CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 02:47 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-93847 New | MA Mattermost Mattermost | 3.5 | Oct 26 | Improper post type validation on scheduled post endpoints |
| CVE-2026-112880 New | HA hackney benoitc | 2.1 | Oct 26 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney |
| CVE-2026-116215 New | MA maccms10 maccmspro | 3.1 | Oct 26 | MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption |
| CVE-2026-116281 New | KA Kameleo Kameleo | 3.3 | Oct 26 | Kameleo Profile Controller t.cs ListProfiles information disclosure |
| CVE-2026-107157 New | QT Qt qt | 2.0 | Oct 26 | Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework |
| CVE-2026-96432 New | QT qt qt | 2.1 | Oct 26 | Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt |
| CVE-2026-116261 New | LI libimobiledevice Libimobiledevice | 3.5 | Oct 26 | libimobiledevice AFC File afc.c afc_file_open out-of-bounds |
| CVE-2026-116229 New | FT FFXIV Teamcraft ffxiv-teamcraft | 3.5 | Oct 26 | ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting |
| CVE-2026-116228 New | AG agent-teams-ai 777genius | 3.3 | Oct 26 | 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication |
| CVE-2026-116227 New | BR BR-6208AC Edimax | 2.4 | Oct 26 | Edimax BR-6208AC Virtual Server cross site scripting |
| CVE-2026-116123 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB signup validatePassword excessive authentication |
| CVE-2026-116122 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB Sign-in Endpoint AuthService.validateUser information disclosure |
| CVE-2026-116121 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB Registration users.service.ts race condition |
| CVE-2026-116115 New | GC GM8135S Camera Yoosee | 3.1 | Oct 26 | Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization |
| CVE-2026-116114 New | GC GM8135S Camera Yoosee | 3.7 | Oct 26 | Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission |
| CVE-2026-116105 New | HA HeyCyan App Heycyan App | 3.7 | Oct 26 | HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission |
| CVE-2026-116100 New | GO gougucms Gougucms | 2.4 | Oct 26 | gougucms User Level Level.php add cross site scripting |
| CVE-2026-116054 New | SH SH3 Sh3 | 2.2 | Oct 25 | SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash |
| CVE-2026-116186 New | CO core openremote | 2.3 | Oct 25 | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId |
| CVE-2026-116184 New | CO core openremote | 2.1 | Oct 25 | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket |
| CVE-2026-116197 New | CO contrast edgelesssys | 2.6 | Oct 25 | Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection |
| CVE-2026-116190 New | RC rclone rclone | 3.7 | Oct 25 | rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect |
| CVE-2026-116162 New | PA parse-server parse-community | 2.1 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login |
| CVE-2026-116160 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate |
| CVE-2026-116159 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option |
| CVE-2026-116158 New | IM ImageMagick ImageMagick | 2.5 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in magick compare |
| CVE-2026-116157 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading |
| CVE-2026-116156 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option |
| CVE-2026-116153 New | IM ImageMagick ImageMagick | 2.5 | Oct 25 | ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit |
| CVE-2026-116151 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder |
| CVE-2026-116150 New | IM ImageMagick ImageMagick | 3.1 | Oct 25 | ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder |
| CVE-2026-116148 New | IM ImageMagick ImageMagick | 3.6 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options |
| CVE-2026-116147 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder |
| CVE-2026-116146 New | IM ImageMagick ImageMagick | 3.7 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder |
| CVE-2026-116145 New | IM ImageMagick ImageMagick | 3.9 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix |
| CVE-2026-116144 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder |
| CVE-2026-116143 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders |
| CVE-2026-116142 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box |
| CVE-2026-116140 New | IM ImageMagick ImageMagick | 3.3 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing |
| CVE-2026-116137 New | AD adm-zip cthackers | 3.7 | Oct 25 | adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names |
| CVE-2026-115183 New | QA Qi Addons For Elementor | 2.4 | Oct 25 | Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget |
| CVE-2026-114743 New | IC InstaWP Connect | 3.1 | Oct 25 | InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings |
| CVE-2026-114742 New | WP WPVR | 2.7 | Oct 25 | WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR |
| CVE-2026-114741 New | WP WPVR | 3.8 | Oct 25 | WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR |
| CVE-2026-111981 New | GI GiveWP | 2.7 | Oct 25 | GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses |
| CVE-2025-15705 New | CF Contact Form by Supsystic | 3.5 | Oct 25 | Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS |
| CVE-2026-116007 New | RU ruoyi-vue-pro YunaiV | 3.7 | Oct 25 | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication |
| CVE-2026-116004 New | ON Onyx onyx-dot-app | 3.5 | Oct 25 | onyx-dot-app Onyx PreviewTab.tsx cross site scripting |
| CVE-2026-115996 New | UG Unitree Go2 Unitree Robotics | 3.7 | Oct 24 | Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation |
| CVE-2026-115981 New | PH phpIPAM Phpipam | 2.4 | Oct 24 | phpIPAM index.php cross site scripting |