CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 09:56 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104736 | LW LearnPress – WordPress LMS Plugin for Create and Sell Online Courses thimpress | 9.8 | Oct 17 | LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter |
| CVE-2026-110653 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 9.1 | Oct 17 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter |
| CVE-2026-111823 | MA mage-ai Mage | 9.8 | Oct 16 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider |
| CVE-2026-110759 | Product not mapped yet | 9.8 | Oct 16 | Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse |
| CVE-2026-110757 | Product not mapped yet | 9.8 | Oct 16 | Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine |
| CVE-2026-110756 | Product not mapped yet | 9.8 | Oct 16 | Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print |
| CVE-2026-110753 | Product not mapped yet | 9.8 | Oct 16 | Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline |
| CVE-2026-96620 | CL claude-agent-sdk-python anthropics | 9.2 | Oct 16 | Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution |
| CVE-2026-108709 | AK Apache Kylin Apache Software Foundation | 9.8 | Oct 16 | Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) |
| CVE-2026-102608 | ZO zoneminder ZoneMinder | 9.0 | Oct 16 | ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) |
| CVE-2026-68573 | AK Apache Kylin Apache Software Foundation | 9.8 | Oct 16 | Apache Kylin: Unauthenticated Metastore Cleanup |
| CVE-2026-111711 | NR NR256CN Netcore | 9.8 | Oct 16 | Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok() |
| CVE-2026-111708 | WH whaticket-community canove | 9.8 | Oct 16 | WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup |
| CVE-2026-111704 | LA langchat LangChat | 9.8 | Oct 16 | LangChat through commit 2a6285a Missing Authentication on REST API Controllers |
| CVE-2026-111693 | DA databuff databufflabs | 9.8 | Oct 16 | DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials |
| CVE-2026-111692 | DA databuff databufflabs | 9.8 | Oct 16 | DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret |
| CVE-2026-111690 | SI simple-admin-core suyuan32 | 9.8 | Oct 16 | Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass |
| CVE-2026-111687 | WE we-mp-rss rachelos | 9.8 | Oct 16 | WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint |
| CVE-2026-111673 | IC IceCMS Thecosy | 9.8 | Oct 16 | IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints |
| CVE-2026-111643 | MI misaka_danmu_server l429609201 | 9.8 | Oct 16 | Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback |
| CVE-2026-111641 | FA FastapiAdmin fastapiadmin | 9.8 | Oct 16 | FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints |
| CVE-2026-111626 | DA Damselfly Webreaper | 9.8 | Oct 16 | Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers |
| CVE-2026-49868 | RI RIOT RIOT-OS | 9.8 | Oct 16 | RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read |
| CVE-2026-102693 | RI RIOT RIOT-OS | 9.6 | Oct 16 | RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID |
| CVE-2026-102692 | RI RIOT RIOT-OS | 9.1 | Oct 16 | RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access |
| CVE-2026-85748 | SE server MariaDB | 9.9 | Oct 16 | MariaDB: Use-after-free with a large number of SYS_REFCURSOR's |
| CVE-2026-85746 | SE server MariaDB | 9.9 | Oct 16 | MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections |
| CVE-2026-92262 | SE server MariaDB | 9.9 | Oct 16 | MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. |
| CVE-2026-57169 | DO dockhand Finsys | 9.6 | Oct 16 | Dockhand: Unauthenticated container exec via WebSocket upgrade |
| CVE-2026-44977 | CO countly-server Countly | 9.0 | Oct 16 | countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context |
| CVE-2026-105279 | DC dcm4chee-arc-light J4Care | 9.1 | Oct 16 | J4Care dcm4che Missing Authentication for Critical Function |
| CVE-2026-97851 | DC dcm4chee-arc-light J4Care | 9.1 | Oct 16 | J4Care dcm4che Missing Authorization |
| CVE-2026-107617 | EA EseeCloud App Guangzhou Juan IoT Technology Co., Ltd. | 9.8 | Oct 16 | Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials |
| CVE-2026-18516 | CC Crafty Controller Arcadia Technology, LLC | 9.6 | Oct 16 | Improper Encoding or Escaping of Output in Crafty Controller |
| CVE-2026-64959 | AK Apache Kylin Apache Software Foundation | 9.8 | Oct 16 | Apache Kylin: Missing authentication on certain cache API endpoints |
| CVE-2026-64610 | AK Apache Kylin Apache Software Foundation | 9.8 | Oct 16 | Apache Kylin: Redis unsafe Java deserialization |
| CVE-2026-63619 | AK Apache Kylin Apache Software Foundation | 9.1 | Oct 16 | Apache Kylin: Missing authorization and path-confinement on system meta dump |
| CVE-2026-111472 | PR Profleet TSG | 9.3 | Oct 16 | SQL injection in TSG Profleet |
| CVE-2026-94169 | TG The Grid Theme-one | 10.0 | Oct 16 | WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-94388 | GP Green Popups halfdata | 9.3 | Oct 16 | WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability |
| CVE-2026-104730 | SP Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers sunshinephotocart | 9.8 | Oct 16 | Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter |
| CVE-2026-103768 | EW ELEX WordPress HelpDesk & Customer Ticketing System elextensions | 9.8 | Oct 16 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment |
| CVE-2026-89079 | TM Theme My Login jfarthing84 | 9.8 | Oct 16 | Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter |
| CVE-2026-104798 | MC My Calendar – Accessible Event Manager joedolson | 9.8 | Oct 16 | My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute |
| CVE-2026-109515 | MP MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. properfraction | 9.8 | Oct 16 | MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter |
| CVE-2026-109219 | MB Mang Board kitae-park | 9.8 | Oct 16 | Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter |
| CVE-2026-111444 | WH Wheels Wheels | 9.8 | Oct 16 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to… |
| CVE-2026-111375 | FR FreeRDP FreeRDP | 9.1 | Oct 16 | FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title |
| CVE-2026-95182 | Product not mapped yet | 10.0 | Oct 16 | An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of… |
| CVE-2026-26846 | Product not mapped yet | 9.8 | Oct 16 | Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component |