CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 08:02 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117537 New | CO core redaxo | 4.1 | Oct 27 | REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter |
| CVE-2026-117535 New | CO core redaxo | 6.1 | Oct 27 | REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool |
| CVE-2026-117534 New | CO core redaxo | 5.4 | Oct 27 | REDAXO before 5.21.3 CSRF in Article History Plugin |
| CVE-2026-117533 New | CO core redaxo | 4.4 | Oct 27 | REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads |
| CVE-2026-116900 New | CO core redaxo | 5.4 | Oct 27 | REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets |
| CVE-2026-116899 New | CO core redaxo | 6.5 | Oct 27 | REDAXO before 5.21.4 Broken Access Control in Slice Operations |
| CVE-2026-116897 New | CO core redaxo | 6.5 | Oct 27 | REDAXO before 5.21.4 Missing Authorization in Version and History Previews |
| CVE-2026-116895 New | CO core redaxo | 5.4 | Oct 27 | REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter |
| CVE-2026-116894 New | CO core redaxo | 4.2 | Oct 27 | REDAXO before 5.21.5 Insufficient Session Expiration on Password Change |
| CVE-2026-116893 New | CO core redaxo | 6.8 | Oct 27 | REDAXO core before 5.21.5 Missing Authorization in rex_api_package API |
| CVE-2026-116892 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile |
| CVE-2026-116891 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate |
| CVE-2026-116889 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property |
| CVE-2026-116888 New | SE SemanticMediaWiki SemanticMediaWiki | 5.4 | Oct 27 | SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading |
| CVE-2026-116887 New | SE SemanticMediaWiki SemanticMediaWiki | 5.4 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property |
| CVE-2026-116886 New | SE SemanticMediaWiki SemanticMediaWiki | 5.4 | Oct 27 | Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse |
| CVE-2026-116885 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter |
| CVE-2026-116884 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes |
| CVE-2026-116883 New | SE SemanticMediaWiki SemanticMediaWiki | 4.8 | Oct 27 | Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions |
| CVE-2026-116882 New | SE SemanticMediaWiki SemanticMediaWiki | 4.8 | Oct 27 | Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels |
| CVE-2026-116881 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete |
| CVE-2026-116879 New | SE SemanticMediaWiki SemanticMediaWiki | 5.4 | Oct 27 | Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task |
| CVE-2026-116877 New | SE SemanticMediaWiki SemanticMediaWiki | 6.5 | Oct 27 | Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event |
| CVE-2026-116875 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters |
| CVE-2026-116874 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter |
| CVE-2026-117530 New | JC Junie CLI JetBrains | 6.7 | Oct 27 | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands |
| CVE-2026-111548 New | NW NPort W2150A-W4/W2250A-W4 Series Moxa | 5.3 | Oct 27 | A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers |
| CVE-2026-107147 New | TW twofactor_gauthenticator alexandregz | 6.3 | Oct 27 | Authentication bypass by spoofing in twofactor_gauthenticator |
| CVE-2026-107146 New | TW twofactor_gauthenticator alexandregz | 6.3 | Oct 27 | Insufficient session expiration in twofactor_gauthenticator |
| CVE-2026-107145 New | TW twofactor_gauthenticator alexandregz | 6.3 | Oct 27 | Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator |
| CVE-2026-102787 New | PD Phoca Download extension for Joomla phoca.cz | 5.3 | Oct 27 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 |
| CVE-2026-65213 New | MB MBD-X12SPI SMCI | 6.6 | Oct 27 | Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability |
| CVE-2026-65210 New | MB MBD-X12SPI SMCI | 4.9 | Oct 27 | Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability |
| CVE-2026-10511 New | JX Jupiter X Core artbees | 6.4 | Oct 27 | Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter |
| CVE-2026-107472 New | QT Qt qt | 4.3 | Oct 27 | Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt |
| CVE-2026-101034 New | SG Symantec Ghost Solution Suite Broadcom | 6.8 | Oct 27 | Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials |
| CVE-2026-105946 New | QT qt qt | 5.3 | Oct 27 | Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt |
| CVE-2026-103359 New | PW PayDunya WooCommerce Payment Gateway | 5.3 | Oct 27 | PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery |
| CVE-2026-103312 New | PI Payment Integration Wompi | 5.3 | Oct 27 | Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback |
| CVE-2026-103332 New | PP Payex Payment Gateway for Woocommerce | 5.3 | Oct 27 | Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key |
| CVE-2026-117472 New | PS Psono esaqa GmbH | 4.3 | Oct 27 | URL prefix handling permits API key read-scope bypass in Psono Server |
| CVE-2026-117471 New | PS Psono esaqa GmbH | 5.4 | Oct 27 | User-controlled Duo host permits authenticated SSRF in Psono Server |
| CVE-2026-117470 New | PS Psono esaqa GmbH | 6.5 | Oct 27 | WebAuthn assertion replay permits second-factor bypass in Psono Server |
| CVE-2026-117469 New | PS Psono esaqa GmbH | 5.4 | Oct 27 | File-transfer type confusion permits unauthorized repository writes in Psono Server |
| CVE-2026-117468 New | PS Psono esaqa GmbH | 6.5 | Oct 27 | Device-code claim permits restricted token escalation in Psono Server |
| CVE-2026-88781 New | MF motherboards firmware ASUS | 6.8 | Oct 27 | Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to… |
| CVE-2026-116844 New | FT ftpserverlib fclairamb | 4.8 | Oct 27 | Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P |
| CVE-2026-116842 New | DE DevilutionX diasurgical | 6.1 | Oct 27 | DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup |
| CVE-2026-116841 New | DE DevilutionX diasurgical | 5.5 | Oct 27 | DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup |
| CVE-2026-116840 New | LL llama.cpp ggml-org | 6.1 | Oct 27 | llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader |