CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 09:24 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119126 New | PA parse-server parse-community | 3.1 | Oct 29 | Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys |
| CVE-2026-119125 New | PA parse-server parse-community | 3.1 | Oct 29 | Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields |
| CVE-2026-119124 New | IM ImageMagick ImageMagick | 3.3 | Oct 29 | ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option |
| CVE-2026-119123 New | IM ImageMagick ImageMagick | 3.7 | Oct 29 | ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder |
| CVE-2026-119122 New | CR crawl4ai unclecode | 5.3 | Oct 29 | Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check |
| CVE-2026-119121 New | CR crawl4ai unclecode | 4.3 | Oct 29 | Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for |
| CVE-2026-119120 New | CR crawl4ai unclecode | 7.5 | Oct 29 | Crawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name |
| CVE-2026-119119 New | CR crawl4ai unclecode | 7.5 | Oct 29 | Crawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields |
| CVE-2026-119118 New | CR crawl4ai unclecode | 6.5 | Oct 29 | Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags |
| CVE-2026-90872 New | WS WS_FTP Server Progress Software | 6.6 | Oct 29 | Server-Side Script Injection in Manager Web UI in Progress WS_FTP Server |
| CVE-2026-90871 New | WS WS_FTP Server Progress Software | 5.3 | Oct 29 | Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server |
| CVE-2026-90870 New | WS WS_FTP Server Progress Software | 5.3 | Oct 29 | Unauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server |
| CVE-2026-90869 New | WS WS_FTP Server Progress Software | 7.5 | Oct 29 | Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server |
| CVE-2026-90868 New | WS WS_FTP Server Progress Software | 9.9 | Oct 29 | OS Command Injection in Progress WS_FTP Server |
| CVE-2026-90867 New | WS WS_FTP Server Progress Software | 8.1 | Oct 29 | Improper Access Control of Web Admin Console in Progress WS_FTP Server |
| CVE-2026-90866 New | WS WS_FTP Server Progress Software | 9.1 | Oct 29 | Virtual Folder Path Confinement Bypass in Progress WS_FTP Server |
| CVE-2026-90865 New | WS WS_FTP Server Progress Software | 9.0 | Oct 29 | Command Injection via FTP Notification Variables in Progress WS_FTP Server |
| CVE-2026-90864 New | WS WS_FTP Server Progress Software | 9.1 | Oct 29 | Host Administrator Path Containment Bypass in Progress WS_FTP Server |
| CVE-2026-90863 New | WS WS_FTP Server Progress Software | 9.1 | Oct 29 | Privilege Escalation via Missing Authorization in WS_FTP Manager |
| CVE-2026-90862 New | WS WS_FTP Server Progress Software | 4.3 | Oct 29 | Web Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server |
| CVE-2026-90861 New | WS WS_FTP Server Progress Software | 6.6 | Oct 29 | Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server |
| CVE-2026-84296 New | WS WS_FTP Server Progress Software | 6.8 | Oct 29 | SSH Multi-Factor Authentication Bypass in Progress WS_FTP Server |
| CVE-2026-84295 New | WS WS_FTP Server Progress Software | 10.0 | Oct 29 | Improper Authentication in Progress WS_FTP Server |
| CVE-2026-115793 New | PN P-Net RT-Labs | 8.7 | Oct 29 | Resource exhaustion from RPC sessions kept for requests to unknown interface |
| CVE-2026-115794 New | PN P-Net RT-Labs | 2.3 | Oct 29 | Alarm data length not validated against received frame length |
| CVE-2026-115795 New | PN P-Net RT-Labs | 5.3 | Oct 29 | Out-of-bounds read of DCP block header in DCP Set and Identify request parsing |
| CVE-2026-111736 New | PN P-Net RT-Labs | 8.7 | Oct 29 | NULL pointer dereference on implicit read of user specific record index |
| CVE-2026-112200 New | PN P-Net RT-Labs | 8.7 | Oct 29 | Resource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness |
| CVE-2026-84294 New | WS WS_FTP Server Progress Software | 7.7 | Oct 29 | Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server |
| CVE-2026-111735 New | PN P-Net RT-Labs | 7.1 | Oct 29 | Integer underflow leads to out-of-bounds read in pf_cpm_c_data_ind() |
| CVE-2026-111734 New | PN P-Net RT-Labs | 7.1 | Oct 29 | Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv() |
| CVE-2026-111733 New | PN P-Net RT-Labs | 8.7 | Oct 29 | NULL pointer dereference on implicit read of AR specific record index |
| CVE-2026-111732 New | PN P-Net RT-Labs | 9.3 | Oct 29 | Out-of-bounds write when parsing AR Vendor Block requests |
| CVE-2026-111731 New | PN P-Net RT-Labs | 8.7 | Oct 29 | Infinite loop when reading PDPortDataCheck record of subslot 0 |
| CVE-2026-111730 New | PN P-Net RT-Labs | 7.2 | Oct 29 | Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length |
| CVE-2026-112256 New | AA Advanced Authentication Server OpenText | 9.2 | Oct 29 | Logon bypass (trust of attacker-controlled completed-methods list) |
| CVE-2026-112255 New | AA Advanced Authentication Server OpenText | 2.9 | Oct 29 | Endpoint credential minting (insecure default allow-list) |
| CVE-2026-118084 New | HB Hotel Booking nicdark | 6.5 | Oct 29 | WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-118083 New | WC WP Crowdfunding Themeum | 7.5 | Oct 29 | WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability |
| CVE-2026-118082 New | BP Buddyboss Platform BuddyBoss | 8.8 | Oct 29 | WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability |
| CVE-2026-118081 New | 1S 10Web Social Photo Feed 10Web | 8.8 | Oct 29 | WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability |
| CVE-2026-118080 New | SS Social Snap Social Snap | 8.8 | Oct 29 | WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability |
| CVE-2026-118079 New | FF FV Flowplayer Video Player FolioVision | 7.2 | Oct 29 | WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability |
| CVE-2026-118078 New | PC Product Catalog Feed by PixelYourSite PixelYourSite | 7.2 | Oct 29 | WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability |
| CVE-2026-118077 New | SE Sastra Essential Addons for Elementor Fast Themes | 7.2 | Oct 29 | WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability |
| CVE-2026-118076 New | FP Frisbii Pay Frisbii | 8.8 | Oct 29 | WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability |
| CVE-2026-118075 New | WM WP Media folders dbarrere | 8.8 | Oct 29 | WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability |
| CVE-2026-118074 New | FL Finale Lite Daman Jeet | 7.2 | Oct 29 | WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability |
| CVE-2026-118073 New | NK News Kit Elementor Addons blazethemes | 8.8 | Oct 29 | WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability |
| CVE-2026-116869 New | MC myPOS Checkout myPOS Payments | 7.2 | Oct 29 | WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability |