| CVE-2026-103765 | MO Mooncake kvcache-ai | 9.4 | Oct 1 | Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server |
| CVE-2026-103764 | MO Mooncake kvcache-ai | 9.8 | Oct 1 | Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport |
| CVE-2026-18397 | SC SConnect Thales | 9.4 | Oct 1 | SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability |
| CVE-2026-71449 | EF EasyIO FS32 Johnson Controls | 9.3 | Oct 1 | : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data |
| CVE-2026-55395 | AW Aware2 Teledyne FLIR | 9.4 | Oct 1 | Hardcoded Passwords in Teledyne FLIR Robots running Aware2 |
| CVE-2026-55393 | AW Aware2 Teledyne FLIR | 10.0 | Oct 1 | Local File Inclusion in Teledyne FLIR Robots running Aware2 |
| CVE-2026-14984 | AW Aware2 Teledyne FLIR | 9.4 | Oct 1 | Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2 |
| CVE-2026-102628 | CL Cadmos LTI Eummena | 9.3 | Oct 1 | Cadmos LTI exposure of sensitive information via debug mode |
| CVE-2026-56662 | GE GetSimpleCMS-CE GetSimpleCMS-CE | 9.6 | Oct 1 | GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request |
| CVE-2026-56660 | GE GetSimpleCMS-CE GetSimpleCMS-CE | 9.1 | Oct 1 | GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction |
| CVE-2026-53953 | GE GetSimpleCMS-CE GetSimpleCMS-CE | 9.1 | Oct 1 | GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover |
| CVE-2026-104286 In wildKEV | FO FortiMail Fortinet | 9.8 | Oct 1 | Fortinet FortiMail Path Traversal Vulnerability |
| CVE-2026-104056 | AU Authlib Authlib | 9.8 | Oct 1 | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding |
| CVE-2026-55083 | DH dhis2-core dhis2 | 9.1 | Oct 1 | DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) |
| CVE-2026-103922 | AN android @capacitor | 9.3 | Oct 1 | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path |
| CVE-2026-96659 | RH Red Hat Satellite 6.16 for RHEL 8 Red Hat | 9.1 | Oct 1 | Foreman: excessive permissions for viewer role on preview |
| CVE-2026-59797 | HS HTTP Server Apache | 9.8 | Oct 1 | Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function |
| CVE-2026-57941 | HS HTTP Server Apache | 9.8 | Oct 1 | Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy |
| CVE-2026-56154 | HS HTTP Server Apache | 9.8 | Oct 1 | Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} |
| CVE-2026-94620 | CL classroom50 foundation50 | 9.4 | Oct 1 | Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download) |
| CVE-2026-12627 | FC Fortra's Core Privileged Access Manager (BoKS) Fortra | 9.8 | Oct 1 | Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability |
| CVE-2026-79898 | BM BoKS Manager Fortra | 9.1 | Oct 1 | Fortra BoKS Manager crlserver command injection vulnerability |
| CVE-2026-62071 | WF WordPress File Upload nickboss | 9.3 | Oct 1 | WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability |
| CVE-2026-103752 | AU Authorizer Paul Ryan | 9.8 | Oct 1 | WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability |
| CVE-2026-79901 | BM BoKS Manager boks-server Fortra | 9.9 | Oct 1 | Predictable Active Directory service-account passwords in BoKS Manager |
| CVE-2026-103264 | FL fleet fleetdm | 9.1 | Oct 1 | Fleet before 4.87.0 Authentication Bypass via Device Identifiers |
| CVE-2026-103255 | N8 n8n n8n-io | 9.0 | Oct 1 | n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase |
| CVE-2026-103248 | N8 n8n n8n-io | 9.0 | Oct 1 | n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase |
| CVE-2026-103244 | GR ground-station sgoudelis | 9.8 | Oct 1 | ground-station before 0.8.0 Authentication Bypass via setup.restore |
| CVE-2026-103655 | MI MISP MISP | 9.3 | Oct 1 | MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period |
| CVE-2026-15989 | SF Super Forms – Drag & Drop Form Builder WebRehab | 9.8 | Oct 1 | Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter |
| CVE-2026-75957 | UM Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform superdav42 | 9.8 | Oct 1 | Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter |
| CVE-2025-41753 | 07 0750-811x-xxxx-xxxx WAGO | 9.8 | Oct 1 | Path traversal in dynamically created BACnet File Objects |
| CVE-2026-101148 | BW BackupSheep WordPress Backup Plugin | 10.0 | Oct 1 | BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key |
| CVE-2026-82824 | HC Hitachi Coding Software Suite Hitachi Industrial Equipment Systems | 9.8 | Oct 1 | Path traversal may allow arbitrary files to be viewed, created, modified, or deleted |
| CVE-2026-82825 | HC Hitachi Coding Software Suite Hitachi Industrial Equipment Systems | 9.8 | Oct 1 | Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed |
| CVE-2026-82827 | HC Hitachi Coding Software Suite Hitachi Industrial Equipment Systems | 9.8 | Oct 1 | A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens |
| CVE-2026-82829 | HC Hitachi Coding Software Suite Hitachi Industrial Equipment Systems | 9.8 | Oct 1 | Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process |
| CVE-2026-76142 | GN Genian NAC 5.0.75 LTS Release Genians, Inc | 9.3 | Oct 1 | Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface |
| CVE-2026-92966 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 9.1 | Oct 1 | Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field |
| CVE-2026-14157 | RO Router ASUS | 9.4 | Oct 1 | Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the… |
| CVE-2026-51897 | Product not mapped yet | 9.8 | Oct 1 | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app) |
| CVE-2026-51880 | Product not mapped yet | 9.8 | Oct 1 | deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute |