CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 02:47 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107832 | FA fastify fastify | 3.7 | Oct 13 | fastify vulnerable to header validation bypass via case-sensitive propertyNames |
| CVE-2026-109407 | MA mall macrozheng | 3.1 | Oct 13 | macrozheng mall Coupon Redemption generateOrder race condition |
| CVE-2026-109854 | RH Red Hat Enterprise Linux 10 Red Hat | 2.5 | Oct 13 | M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding |
| CVE-2026-82632 | GI GitLab GitLab | 3.1 | Oct 13 | Incorrect Authorization in GitLab |
| CVE-2026-100104 | GI GitLab GitLab | 3.5 | Oct 13 | Server-Side Request Forgery (SSRF) in GitLab |
| CVE-2026-103549 | GI GitLab GitLab | 2.7 | Oct 13 | Incorrect Authorization in GitLab |
| CVE-2026-58242 | SC SAP Cloud Connector SAP_SE | 3.5 | Oct 13 | Improper Authorization check in SAP Cloud Connector |
| CVE-2026-108942 | CL clarity-upscaler philz1337x | 3.5 | Oct 13 | philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting |
| CVE-2026-108936 | BR BR-6208AC Edimax | 2.4 | Oct 12 | Edimax BR-6208AC QoS Page formQoS cross site scripting |
| CVE-2026-109603 | FR frappe frappe | 3.3 | Oct 12 | Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit |
| CVE-2026-108935 | BR BR-6208AC Edimax | 2.4 | Oct 12 | Edimax BR-6208AC Port Forwarding formPortFw cross site scripting |
| CVE-2026-108934 | BR BR-6208AC Edimax | 2.4 | Oct 12 | Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting |
| CVE-2026-108933 | BR BR-6208AC Edimax | 2.4 | Oct 12 | Edimax BR-6208AC formFilter cross site scripting |
| CVE-2026-109564 | LE LearnHouse learnhouse | 3.1 | Oct 12 | LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint |
| CVE-2026-108930 | NR NR268 Netcore | 2.7 | Oct 12 | Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure |
| CVE-2026-104364 | DB Db2 IBM | 3.3 | Oct 12 | IBM® Db2® Denial of Service |
| CVE-2026-42689 | EM Events Manager Pixelite | 3.7 | Oct 12 | WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability |
| CVE-2026-105274 | RE rebar3 erlang | 2.1 | Oct 12 | hex_core decompresses registry and Erlang term API responses without size limits |
| CVE-2026-108908 | NR NR268 Netcore | 2.4 | Oct 12 | Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting |
| CVE-2026-109366 | ZE zebra ZcashFoundation | 3.7 | Oct 12 | Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height |
| CVE-2026-109365 | ZE zebra ZcashFoundation | 3.7 | Oct 12 | Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies |
| CVE-2026-109332 | NE Network-AI Jovancoding | 3.1 | Oct 12 | Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport |
| CVE-2026-109302 | PA parse-server parse-community | 3.7 | Oct 12 | Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries |
| CVE-2026-109282 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders |
| CVE-2026-109280 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option |
| CVE-2026-109279 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access |
| CVE-2026-109278 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operation |
| CVE-2026-109277 | IM ImageMagick ImageMagick | 3.3 | Oct 12 | ImageMagick before 7.1.2-32 Policy Bypass via -script Operation |
| CVE-2026-109274 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script |
| CVE-2026-109272 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder |
| CVE-2026-109271 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder |
| CVE-2026-109270 | IM ImageMagick ImageMagick | 3.3 | Oct 12 | ImageMagick before 7.1.2-32 Memory Leak via -process Option |
| CVE-2026-109268 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG2000 |
| CVE-2026-109264 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder |
| CVE-2026-109263 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder |
| CVE-2026-109261 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder |
| CVE-2026-109260 | IM ImageMagick ImageMagick | 3.7 | Oct 12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder |
| CVE-2026-109258 | IM ImageMagick ImageMagick | 2.5 | Oct 12 | ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation |
| CVE-2026-109247 | FR FreeRDP FreeRDP | 3.1 | Oct 12 | FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName |
| CVE-2026-109241 | FR FreeRDP FreeRDP | 3.1 | Oct 12 | FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel |
| CVE-2026-109240 | FR FreeRDP FreeRDP | 3.1 | Oct 12 | FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer |
| CVE-2026-81856 | HE hex hexpm | 2.3 | Oct 12 | Terminal escape sequence injection in Hex via unneutralized server-supplied output |
| CVE-2026-108901 | MM MPOS M6 PLUS Shenzhen HCC Technology | 3.5 | Oct 12 | Shenzhen HCC Technology MPOS M6 PLUS Display QR Code Rendering ui layer |
| CVE-2026-96618 | HE hex hexpm | 2.1 | Oct 12 | Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror |
| CVE-2026-109195 | RH Red Hat Quay 3 Red Hat | 3.1 | Oct 12 | Quay: repository auto-prune policy uuid idor in quay api |
| CVE-2026-108898 | WF WF2409E Netis | 3.5 | Oct 12 | Netis WF2409E Wireless Settings cross site scripting |
| CVE-2026-103526 | TH Thelia Thelia | 3.7 | Oct 12 | In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated… |
| CVE-2026-105081 | IM ImageMagick ImageMagick | 3.6 | Oct 12 | ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName |
| CVE-2026-108815 | ID idcCMS Idccms | 3.5 | Oct 12 | idcCMS member_deal.php cross site scripting |
| CVE-2026-108809 | CR Call Recording Software Eleveo | 3.5 | Oct 12 | Eleveo Call Recording Software logout session expiration |