CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 03:44 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-71542 | GE GetSimpleCMS-CE GetSimpleCMS-CE | 8.7 | Oct 1 | GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php |
| CVE-2026-71426 | GE GetSimpleCMS-CE GetSimpleCMS-CE | 7.1 | Oct 1 | GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field |
| CVE-2026-70650 | GE GetSimpleCMS-CE GetSimpleCMS-CE | 8.8 | Oct 1 | GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content |
| CVE-2026-56661 | GE GetSimpleCMS-CE GetSimpleCMS-CE | 7.5 | Oct 1 | GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint |
| CVE-2026-84682 | AA Archer AX90 v1 TP-Link Systems Inc. | 7.7 | Oct 1 | TDDPv2 setProductVer Command Injection in Archer AX90 |
| CVE-2026-55232 | VV Vvveb givanz | 7.6 | Oct 1 | Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy |
| CVE-2026-55230 | VV Vvveb givanz | 8.7 | Oct 1 | Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character |
| CVE-2026-55231 | VV Vvveb givanz | 7.2 | Oct 1 | Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools |
| CVE-2026-15911 | CO confluent-kafka confluent | 7.4 | Oct 1 | Confluent Kafka Python Improper TLS Certificate Validation |
| CVE-2026-104059 | LE lektor lektor | 8.1 | Oct 1 | Lektor 3.3.14 CSRF via Admin API Endpoints |
| CVE-2026-8618 | DM Deco M9 Plus V2 TP-Link Systems Inc. | 7.7 | Oct 1 | Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus |
| CVE-2026-104057 | PO podgrab akhilrex | 7.5 | Oct 1 | Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler |
| CVE-2026-102369 | TC Tapo C120 v1 TP-Link Systems Inc. | 8.7 | Oct 1 | Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200 |
| CVE-2026-78578 | TC Tapo C120 v1 TP-Link Systems Inc. | 7.1 | Oct 1 | Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200 |
| CVE-2026-9032 | TC Tapo C120 V1 TP-Link Systems Inc. | 7.1 | Oct 1 | Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200 |
| CVE-2026-68496 | JA jackson-dataformats-binary FasterXML | 7.5 | Oct 1 | jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service |
| CVE-2026-68495 | JA jackson-dataformats-binary FasterXML | 7.5 | Oct 1 | jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service |
| CVE-2026-104018 | V7 VxWorks 7 Wind River Systems Inc | 8.8 | Oct 1 | VxWorks 7 improper privilege management |
| CVE-2026-97662 | SE security-agent-mcp-server AWS | 8.2 | Oct 1 | Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace |
| CVE-2026-102294 | TV TL-WR841N v14 TP-Link System Inc. | 8.5 | Oct 1 | Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration |
| CVE-2026-12542 | RH Red Hat Satellite 6 Red Hat | 7.8 | Oct 1 | Foreman: command injection in foreman-tail |
| CVE-2026-73976 | DJ djehuty 4TUResearchData | 7.1 | Oct 1 | djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`) |
| CVE-2026-73975 | DJ djehuty 4TUResearchData | 8.4 | Oct 1 | djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples |
| CVE-2026-103921 | EX executor-legacy-ws @graphql-tools | 7.4 | Oct 1 | GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor |
| CVE-2026-96658 | RH Red Hat Satellite 6.16 for RHEL 8 Red Hat | 8.8 | Oct 1 | Foreman: foreman: arbitrary code execution via safemode sandbox bypass |
| CVE-2026-12544 | RH Red Hat Satellite 6 Red Hat | 7.7 | Oct 1 | Foreman: ssti and insecure deserialization in foreman-rake configuration |
| CVE-2026-12541 | RH Red Hat Satellite 6 Red Hat | 8.2 | Oct 1 | Foreman: command injection in foreman-rake database tasks |
| CVE-2026-12540 | RH Red Hat Satellite 6 Red Hat | 8.2 | Oct 1 | Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter |
| CVE-2026-12423 | RH Red Hat Satellite 6 Red Hat | 7.5 | Oct 1 | Foreman: unauthenticated information disclosure via provisioning token validation flaw |
| CVE-2026-12405 | RH Red Hat Satellite 6 Red Hat | 8.8 | Oct 1 | Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter |
| CVE-2026-63686 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_xml2enc crash on charset conversion failure |
| CVE-2026-101888 | PM Prime Mover Codexonics | 7.2 | Oct 1 | Prime Mover < 2.2.1 Zip Slip Path Traversal File Write |
| CVE-2026-93546 | HS HTTP Server Apache | 8.8 | Oct 1 | Apache HTTP Server: mod_dav_fs namespace overflow |
| CVE-2026-73637 | HS HTTP Server Apache | 7.3 | Oct 1 | Apache HTTP Server: mod_auth_digest DoS attack |
| CVE-2026-73636 | HS HTTP Server Apache | 8.1 | Oct 1 | Apache HTTP Server: mod_auth_digest one-time-nonce replay attack |
| CVE-2026-63718 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling |
| CVE-2026-14316 | CP Core Privileged Access Manager (BoKS) Fortra | 8.1 | Oct 1 | Heap buffer overflow in boks_sshd revoked-key error handling |
| CVE-2026-63292 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_vhost_alias stack overflow |
| CVE-2026-63045 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_proxy_ftp PASV address handling |
| CVE-2026-59685 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM |
| CVE-2026-13043 | ES Endpoint Security WatchGuard | 8.8 | Oct 1 | WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access |
| CVE-2026-56449 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_proxy_html: crash in dump_content |
| CVE-2026-56153 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char |
| CVE-2026-48005 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_auth_digest reauthentication attack |
| CVE-2026-47360 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_session: Session cookie not removed during internal redirect |
| CVE-2026-101322 | EB Eclipse BaSyx AAS Web UI Eclipse Foundation | 8.3 | Oct 1 | In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to… |
| CVE-2026-46729 | HS HTTP Server Apache | 7.5 | Oct 1 | Apache HTTP Server: mod_heartmonitor denial of service |
| CVE-2026-79896 | BM BoKS Manager Fortra | 7.5 | Oct 1 | Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability |
| CVE-2026-67105 | HB HCL BigFix Service Management HCL Software | 7.4 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-56589 | HB HCL BigFix Service Management HCL Software | 7.2 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |