CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 11:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-96741 New | DA DSGVO All in one for WP mlfactory | 7.2 | Oct 29 | DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption |
| CVE-2026-113387 New | OR ortto canva | 8.6 | Oct 29 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML |
| CVE-2026-66090 New | OP openEQUELLA Apereo Foundation | 7.1 | Oct 29 | XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read |
| CVE-2026-21157 New | BI Bixby Samsung Mobile | 8.3 | Oct 29 | Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity |
| CVE-2026-107037 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note… |
| CVE-2026-107026 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content |
| CVE-2026-107020 New | Product not mapped yet | 7.5 | Oct 29 | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL |
| CVE-2026-107047 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data |
| CVE-2026-107052 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via… |
| CVE-2026-107042 New | Product not mapped yet | 7.5 | Oct 29 | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via… |
| CVE-2026-85749 New | MA MailWatch mailwatch | 8.1 | Oct 28 | MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail |
| CVE-2026-61569 New | AV AVideo-Encoder WWBN | 7.5 | Oct 28 | AVideo-Encoder: pre-authentication streamer-login SQL injection |
| CVE-2026-54453 New | OP OpenCATS opencats | 7.2 | Oct 28 | OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional) |
| CVE-2026-61571 New | AV AVideo-Encoder WWBN | 7.3 | Oct 28 | AVideo-Encoder: missing authentication on control and status endpoints |
| CVE-2026-61572 New | AV AVideo-Encoder WWBN | 8.6 | Oct 28 | AVideo-Encoder: unauthenticated full-response server-side request forgery |
| CVE-2026-54455 New | OP OpenCATS opencats | 7.6 | Oct 28 | OpenCATS: Authenticated SQL injection in activity DataGrid date filters |
| CVE-2026-93851 New | MA Mattermost Mattermost | 8.0 | Oct 28 | Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post |
| CVE-2026-61546 New | AN anki-mcp-server-addon ankimcp | 8.8 | Oct 28 | AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools |
| CVE-2026-118804 New | BB Bricks Builder Bricks | 7.5 | Oct 28 | Bricks Broken Access Control via query_result Endpoint |
| CVE-2026-118803 New | BT Bricks Theme Bricks | 7.5 | Oct 28 | Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result |
| CVE-2026-118755 New | PE personal-management-system Volmarg | 7.2 | Oct 28 | Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path |
| CVE-2026-118753 New | FR FreeImage danoli3 | 7.8 | Oct 28 | FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing |
| CVE-2026-118752 New | FR FreeImage danoli3 | 7.8 | Oct 28 | FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder |
| CVE-2026-118694 New | PY python-markdown2 trentm | 7.5 | Oct 28 | python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations |
| CVE-2026-118692 New | CH cherrytree giuspen | 7.0 | Oct 28 | CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action |
| CVE-2026-118689 New | OV OvenMediaEngine OvenMediaLabs | 7.5 | Oct 28 | OvenMediaEngine through 0.21.0 OVT Relay DoS via Oversized payload_length |
| CVE-2026-118682 New | CL clashmi KaringX | 7.5 | Oct 28 | ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM |
| CVE-2026-118669 New | OA oauthlib oauthlib | 8.4 | Oct 28 | OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client |
| CVE-2026-118668 New | LA langgraph-api langchain-ai | 8.6 | Oct 28 | LangGraph JavaScript custom authentication may permit cross-user Store access |
| CVE-2026-118665 New | EX executor-legacy-ws @graphql-tools | 8.2 | Oct 28 | GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications |
| CVE-2026-118664 New | DE decode-uri-component SamVerschueren | 8.2 | Oct 28 | decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs |
| CVE-2026-118660 New | HA happy-dom capricorn86 | 8.6 | Oct 28 | Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML |
| CVE-2026-118659 New | HA happy-dom capricorn86 | 7.5 | Oct 28 | @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy |
| CVE-2026-76418 In wildKEVNew | CS Cisco Secure Firewall Adaptive Security Appliance (ASA) Software Cisco | 8.6 | Oct 28 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability |
| CVE-2026-13451 New | RH Red Hat OpenShift AI (RHOAI) Red Hat | 7.7 | Oct 28 | Kserve: kserve: server-side request forgery via malicious storageuri |
| CVE-2026-61542 New | GE Gearboy drhelius | 8.6 | Oct 28 | Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools |
| CVE-2026-118650 New | EC echo labstack | 7.5 | Oct 28 | Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path |
| CVE-2026-78674 New | BP Business Process Server WSO2 | 8.8 | Oct 28 | Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution |
| CVE-2026-6647 New | WC WSO2 Carbon OAuth WSO2 | 7.4 | Oct 28 | Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events |
| CVE-2025-14260 New | SS SAML2 SSO Authenticator UI Bundle WSO2 | 8.3 | Oct 28 | Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources |
| CVE-2026-109411 New | SA Samba Samba | 8.1 | Oct 28 | Samba: access control bypass via vfs_ceph_rgw case-insensitive open |
| CVE-2026-118262 New | EC echo labstack | 8.2 | Oct 28 | Echo: WebSocket proxy can retain connections and handlers after client disconnect |
| CVE-2026-118688 New | WA wasmtime bytecodealliance | 7.9 | Oct 28 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename |
| CVE-2026-118686 New | ES espocrm espocrm | 7.5 | Oct 28 | EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex |
| CVE-2026-118683 New | MO MONAI Project-MONAI | 8.8 | Oct 28 | MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf |
| CVE-2026-118679 New | N8 n8n n8n-io | 7.5 | Oct 28 | n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger |
| CVE-2026-118678 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction |
| CVE-2026-118676 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass |
| CVE-2026-118675 New | N8 n8n n8n-io | 7.1 | Oct 28 | n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow |
| CVE-2026-118649 New | N8 n8n n8n-io | 8.3 | Oct 28 | n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables |