CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 23:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115479 New | BA basercms baserproject | 5.3 | Oct 23 | baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients |
| CVE-2026-114355 New | CZ CrystalSky ZS600C DJI | 8.6 | Oct 23 | DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root |
| CVE-2026-93640 New | CO Collaboration Zimbra | 7.8 | Oct 23 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration |
| CVE-2026-115481 New | BA basercms baserproject | 8.5 | Oct 23 | baserCMS: BcCustomContent file fields can be configured to allow executable file extensions such as php, leading to arbitrary PHP file upload |
| CVE-2026-114354 New | CZ CrystalSky ZS600C DJI | 8.6 | Oct 23 | DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root |
| CVE-2026-50057 New | CO Collaboration Zimbra | 7.8 | Oct 23 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions |
| CVE-2026-114353 New | CZ CrystalSky ZS600C DJI | 7.0 | Oct 23 | DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution |
| CVE-2026-50056 New | CO Collaboration Zimbra | 7.8 | Oct 23 | Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection |
| CVE-2026-93639 New | CO Collaboration Zimbra | 8.7 | Oct 23 | Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation |
| CVE-2026-93638 New | CO Collaboration Zimbra | 6.1 | Oct 23 | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter |
| CVE-2026-55826 New | GT gtm-server-side-wordpress-plugin stape-io | 8.7 | Oct 23 | Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin |
| CVE-2026-93636 New | CO Collaboration Zimbra | 4.3 | Oct 23 | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name |
| CVE-2026-93634 New | CO Collaboration Zimbra | 4.3 | Oct 23 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records |
| CVE-2026-93633 New | CO Collaboration Zimbra | 5.4 | Oct 23 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters |
| CVE-2026-93631 New | CO Collaboration Zimbra | 7.1 | Oct 23 | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking |
| CVE-2026-93630 New | CO Collaboration Zimbra | 4.3 | Oct 23 | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization |
| CVE-2026-55606 New | OD odhcpd openwrt | 6.5 | Oct 23 | odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() |
| CVE-2026-53918 New | OD odhcpd openwrt | 8.8 | Oct 23 | odhcpd DHCPv6 IA dangling first pointer use-after-free |
| CVE-2026-53920 New | OD odhcpd openwrt | 8.7 | Oct 23 | odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure |
| CVE-2026-115754 New | SE serialize-javascript yahoo | 4.7 | Oct 23 | serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body |
| CVE-2026-53921 New | OD odhcpd openwrt | 9.8 | Oct 23 | odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) |
| CVE-2026-93629 New | CO Collaboration Zimbra | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity |
| CVE-2026-93628 New | CO Collaboration Zimbra | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response |
| CVE-2026-93627 New | CO Collaboration Zimbra | 5.3 | Oct 23 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST Organizer |
| CVE-2026-50053 New | CO Collaboration Zimbra | 8.7 | Oct 23 | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters |
| CVE-2026-10632 New | CO Collaboration Zimbra | 8.7 | Oct 23 | Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter |
| CVE-2026-115752 New | SI signalk-server SignalK | 4.2 | Oct 23 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon |
| CVE-2026-115751 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname |
| CVE-2026-115750 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects |
| CVE-2026-115749 New | HY hydra-ray-launcher hydra-ecosystem | 3.3 | Oct 23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import |
| CVE-2026-112848 New | HV Hostme v2 AivahThemes | 9.8 | Oct 23 | WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability |
| CVE-2026-112849 New | HV Hostme v2 AivahThemes | 7.1 | Oct 23 | WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112850 New | YD Your Dress AncoraThemes | 8.1 | Oct 23 | WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability |
| CVE-2026-112854 New | HC Holistic Center axiomthemes | 9.8 | Oct 23 | WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability |
| CVE-2026-112847 New | ZE ZenSoul ThemeREX | 9.8 | Oct 23 | WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability |
| CVE-2026-112846 New | SL Save Life ThemeREX Group | 9.8 | Oct 23 | WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability |
| CVE-2026-112851 New | HO HotLock ThemeREX Group | 9.8 | Oct 23 | WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability |
| CVE-2026-112852 New | HE Helion ThemeREX Group | 8.1 | Oct 23 | WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability |
| CVE-2026-112853 New | HA Hallelujah axiomthemes | 9.8 | Oct 23 | WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability |
| CVE-2026-112856 New | VA Vagabonds ThemeREX Group | 9.8 | Oct 23 | WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability |
| CVE-2026-112857 New | RE Reprizo axiomthemes | 9.8 | Oct 23 | WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability |
| CVE-2026-112858 New | RH Rhodos axiomthemes | 9.8 | Oct 23 | WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability |
| CVE-2026-112859 New | LB Little Birdies ThemeREX Group | 9.8 | Oct 23 | WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability |
| CVE-2026-112855 New | RE Redy axiomthemes | 9.8 | Oct 23 | WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability |
| CVE-2026-112863 New | KA KALLYAS Hogash | 7.1 | Oct 23 | WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115730 New | I1 i18next-http-backend i18next | 3.1 | Oct 23 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl |
| CVE-2026-115729 New | CO common pdfme | 6.8 | Oct 23 | @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass |
| CVE-2026-115728 New | HA @hapi/content hapijs | 7.5 | Oct 23 | @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing |
| CVE-2026-99087 New | LI Linux Linux | – | Oct 23 | dm-integrity: fix NULL pointer dereference when the 'R' flag is used |
| CVE-2026-99086 New | LI Linux Linux | – | Oct 23 | dm-integrity: validate the superblock on resume |