CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 11:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2021-48014 | FI FineReport FanRuan | 9.8 | Oct 22 | FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer |
| CVE-2026-112241 | SU SureCart Brainstorm Force | 9.8 | Oct 22 | WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability |
| CVE-2026-112327 | AM Amelia TMS | 9.3 | Oct 22 | WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability |
| CVE-2026-114220 | NO NT OneAPP NewType Infortech | 9.1 | Oct 22 | NewType Infortech｜NT OneAPP - Improper Certificate Validation |
| CVE-2026-96355 | DR Drupal Drupal | 9.1 | Oct 22 | Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 |
| CVE-2026-114575 | A9 A950RG TOTOLINK | 10.0 | Oct 22 | TOTOLINK A950RG product.so UploadCustomModule command injection |
| CVE-2026-110264 | GI GitLab GitLab | 10.0 | Oct 22 | Integer Overflow or Wraparound in GitLab |
| CVE-2026-78846 | Product not mapped yet | 9.8 | Oct 22 | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing |
| CVE-2025-65200 | Product not mapped yet | 9.6 | Oct 22 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the… |
| CVE-2026-76531 | SS Splunk SOAR Splunk | 9.9 | Oct 21 | Files or Directories Accessible to External Parties in Splunk SOAR |
| CVE-2026-76527 | SS Splunk SOAR Splunk | 9.8 | Oct 21 | Improper Check or Handling of Exceptional Conditions in Splunk SOAR |
| CVE-2026-76302 | SE Splunk Enterprise Splunk | 9.9 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-76301 | SE Splunk Enterprise Splunk | 9.8 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-76299 | SE Splunk Enterprise Splunk | 9.9 | Oct 21 | Security Hardening in Splunk Enterprise - October 2026 |
| CVE-2026-114509 | FR framework laravel | 9.2 | Oct 21 | Laravel TokenGuard authentication bypass through non-string API credentials |
| CVE-2026-114383 | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow |
| CVE-2026-114382 | EX EX200 TOTOLINK | 10.0 | Oct 21 | TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow |
| CVE-2026-91403 | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-96639 | PI Pillow python-pillow | 9.8 | Oct 21 | Pillow multi-frame loaders can reuse stale native image storage after mode transitions |
| CVE-2026-114139 | SE sentry-javascript getsentry | 9.1 | Oct 21 | Sentry-Javascript: Middleware Bypass when using Tunnel route |
| CVE-2026-111812 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials |
| CVE-2026-111811 | AT Apache Traffic Server Apache Software Foundation | 9.0 | Oct 21 | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication |
| CVE-2026-111809 | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling |
| CVE-2026-111815 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement |
| CVE-2026-111814 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin |
| CVE-2026-114268 | BP BE3L Pro Tenda | 9.9 | Oct 21 | Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow |
| CVE-2026-111816 | AT Apache Traffic Server Apache Software Foundation | 9.3 | Oct 21 | Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out |
| CVE-2026-111813 | AT Apache Traffic Server Apache Software Foundation | 10.0 | Oct 21 | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration |
| CVE-2026-105944 | AP Apache Pulsar Manager Apache Software Foundation | 10.0 | Oct 21 | Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life |
| CVE-2026-105869 | AP Apache Pulsar Apache Software Foundation | 9.2 | Oct 21 | Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role |
| CVE-2026-111183 | GS GStreamer GStreamer | 9.8 | Oct 21 | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2026-76475 | CE Cisco Emergency Responder Cisco | 9.3 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities |
| CVE-2026-76474 | CE Cisco Emergency Responder Cisco | 9.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities |
| CVE-2026-76473 | CE Cisco Emergency Responder Cisco | 9.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. |
| CVE-2026-76466 | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 9.8 | Oct 21 | Cisco Expressway Series Remote Code Execution Vulnerability |
| CVE-2026-20043 | CC Cisco Cyber Vision Cisco | 9.0 | Oct 21 | Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 |
| CVE-2026-113788 | LA lagoon uselagoon | 9.4 | Oct 21 | Lagoon core ssh service vulnerable to remote code execution |
| CVE-2026-111832 | WM WP Mailster WP Mailster | 10.0 | Oct 21 | WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability |
| CVE-2026-111834 | MB Mang Board WP Kitae Park | 9.9 | Oct 21 | WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability |
| CVE-2026-111852 | AS Ajax Search Lite WPdreams | 9.3 | Oct 21 | WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability |
| CVE-2026-109618 In wildKEV | PH PHP PHP | 9.8 | Oct 21 | RCE via OOM corruption |
| CVE-2026-87095 | AC Acronis Cyber Infrastructure Acronis | 9.1 | Oct 21 | Sensitive information disclosure and manipulation due to improper authorization checks |
| CVE-2026-71195 | MA Manila OpenStack | 9.9 | Oct 21 | In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share |
| CVE-2026-113744 | AC AC19 Tenda | 10.0 | Oct 21 | Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow |
| CVE-2026-114119 | BP Bp Premier Best Practice Software | 9.8 | Oct 21 | Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential |
| CVE-2026-114108 | VI Vibe-Trading HKUDS | 9.8 | Oct 21 | HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE |
| CVE-2026-113736 | DH DHP-W610AV D-Link | 9.8 | Oct 21 | D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password |
| CVE-2026-81212 | DO DataStage on Cloud Pak for Data IBM | 10.0 | Oct 20 | DataStage on Cloud Pak for Data Improper Authorization |
| CVE-2026-92559 | AC App Connect Enterprise IBM | 9.8 | Oct 20 | IBM App Connect Enterprise is vulnerable to a credential exposure |
| CVE-2026-91665 | OE Oracle Essbase Oracle Corporation | 9.8 | Oct 20 | Vulnerability in Oracle Essbase (component: Security) |