CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 13:28 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115191 New | Product not mapped yet | 7.1 | Oct 26 | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax) |
| CVE-2026-115190 New | Product not mapped yet | 8.0 | Oct 26 | An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties |
| CVE-2026-115189 New | Product not mapped yet | 8.8 | Oct 26 | A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic |
| CVE-2026-110474 New | AA Agentic AI Call Centre CreditNirvana | 8.7 | Oct 26 | Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application |
| CVE-2026-115717 New | BU builder frappe | 7.7 | Oct 26 | Frappe Builder before 1.36.1 SSRF via convert_to_webp |
| CVE-2026-94380 New | LM Liman MYS HAVELSAN Inc. | 8.1 | Oct 26 | Host Header Injection in HAVELSAN's Liman MYS |
| CVE-2026-116260 New | LI libimobiledevice Libimobiledevice | 7.3 | Oct 26 | libimobiledevice AFC Service afc.c service_receive double free |
| CVE-2026-116469 New | MI misp-guard MISP | 7.1 | Oct 26 | MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding |
| CVE-2026-116257 New | BI BillaBear Billabear | 7.3 | Oct 26 | BillaBear Installation InstallController.php processInstall missing authentication |
| CVE-2026-115608 New | JE JetEngine Crocoblock | 8.5 | Oct 26 | WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability |
| CVE-2026-116256 New | RH RhaPHP geesondog | 7.3 | Oct 26 | geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery |
| CVE-2026-115948 New | ML Media LIbrary Assistant David Lingren | 8.5 | Oct 26 | WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability |
| CVE-2026-116253 New | DE DedeCMS Dedecms | 7.3 | Oct 26 | DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection |
| CVE-2026-116237 New | PX Pugongying X5 Pro Oray | 8.4 | Oct 26 | Oray Pugongying X5 Pro Dnsmasq crlf injection |
| CVE-2026-116236 New | PX Pugongying X5 Pro Oray | 7.2 | Oct 26 | Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload |
| CVE-2026-82947 New | SO SOEM RT-Labs AB | 7.1 | Oct 26 | Multiple Out-of-Bounds Reads in Frame Processing |
| CVE-2026-82944 New | SO SOEM RT-Labs AB | 8.8 | Oct 26 | Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers |
| CVE-2026-111841 New | FA FunnelKit Automations Aman | 8.8 | Oct 26 | WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-116372 New | MI misp-guard MISP | 7.7 | Oct 26 | MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules |
| CVE-2026-70388 New | SO SOEM RT-Labs AB | 8.3 | Oct 26 | Memory Corruption via Integer Underflow in Message Length Validation |
| CVE-2026-96581 New | AS ash ash-project | 7.6 | Oct 26 | An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records |
| CVE-2026-107900 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107899 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107898 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107897 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107896 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107895 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107894 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-113345 New | ED Electronic delivery item Inspection Support System Ministry of Land, Infrastructure, Transport and Tourism, Japan | 7.8 | Oct 26 | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission… |
| CVE-2026-116117 New | HA halo halo-dev | 7.3 | Oct 26 | halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal |
| CVE-2026-116116 New | GC GM8135S Camera Yoosee | 8.2 | Oct 26 | Yoosee GM8135S Camera Secure Boot signature verification |
| CVE-2026-116112 New | ED edoc-doctor-appointment-system HashenUdara | 7.3 | Oct 26 | HashenUdara edoc-doctor-appointment-system add-new.php sql injection |
| CVE-2026-116110 New | LI LiveWallPaper GiantappMan | 7.3 | Oct 26 | GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication |
| CVE-2026-116106 New | HA HeyCyan App Heycyan App | 7.3 | Oct 26 | HeyCyan App FileProvider access control |
| CVE-2026-116094 New | EY EyouCMS Eyoucms | 7.3 | Oct 25 | EyouCMS function.php remote_file_to_local server-side request forgery |
| CVE-2026-116062 New | PI Performance Indicator System SourceCodester | 7.3 | Oct 25 | SourceCodester Performance Indicator System save_profile.php sql injection |
| CVE-2026-116061 New | PI Performance Indicator System SourceCodester | 7.3 | Oct 25 | SourceCodester Performance Indicator System edit_dealer.php sql injection |
| CVE-2026-116060 New | PI Performance Indicator System SourceCodester | 7.3 | Oct 25 | SourceCodester Performance Indicator System adddealer.php sql injection |
| CVE-2026-116211 New | YE yeswiki YesWiki | 8.2 | Oct 25 | YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create |
| CVE-2026-116208 New | YE yeswiki YesWiki | 8.1 | Oct 25 | YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts |
| CVE-2026-116204 New | YE yeswiki YesWiki | 8.1 | Oct 25 | YesWiki before 4.7.0 CSRF via despam Admin Action |
| CVE-2026-116201 New | SN snipe-it grokability | 8.8 | Oct 25 | Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition |
| CVE-2026-116199 New | SN snipe-it grokability | 8.1 | Oct 25 | Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback |
| CVE-2026-116191 New | RC rclone rclone | 7.5 | Oct 25 | Rclone before 1.75.2 Path Traversal via serve webdav MKCOL |
| CVE-2026-116189 New | RC rclone rclone | 7.5 | Oct 25 | rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS |
| CVE-2026-116183 New | PH phpMyFAQ thorsten | 7.5 | Oct 25 | phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID |
| CVE-2026-116180 New | VL vllm vllm-project | 7.7 | Oct 25 | vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors |
| CVE-2026-116179 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override |
| CVE-2026-116178 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders |
| CVE-2026-116177 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass |