CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 31, 03:59 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90492 | WE web_robot webgjc | 6.3 | Sep 13 | webgjc web_robot web.py controller_recover os command injection |
| CVE-2026-90491 | GS gsubs sanjevirau | 6.3 | Sep 13 | sanjevirau gsubs Electron index.js showQuerySuccessPage code injection |
| CVE-2026-90490 | VH vhr lenve | 6.3 | Sep 13 | lenve vhr MailReceiver deserialization |
| CVE-2022-42917 | FR FRRouting FRRouting | 6.7 | Sep 13 | In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files… |
| CVE-2025-70819 | DU D6 Ultra Zettlab | 6.3 | Sep 13 | Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a compose… |
| CVE-2026-36989 | LW LuxCal Web Calendar LuxSoft | 5.8 | Sep 13 | A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php |
| CVE-2024-53922 | E8 Exynos 8890 firmware Samsung | 5.7 | Sep 13 | An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920 |
| CVE-2025-63842 | WB web backend Repetico | 5.4 | Sep 13 | A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in… |
| CVE-2020-15875 | LI LibreNMS LibreNMS | 5.0 | Sep 13 | An issue was discovered in LibreNMS 1.65 |
| CVE-2026-29812 | CY CyberPanel CyberPanel | 4.3 | Sep 13 | CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list |
| CVE-2026-29810 | CY CyberPanel CyberPanel | 4.3 | Sep 13 | CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic |
| CVE-2026-90488 | XX xxl-job Xuxueli | 6.3 | Sep 12 | Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection |
| CVE-2026-90487 | XX xxl-job Xuxueli | 4.3 | Sep 12 | Xuxueli xxl-job JobGroupController.java privileges management |
| CVE-2026-90486 | OP openstatus openstatusHQ | 6.3 | Sep 12 | openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery |
| CVE-2026-90485 | UN Uninstaller IOBit | 5.5 | Sep 12 | IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference |
| CVE-2026-90557 | FR freeciv freeciv | 6.1 | Sep 12 | Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame |
| CVE-2026-10148 | BF Booking for Appointments and Events Calendar – Amelia melograno | 6.4 | Sep 12 | Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter |
| CVE-2026-90555 | VL vLLM vllm-project | 6.5 | Sep 12 | vLLM before 0.28.0 Denial of Service via Audio Header |
| CVE-2026-90552 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via Playlists_schedules list.json.php |
| CVE-2026-90551 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via video_from_program API |
| CVE-2026-90550 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via mediaSession.json.php |
| CVE-2026-90549 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint |
| CVE-2026-90548 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization in ImageGallery list.json.php |
| CVE-2026-90547 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via getBookmarks.json.php |
| CVE-2026-90546 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via like.json.php |
| CVE-2026-90545 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via commentAddNew.json.php |
| CVE-2026-90544 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via videoAddViewCount.json.php |
| CVE-2026-90543 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php |
| CVE-2026-90542 | AV AVideo WWBN | 5.4 | Sep 12 | WWBN AVideo Missing Authorization via remindMe.json.php |
| CVE-2026-90541 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Unauthenticated Information Disclosure via menus.json.php |
| CVE-2026-90540 | AV AVideo WWBN | 4.3 | Sep 12 | WWBN AVideo Missing Authorization via playListAddVideo.json.php |
| CVE-2026-90539 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authentication via menuItems.json.php |
| CVE-2026-90538 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via playlistsFromUser.json.php |
| CVE-2026-90536 | AV AVideo WWBN | 5.3 | Sep 12 | WWBN AVideo Missing Authorization via adsInfo API Endpoint |
| CVE-2026-90534 | FL Flowise FlowiseAI | 6.5 | Sep 12 | Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method |
| CVE-2026-90533 | FL Flowise FlowiseAI | 6.5 | Sep 12 | Flowise before 3.1.4 Broken Access Control via organizationuser |
| CVE-2026-90474 | MC mcphub samanhappy | 6.8 | Sep 12 | MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass |
| CVE-2026-90473 | MS msgpack-java msgpack | 5.3 | Sep 12 | msgpack-java through 0.9.12 Integer Overflow via MAP32 |
| CVE-2026-90472 | MS msgpack-java msgpack | 5.3 | Sep 12 | msgpack-java through 0.9.12 Stack Overflow via Nested Arrays |
| CVE-2026-89172 | AN AN1044 Microchip | 5.6 | Sep 12 | Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms |
| CVE-2026-11355 | DL DT LMS – elearning, WordPress LMS Plugin designthemes | 5.3 | Sep 12 | DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions |
| CVE-2026-77161 | SM Smart Marketing SMS and Newsletters Forms egoi | 6.5 | Sep 12 | Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name |
| CVE-2026-85198 | MM MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO themeisle | 6.5 | Sep 12 | MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path |
| CVE-2026-17585 | RA Royal Addons for Elementor – Addons and Templates Kit for Elementor wproyal | 5.3 | Sep 12 | Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter |
| CVE-2026-87919 | PX Product XML Feed Manager for WooCommerce | 4.9 | Sep 12 | Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode |
| CVE-2026-87918 | WP WPBot | 5.3 | Sep 12 | WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions |
| CVE-2026-87916 | WP WPBot | 5.3 | Sep 12 | WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure |
| CVE-2026-87894 | RA Rox Appointment Booking | 5.3 | Sep 12 | Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR |
| CVE-2026-87892 | RA Rox Appointment Booking | 5.3 | Sep 12 | Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass |
| CVE-2026-87891 | RA Rox Appointment Booking | 6.5 | Sep 12 | Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API |