CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 09:56 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115482 New | LS lsquic litespeedtech | 7.5 | Oct 22 | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK… |
| CVE-2026-114515 New | OC OCO-Server schorschii | 6.5 | Oct 22 | OCO-Server: Self-Service Portal uninstall-job authorization bypass |
| CVE-2026-61791 New | OC OCO-Server schorschii | 7.4 | Oct 22 | OCO-Server: Stored XSS through agent hostnames in command buttons |
| CVE-2026-16477 New | CX CleanShot X MTW | 8.4 | Oct 22 | Insecure Deserialization of .cleanshot Files in CleanShot X |
| CVE-2026-114510 New | FL flexible-graphrag stevereiner | 7.1 | Oct 22 | Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content |
| CVE-2026-111181 New | BO body-parser body-parser | 7.5 | Oct 22 | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body |
| CVE-2026-113872 New | MU multer multer | 7.5 | Oct 22 | multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown |
| CVE-2026-89410 New | ZS Z-Wave SDK Silicon Labs | 5.1 | Oct 22 | Out-of-bounds read in Z-Wave NCP SPI Handler |
| CVE-2026-89409 New | ZS Z-Wave SDK Silicon Labs | 5.3 | Oct 22 | Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes |
| CVE-2026-85079 New | EM EmberZNet Silicon Labs | 7.5 | Oct 22 | Out-of-bounds write in Zigbee Simple_Desc_req handling |
| CVE-2026-94502 New | EM EmberZNet Silicon Labs | 7.5 | Oct 22 | Out-of-bounds write in Zigbee Publish Price Matrix handling |
| CVE-2026-115249 New | ON online-clinic-management-system subhajitkhan | 4.6 | Oct 22 | subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation |
| CVE-2026-66282 New | EM EmberZNet Silicon Labs | 6.0 | Oct 22 | Authenticated Denial-of-Service in Zigbee Publish Billing Period |
| CVE-2026-66281 New | EM EmberZNet Silicon Labs | 6.0 | Oct 22 | Authenticated Denial-of-Service in Zigbee Discover Attributes Handling |
| CVE-2026-85080 New | EM EmberZNet Silicon Labs | 6.0 | Oct 22 | Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling |
| CVE-2026-66279 New | CS Connect SDK Silicon Labs | 7.2 | Oct 22 | Dis-connect vulnerability in Connect Stack |
| CVE-2026-111497 In wildKEVNew | BR Brotli Google | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-92709 New | RS rsyslog rsyslog | 8.1 | Oct 22 | Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE |
| CVE-2026-115248 New | ON online-clinic-management-system subhajitkhan | 5.4 | Oct 22 | subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow |
| CVE-2026-113582 New | AA Apache Abdera Apache Software Foundation | 7.5 | Oct 22 | Apache Abdera: XML external entity expansion in Atom document parsing |
| CVE-2026-115400 New | CR crawlseo crawlseo | 4.4 | Oct 22 | crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens |
| CVE-2026-115411 New | CR crawlseo crawlseo | 5.0 | Oct 22 | crawlseo before 0.2.4 Server-Side Request Forgery via Crawler |
| CVE-2026-115247 New | ON online-clinic-management-system subhajitkhan | 4.3 | Oct 22 | subhajitkhan online-clinic-management-system patientregistration.php missing encryption |
| CVE-2026-115246 New | ON online-clinic-management-system subhajitkhan | 3.5 | Oct 22 | subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting |
| CVE-2026-102785 New | YP YOOtheme Pro extension for Joomla yootheme.com | 10.0 | Oct 22 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 |
| CVE-2026-112832 New | RO Rootblox CozyThemes | 9.8 | Oct 22 | WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability |
| CVE-2026-112842 New | PM Paid Member Subscriptions Cozmoslabs | 6.5 | Oct 22 | WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability |
| CVE-2026-112822 New | WC Workreap Core AmentoTech | 8.5 | Oct 22 | WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability |
| CVE-2026-115334 New | LO lotus uselotus | 6.8 | Oct 22 | Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint |
| CVE-2026-115333 New | LO lotus uselotus | 5.9 | Oct 22 | Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix |
| CVE-2026-115332 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Subscription Filter Keys |
| CVE-2026-115331 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters |
| CVE-2026-115330 New | LO lotus uselotus | 8.8 | Oct 22 | Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics |
| CVE-2026-115329 New | LO lotus uselotus | 5.9 | Oct 22 | Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet |
| CVE-2026-115328 New | JS json-scada riclolsen | 8.8 | Oct 22 | JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API |
| CVE-2026-115327 New | LI libyang CESNET | 5.3 | Oct 22 | libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser |
| CVE-2026-115326 New | QL QloApps Webkul | 5.4 | Oct 22 | QloApps through 1.7.0 IDOR via OrderDetailController Refund Request |
| CVE-2026-115325 New | NE netmaker gravitl | 8.3 | Oct 22 | Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup |
| CVE-2026-115324 New | ME mem0 mem0ai | 8.1 | Oct 22 | mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store |
| CVE-2026-115323 New | EV evershop evershopcommerce | 7.3 | Oct 22 | EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API |
| CVE-2026-115322 New | BY bytebase bytebase | 4.3 | Oct 22 | Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers |
| CVE-2026-115321 New | BY bytebase bytebase | 4.3 | Oct 22 | Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment |
| CVE-2026-115319 New | FZ fzf junegunn | 2.5 | Oct 22 | fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents |
| CVE-2026-114665 New | GO goploy zhenorzz | 6.5 | Oct 22 | Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare |
| CVE-2025-71434 New | EC E-cology Weaver Network Co., Ltd. | 8.2 | Oct 22 | Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list |
| CVE-2024-58396 New | CA CPAS Audit Management System YouDataSum | 7.5 | Oct 22 | YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId |
| CVE-2024-58394 New | RE Retool Retool | 6.1 | Oct 22 | Retool 3.88.0 XSS via /api/imageProxy SVG Proxying |
| CVE-2024-58393 New | RU Readymade Unilevel Ecommerce MLM i-Netsolution | 8.2 | Oct 22 | i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php |
| CVE-2023-54413 New | WM WPML Multilingual CMS OnTheGoSystems | 6.1 | Oct 22 | WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang |
| CVE-2022-51025 New | WA WAPPLES Penta Security Systems | 6.5 | Oct 22 | Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer |