CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 18:40 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114625 In wildKEVNew | VO VeloCloud Orchestrator Arista Networks | 9.9 | Oct 22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host |
| CVE-2026-111497 In wildKEVNew | BR Brotli Google | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-109618 In wildKEV | PH PHP PHP | 9.8 | Oct 21 | RCE via OOM corruption |
| CVE-2026-102764 In wildKEV | RS Remote Support BeyondTrust | 9.8 | Oct 15 | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support |
| CVE-2026-76519 In wildKEV | CS Cisco Secure Email Cisco | 9.8 | Oct 14 | Cisco Secure Email Gateway Arbitrary File Write Vulnerability |
| CVE-2026-110447 In wildKEV | CO Collabora Online - Built-in CODE Server Collabora | 9.8 | Oct 14 | Collabora Online – Built-in CODE Server OS Command Injection Vulnerability |
| CVE-2026-105134 In wildKEV | AH AhsayCBS Ahsay | 10.0 | Oct 4 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection |
| CVE-2026-104286 In wildKEV | FO FortiMail Fortinet | 9.8 | Oct 1 | Fortinet FortiMail Path Traversal Vulnerability |
| CVE-2026-102489 In wildKEV | ZA Zammad Zammad GmbH | 9.8 | Sep 30 | Undisclosed RCE in Zammad v6.3 and higher |
| CVE-2026-76504 In wildKEV | CC Cisco Catalyst SD-WAN Manager Cisco | 9.8 | Sep 30 | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability |
| CVE-2026-88771 In wildKEV | NA NetScaler ADC Citrix | 9.8 | Sep 27 | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands |
| CVE-2026-94127 In wildKEV | BI BIG-IP F5 | 9.8 | Sep 22 | BIG-IP APM OAuth vulnerability |
| CVE-2026-93616 In wildKEV | QS Quantum Security Management checkpoint | 9.8 | Sep 22 | Directory Traversal and File upload allows execution of arbitrary script on the Management Server |
| CVE-2026-93952 In wildKEV | VO VeloCloud Orchestrator (VCO) On-Prem Arista Networks | 10.0 | Sep 22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host |
| CVE-2026-76460 In wildKEV | CI Cisco Identity Services Engine Software Cisco | 10.0 | Sep 16 | Cisco Identity Services Engine Authentication Bypass Vulnerability |
| CVE-2026-76461 In wildKEV | CS Cisco Secure Email Cisco | 9.8 | Sep 14 | Cisco Secure Email Gateway SQL Injection Vulnerability |
| CVE-2026-85706 In wildKEV | GI GitLab GitLab | 10.0 | Sep 12 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab |
| CVE-2026-85102 In wildKEV | QS Quantum Security Gateway Check Point | 9.8 | Sep 9 | Improper Certificate Validation in Quantum Security Gateway |
| CVE-2026-84869 In wildKEV | SC ScreenConnect ConnectWise | 9.9 | Sep 8 | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions |
| CVE-2026-75650 In wildKEV | CO Commerce Adobe | 10.0 | Sep 7 | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) |
| CVE-2026-86218 In wildKEV | NC N-central N-able | 9.8 | Sep 6 | pre-authentication remote code execution |
| CVE-2026-86060 In wildKEV | RO RouterOS Mikrotik | 9.8 | Sep 5 | SSH session privilege manipulation via a crafted username in Mikrotik RouterOS |
| CVE-2026-83548 In wildKEV | SM SMA1000 SonicWall | 10.0 | Sep 1 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| CVE-2026-82329 In wildKEV | AR artifactory jfrog | 9.8 | Aug 28 | Potential authentication bypass leading to administrative access in Artifactory |
| CVE-2026-82078 In wildKEV | PM PaperCut MF/NG PaperCut | 9.1 | Aug 28 | PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector |
| CVE-2026-81578 In wildKEV | PM PaperCut MF/NG PaperCut | 9.8 | Aug 28 | PaperCut MF/NG: Authentication Bypass |
| CVE-2026-60004 In wildKEV | GI Gitea Gitea | 9.8 | Aug 26 | Gitea Code Injection Vulnerability |
| CVE-2026-69836 In wildKEV | ME Microsoft Entra Microsoft | 10.0 | Aug 20 | Microsoft Entra ID Remote Code Execution Vulnerability |
| CVE-2026-72530 In wildKEV | TS TrueConf Server TrueConf | 9.0 | Aug 19 | TrueConf Server Code Injection Vulnerability |
| CVE-2026-72529 In wildKEV | TS TrueConf Server TrueConf | 9.8 | Aug 19 | TrueConf Server Missing Authentication for Critical Function Vulnerability |
| CVE-2026-19490 In wildKEV | NA NetScaler ADC Citrix | 9.8 | Aug 19 | NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 |
| CVE-2026-64849 In wildKEV | ML mlflow mlflow | 9.3 | Aug 17 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) |
| CVE-2026-71362 In wildKEV | CO Commerce Adobe | 9.1 | Aug 11 | Adobe Commerce | Incorrect Authorization (CWE-863) |
| CVE-2026-72898 In wildKEV | ME Metabase Metabase | 10.0 | Aug 10 | Metabase SQL injection via password reset endpoint |
| CVE-2026-65400 In wildKEV | MA macOS Apple | 9.8 | Aug 6 | Apple macOS Improper Authentication Vulnerability |
| CVE-2026-5430 In wildKEV | WA WSO2 API Control Plane WSO2 | 10.0 | Aug 6 | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover |
| CVE-2026-59310 RansomwareIn wildKEV | VS vCenter Server VMware | 9.8 | Jul 30 | vCenter directory-traversal vulnerability |
| CVE-2026-63077 RansomwareIn wildKEV | TE TeamCity JetBrains | 9.8 | Jul 27 | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
| CVE-2026-16812 In wildKEV | VO VeloCloud Orchestrator On-Prem Arista Networks | 10.0 | Jul 27 | VeloCloud Orchestrator OS Command Injection |
| CVE-2026-16232 In wildKEV | MS Multi-Domain Security Management checkpoint | 9.8 | Jul 22 | Authentication Bypass in the SmartConsole Login Process Using an Application Token |
| CVE-2026-63030 In wildKEV | WO WordPress WordPress | 9.8 | Jul 17 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution |
| CVE-2026-9198 In wildKEV | LO Langflow OSS IBM | 9.8 | Jul 17 | Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation |
| CVE-2026-9586 In wildKEV | SS Switchvox SMB Edition Sangoma | 9.8 | Jul 17 | Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB |
| CVE-2026-48356 In wildKEV | CO Commerce Adobe | 9.3 | Jul 14 | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) |
| CVE-2026-15409 RansomwareIn wildKEV | SM SMA1000 SonicWall | 10.0 | Jul 14 | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
| CVE-2026-55040 In wildKEV | SH SharePoint Microsoft | 9.1 | Jul 14 | Microsoft SharePoint Server Security Feature Bypass Vulnerability |
| CVE-2026-58644 In wildKEV | SH SharePoint Microsoft | 9.8 | Jul 14 | Microsoft SharePoint Remote Code Execution Vulnerability |
| CVE-2026-50522 In wildKEV | SH SharePoint Microsoft | 9.8 | Jul 14 | Microsoft SharePoint Remote Code Execution Vulnerability |
| CVE-2026-56164 In wildKEV | SH SharePoint Microsoft | 9.8 | Jul 14 | Microsoft SharePoint Server Elevation of Privilege Vulnerability |
| CVE-2026-56291 In wildKEV | BB balbooa.com Balbooa Forms extension for Joomla balbooa.com | 9.8 | Jul 9 | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 |