CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 08:35 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116372 New | MI misp-guard MISP | 7.7 | Oct 26 | MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules |
| CVE-2026-70388 New | SO SOEM RT-Labs AB | 8.3 | Oct 26 | Memory Corruption via Integer Underflow in Message Length Validation |
| CVE-2026-116234 New | PX Pugongying X5 Pro Oray | 9.1 | Oct 26 | Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection |
| CVE-2026-116233 New | PX Pugongying X5 Pro Oray | 9.1 | Oct 26 | Oray Pugongying X5 Pro Dnsmasq crlf injection |
| CVE-2026-115425 New | OF OPNsense firewall OPNsense | 5.6 | Oct 26 | Multiple cross-site scripting (XSS) in OPNsense |
| CVE-2026-116232 New | PX Pugongying X5 Pro Oray | 9.9 | Oct 26 | Oray Pugongying X5 Pro SNMP snmp_set crlf injection |
| CVE-2026-116231 New | PX Pugongying X5 Pro Oray | 9.9 | Oct 26 | Oray Pugongying X5 Pro Ser2net crlf injection |
| CVE-2026-116230 New | PI Plague Inc Evolved Ndemic Creations | 7.8 | Oct 26 | Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization |
| CVE-2026-96581 New | AS ash ash-project | 7.6 | Oct 26 | An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records |
| CVE-2026-116229 New | FT FFXIV Teamcraft ffxiv-teamcraft | 3.5 | Oct 26 | ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting |
| CVE-2026-103300 New | EW Eurobank WooCommerce Payment Gateway | 5.3 | Oct 26 | Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback |
| CVE-2026-111974 New | GI GiveWP | 5.3 | Oct 26 | GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency |
| CVE-2026-116228 New | AG agent-teams-ai 777genius | 3.3 | Oct 26 | 777genius agent-teams-ai Local HTTP Service HttpServer.ts doStart missing authentication |
| CVE-2026-116227 New | BR BR-6208AC Edimax | 2.4 | Oct 26 | Edimax BR-6208AC Virtual Server cross site scripting |
| CVE-2026-116224 New | BE benotes fr0tt | 4.3 | Oct 26 | fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery |
| CVE-2026-107900 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107899 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107898 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107897 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107896 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107895 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107894 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-116223 New | EA EasyImage icret | 6.5 | Oct 26 | icret EasyImage del.php privileges management |
| CVE-2026-103299 New | PG Payment Gateway | – | Oct 26 | nexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared Secret |
| CVE-2026-103319 New | OP OPay Payment Gateway for WooCommerce | 5.3 | Oct 26 | OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key |
| CVE-2026-103381 New | MF Mintpay for WooCommerce | 6.5 | Oct 26 | Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery |
| CVE-2026-103306 New | OP Online Payments with iK Pay Gateway | 5.3 | Oct 26 | iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback |
| CVE-2026-103298 New | CP CCAvenue Payment Gateway for WooCommerce | 5.3 | Oct 26 | CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery |
| CVE-2026-116124 New | LI libgsf GNOME | 6.3 | Oct 26 | GNOME libgsf OLE2 gsf-infile-msole.c ole_info_read_metabat heap-based overflow |
| CVE-2026-116123 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB signup validatePassword excessive authentication |
| CVE-2026-116122 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB Sign-in Endpoint AuthService.validateUser information disclosure |
| CVE-2026-116121 New | NO NocoDB Nocodb | 3.7 | Oct 26 | NocoDB Registration users.service.ts race condition |
| CVE-2026-116120 New | NO NocoDB Nocodb | 5.6 | Oct 26 | NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources |
| CVE-2026-116119 New | NO NocoDB Nocodb | 5.5 | Oct 26 | NocoDB Password-Reset Flow users.service.ts race condition |
| CVE-2026-113345 New | ED Electronic delivery item Inspection Support System Ministry of Land, Infrastructure, Transport and Tourism, Japan | 7.8 | Oct 26 | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission… |
| CVE-2026-116118 New | ZC Zcode Z.ai | 6.3 | Oct 26 | Z.ai Zcode Sed Command Filter os command injection |
| CVE-2026-116117 New | HA halo halo-dev | 7.3 | Oct 26 | halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal |
| CVE-2026-116116 New | GC GM8135S Camera Yoosee | 8.2 | Oct 26 | Yoosee GM8135S Camera Secure Boot signature verification |
| CVE-2026-116115 New | GC GM8135S Camera Yoosee | 3.1 | Oct 26 | Yoosee GM8135S Camera WiFi Configuration wpa_supplicantX.conf initialization |
| CVE-2026-116114 New | GC GM8135S Camera Yoosee | 3.7 | Oct 26 | Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission |
| CVE-2026-116113 New | GO GouGuOA Gouguoa | 6.3 | Oct 26 | GouGuOA Api.php chunkUpload unrestricted upload |
| CVE-2026-116112 New | ED edoc-doctor-appointment-system HashenUdara | 7.3 | Oct 26 | HashenUdara edoc-doctor-appointment-system add-new.php sql injection |
| CVE-2026-116111 New | CV Civilization V 2K Games | 9.6 | Oct 26 | 2K Games Civilization V Lua Sandbox loadstring type confusion |
| CVE-2026-116110 New | LI LiveWallPaper GiantappMan | 7.3 | Oct 26 | GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication |
| CVE-2026-116109 New | CO Continue continuedev | 6.3 | Oct 26 | continuedev Continue MCP Server Transport ConfigHandler.ts MCPManagerSingleton.setConnections os command injection |
| CVE-2026-116108 New | OP OpenBB openbq-org | 4.3 | Oct 26 | openbq-org OpenBB Local API Server api_settings.py access control |
| CVE-2026-116107 New | PS Product Sets Plugin Datafeedr | 5.4 | Oct 26 | Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization |
| CVE-2026-116106 New | HA HeyCyan App Heycyan App | 7.3 | Oct 26 | HeyCyan App FileProvider access control |
| CVE-2026-116105 New | HA HeyCyan App Heycyan App | 3.7 | Oct 26 | HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission |
| CVE-2026-116104 New | NN Neural Network Libraries Sony | 6.3 | Oct 26 | Sony Neural Network Libraries NNP Converter utils.py func_set_nnabla_version_decorate code injection |