CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 16:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106073 New | NO node nodejs | 3.3 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks |
| CVE-2026-115751 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname |
| CVE-2026-115750 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects |
| CVE-2026-115749 New | HY hydra-ray-launcher hydra-ecosystem | 3.3 | Oct 23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import |
| CVE-2026-115730 New | I1 i18next-http-backend i18next | 3.1 | Oct 23 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl |
| CVE-2026-54711 New | PG pghoard Aiven-Open | 2.4 | Oct 23 | PGHoard: Password written to debug log |
| CVE-2026-115724 New | VF VLC for Android VideoLAN | 2.9 | Oct 23 | VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider |
| CVE-2026-95620 New | QT qt qt | 2.1 | Oct 23 | Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt |
| CVE-2026-113501 New | LC LiteSpeed Cache | 3.1 | Oct 23 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal |
| CVE-2026-112230 New | PB Popup Builder | 3.7 | Oct 23 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter |
| CVE-2026-111737 New | SO Speed Optimizer | 3.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists |
| CVE-2026-110537 New | EA Essential Addons for Elementor | 3.8 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action |
| CVE-2026-110510 New | EA Essential Addons for Elementor | 3.5 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag |
| CVE-2026-115535 New | HO HospitalManagement gedelumbung | 2.4 | Oct 23 | gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting |
| CVE-2026-115449 New | RH Red Hat Enterprise Linux 10 Red Hat | 3.5 | Oct 22 | Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest |
| CVE-2026-114614 New | AU authlib authlib | 3.5 | Oct 22 | Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts |
| CVE-2026-115507 New | VI vikunja go-vikunja | 3.5 | Oct 22 | Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header |
| CVE-2026-115393 New | WA wasmtime bytecodealliance | 3.8 | Oct 22 | Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion |
| CVE-2026-115389 New | WA wasmtime bytecodealliance | 2.3 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API |
| CVE-2026-115386 New | WA wasmtime bytecodealliance | 2.6 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir |
| CVE-2026-115369 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs |
| CVE-2026-115366 New | OP openbao openbao | 2.6 | Oct 22 | OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs |
| CVE-2026-115364 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints |
| CVE-2026-115363 New | OP openbao openbao | 3.3 | Oct 22 | OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration |
| CVE-2026-115362 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass |
| CVE-2026-115359 New | OP openbao openbao | 3.7 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing |
| CVE-2026-115358 New | OP openbao openbao | 2.0 | Oct 22 | OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters |
| CVE-2026-115357 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses |
| CVE-2026-95721 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 3.3 | Oct 22 | Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface |
| CVE-2026-115519 New | KB KNIME Business Hub KNIME | 2.1 | Oct 22 | Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub |
| CVE-2026-113875 New | HF HAPI FHIR SmileCDR | 3.1 | Oct 22 | SmileCDR HAPI FHIR unauthorized read via subscription |
| CVE-2026-54238 New | RE realtime supabase | 3.1 | Oct 22 | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization |
| CVE-2026-115246 | ON online-clinic-management-system subhajitkhan | 3.5 | Oct 22 | subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting |
| CVE-2026-115319 | FZ fzf junegunn | 2.5 | Oct 22 | fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents |
| CVE-2026-21812 | AI AppScan Integration with Azure Boards for ASoC & A360 HCL Software | 2.2 | Oct 22 | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) |
| CVE-2026-21811 | AI AppScan Integration with Azure Boards for ASoC & A360 HCL Software | 3.8 | Oct 22 | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) |
| CVE-2026-114459 | MO mod_qos pbuchbinder | 3.7 | Oct 22 | Mod_qos: out-of-bounds reads in response-body substring matching |
| CVE-2026-114457 | MO mod_qos pbuchbinder | 3.7 | Oct 22 | Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads |
| CVE-2026-88849 | ML MasterStudy LMS WordPress Plugin | 2.7 | Oct 22 | MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment |
| CVE-2026-110011 | MC MB Custom Post Types & Custom Taxonomies | 2.7 | Oct 22 | MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export |
| CVE-2026-109931 | IG Infility Global | 3.7 | Oct 22 | Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update |
| CVE-2026-114723 | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation |
| CVE-2026-114641 | TR traefik traefik | 3.7 | Oct 22 | Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper |
| CVE-2026-114721 | WE Webmail Roundcube | 3.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed |
| CVE-2026-114576 | RE RE6250 Linksys | 3.7 | Oct 22 | Linksys RE6250 Web Management strcmp random values |
| CVE-2026-114719 | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin |
| CVE-2026-84911 | DR Drupal Drupal | 3.1 | Oct 22 | AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 |
| CVE-2026-84916 | DR Drupal Drupal | 3.7 | Oct 22 | Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 |
| CVE-2026-16648 | DR Drupal Drupal | 3.8 | Oct 22 | Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 |
| CVE-2026-84918 | DR Drupal Drupal | 3.7 | Oct 22 | Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 |