CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 31, 01:09 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119553 New | MO moodle Moodle Project | 6.5 | Oct 30 | Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal |
| CVE-2026-119552 New | UP uptime-kuma louislam | 4.8 | Oct 30 | Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler |
| CVE-2026-119551 New | JE jellyfin jellyfin | 6.5 | Oct 30 | Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions |
| CVE-2026-119547 New | FO forgejo forgejo | 4.3 | Oct 30 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id} |
| CVE-2026-119546 New | FO forgejo forgejo | 5.5 | Oct 30 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo |
| CVE-2026-119545 New | FO forgejo forgejo | 5.3 | Oct 30 | Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery |
| CVE-2026-119429 New | PH phpMyAdmin phpMyAdmin | 4.3 | Oct 30 | phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set |
| CVE-2026-119427 New | PH phpMyAdmin phpMyAdmin | 4.2 | Oct 30 | phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting |
| CVE-2026-119425 New | CO core opnsense | 5.4 | Oct 30 | OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP |
| CVE-2026-119424 New | CO core opnsense | 6.8 | Oct 30 | OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity |
| CVE-2026-119423 New | CO core opnsense | 5.3 | Oct 30 | OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username |
| CVE-2026-119422 New | HY hyperswitch juspay | 5.9 | Oct 30 | Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector |
| CVE-2026-119421 New | HY hyperswitch juspay | 5.9 | Oct 30 | Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation |
| CVE-2026-119416 New | CA cakephp cakephp | 4.8 | Oct 30 | CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching |
| CVE-2026-119414 New | SE server bitwarden | 4.3 | Oct 30 | Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create |
| CVE-2026-119378 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite() |
| CVE-2026-119376 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain |
| CVE-2026-119375 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch |
| CVE-2026-119372 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet() |
| CVE-2026-119371 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander() |
| CVE-2026-119364 New | PR ProFTPD ProFTPD Project | 5.3 | Oct 30 | ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass |
| CVE-2026-119147 New | PR ProFTPD ProFTPD Project | 4.3 | Oct 30 | ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass |
| CVE-2026-119146 New | PR ProFTPD ProFTPD Project | 5.6 | Oct 30 | ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap |
| CVE-2026-22114 New | DU Delta UFC500 Delta Electronics | 5.3 | Oct 30 | Missing brute-force protection for web interface |
| CVE-2026-97209 New | EL elixir elixir-lang | 5.4 | Oct 30 | Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build |
| CVE-2026-115274 New | EL elixir elixir-lang | 6.9 | Oct 30 | Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir |
| CVE-2026-109821 New | EL elixir elixir-lang | 6.3 | Oct 30 | Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
| CVE-2026-59388 New | CC CAPI (Cloud Foundry Controller) Cloud Foundry Foundation | 6.5 | Oct 30 | Cloud Controller exposes secrets in audit log |
| CVE-2026-59386 New | CF cf-deployment Cloud Foundry | 6.5 | Oct 30 | Credential exposure to space supporter |
| CVE-2026-59396 New | CF cf-deployment Cloud Foundry | 4.9 | Oct 30 | DoS Vulnerability in UAA Related to JWKS URI Handling |
| CVE-2026-115455 New | RH Red Hat Enterprise Linux 10 Red Hat | 6.5 | Oct 30 | Gcc: stack overflow in std::bitset on libstdc++ |
| CVE-2026-114691 New | RH Red Hat Enterprise Linux 10 Red Hat | 5.9 | Oct 30 | Gcc: integer wrap in `std |
| CVE-2026-114690 New | RH Red Hat Enterprise Linux 10 Red Hat | 6.2 | Oct 30 | Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std |
| CVE-2026-118593 New | RH Red Hat Enterprise Linux 9 Red Hat | 5.9 | Oct 30 | Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099) |
| CVE-2026-118952 New | SF streams for Apache Kafka 3 Red Hat | 6.5 | Oct 30 | Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules |
| CVE-2026-118165 New | FL Firelight Lightbox | 6.8 | Oct 30 | Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute |
| CVE-2026-118101 New | BU BuddyForms | 5.3 | Oct 30 | BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification |
| CVE-2026-118100 New | BU BuddyForms | 5.3 | Oct 30 | BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure |
| CVE-2026-118072 New | FP Fraud Prevention For WooCommerce and EDD | 5.4 | Oct 30 | Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting |
| CVE-2026-118071 New | JO Joinchat | 6.8 | Oct 30 | Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute |
| CVE-2026-117572 New | WV WP Visitor Statistics (Real Time Traffic) | 4.1 | Oct 30 | WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter |
| CVE-2026-115277 New | UF User Frontend | 4.7 | Oct 30 | WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter |
| CVE-2026-114444 New | SP Security Plugin, Firewall & Malware Scanner with Auto Removal | 4.4 | Oct 30 | Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer |
| CVE-2026-119087 New | CE Content Egg – Affiliate Product Importer & Price Comparison keywordrush | 4.3 | Oct 30 | Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter |
| CVE-2026-119059 New | CE Content Egg – Affiliate Product Importer & Price Comparison keywordrush | 4.3 | Oct 30 | Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action |
| CVE-2026-118634 New | EM Events Made Easy liedekef | 6.4 | Oct 30 | Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute |
| CVE-2026-118500 New | CF Cool FormKit Lite – Advanced Form Builder for Elementor coolplugins | 6.4 | Oct 30 | Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter |
| CVE-2026-118698 New | JF JoomSport – for Sports: Team & League, Football, Hockey & more beardev | 6.5 | Oct 30 | JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute |
| CVE-2026-118194 New | PA Page and Post Restriction cyberlord92 | 6.5 | Oct 30 | Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication |
| CVE-2026-5461 New | FF Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev | 6.5 | Oct 30 | Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata |