CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 13:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110232 | FF Fossify File Manager Fossify | 3.3 | Oct 13 | Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity |
| CVE-2026-110225 | SH Shaarli shaarli | 2.7 | Oct 13 | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route |
| CVE-2026-110223 | KA Kavita Kareadita | 3.1 | Oct 13 | Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint |
| CVE-2026-110218 | AE Aureus ERP Webkul | 3.7 | Oct 13 | Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL |
| CVE-2026-110214 | SN Snowy xiaonuobase | 3.7 | Oct 13 | Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download |
| CVE-2026-110036 | RH Red Hat Enterprise Linux 10 Red Hat | 3.3 | Oct 13 | Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices |
| CVE-2026-106175 | FO FortiOS Fortinet | 2.3 | Oct 13 | A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6,… |
| CVE-2026-106176 | FO FortiSIEM Fortinet | 3.8 | Oct 13 | A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests |
| CVE-2026-88834 | RH Red Hat Hardened Images Red Hat | 3.7 | Oct 13 | Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds |
| CVE-2026-109526 | TO Toonflow-app HBAI-Ltd | 3.3 | Oct 13 | HBAI-Ltd Toonflow-app exportData Endpoint information disclosure |
| CVE-2026-65200 | OP openBMC Huawei | 3.5 | Oct 13 | Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses |
| CVE-2026-65197 | HF HDM Family-A G5 H3C | 3.1 | Oct 13 | H3C G3/G5 HDM Firmware Verification Key Replacement |
| CVE-2026-109410 | MA mall macrozheng | 2.4 | Oct 13 | macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation |
| CVE-2026-107832 | FA fastify fastify | 3.7 | Oct 13 | fastify vulnerable to header validation bypass via case-sensitive propertyNames |
| CVE-2026-109407 | MA mall macrozheng | 3.1 | Oct 13 | macrozheng mall Coupon Redemption generateOrder race condition |
| CVE-2026-109854 | RH Red Hat Enterprise Linux 10 Red Hat | 2.5 | Oct 13 | M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding |
| CVE-2026-82632 | GI GitLab GitLab | 3.1 | Oct 13 | Incorrect Authorization in GitLab |
| CVE-2026-100104 | GI GitLab GitLab | 3.5 | Oct 13 | Server-Side Request Forgery (SSRF) in GitLab |
| CVE-2026-103549 | GI GitLab GitLab | 2.7 | Oct 13 | Incorrect Authorization in GitLab |
| CVE-2026-58242 | SC SAP Cloud Connector SAP_SE | 3.5 | Oct 13 | Improper Authorization check in SAP Cloud Connector |
| CVE-2026-108942 | CL clarity-upscaler philz1337x | 3.5 | Oct 13 | philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting |
| CVE-2026-108936 | BR BR-6208AC Edimax | 2.4 | Oct 12 | Edimax BR-6208AC QoS Page formQoS cross site scripting |
| CVE-2026-109603 | FR frappe frappe | 3.3 | Oct 12 | Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit |
| CVE-2026-108935 | BR BR-6208AC Edimax | 2.4 | Oct 12 | Edimax BR-6208AC Port Forwarding formPortFw cross site scripting |
| CVE-2026-108934 | BR BR-6208AC Edimax | 2.4 | Oct 12 | Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting |
| CVE-2026-108933 | BR BR-6208AC Edimax | 2.4 | Oct 12 | Edimax BR-6208AC formFilter cross site scripting |
| CVE-2026-109564 | LE LearnHouse learnhouse | 3.1 | Oct 12 | LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint |
| CVE-2026-108930 | NR NR268 Netcore | 2.7 | Oct 12 | Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure |
| CVE-2026-104364 | DB Db2 IBM | 3.3 | Oct 12 | IBM® Db2® Denial of Service |
| CVE-2026-42689 | EM Events Manager Pixelite | 3.7 | Oct 12 | WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability |
| CVE-2026-105274 | RE rebar3 erlang | 2.1 | Oct 12 | hex_core decompresses registry and Erlang term API responses without size limits |
| CVE-2026-108908 | NR NR268 Netcore | 2.4 | Oct 12 | Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting |
| CVE-2026-109366 | ZE zebra ZcashFoundation | 3.7 | Oct 12 | Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height |
| CVE-2026-109365 | ZE zebra ZcashFoundation | 3.7 | Oct 12 | Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies |
| CVE-2026-109332 | NE Network-AI Jovancoding | 3.1 | Oct 12 | Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport |
| CVE-2026-109302 | PA parse-server parse-community | 3.7 | Oct 12 | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries |
| CVE-2026-109282 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders |
| CVE-2026-109280 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option |
| CVE-2026-109279 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access |
| CVE-2026-109278 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation |
| CVE-2026-109277 | IM ImageMagick ImageMagick | 3.3 | Oct 12 | ImageMagick before 7.1.2-32 Policy Bypass via -script Operation |
| CVE-2026-109274 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script |
| CVE-2026-109272 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder |
| CVE-2026-109271 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder |
| CVE-2026-109270 | IM ImageMagick ImageMagick | 3.3 | Oct 12 | ImageMagick before 7.1.2-32 Memory Leak via -process Option |
| CVE-2026-109268 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000 |
| CVE-2026-109264 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder |
| CVE-2026-109263 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder |
| CVE-2026-109261 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder |
| CVE-2026-109260 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder |