CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 11:26 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-105048 | AT Attu Zilliz | 4.0 | Oct 2 | The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses) |
| CVE-2026-105046 | XP Xperience Kentico | 4.3 | Oct 2 | Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints |
| CVE-2026-94594 | AO Armatura One Armatura LLC | 4.0 | Oct 2 | Armatura LLC Armatura One Insertion of Sensitive Information into Log File |
| CVE-2026-93474 | MO monta.app Monta | 6.5 | Oct 2 | Monta monta.app Insufficiently Protected Credentials |
| CVE-2026-104055 | PO postgresql-operator Canonical | 5.3 | Oct 2 | Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm |
| CVE-2026-82045 | UT UTMStack UTMStack | 6.5 | Oct 2 | UTMStack < 11.2.16 JPQL Injection via searchPropertyValues |
| CVE-2026-104874 | MU multidict aio-libs | 5.3 | Oct 2 | Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction |
| CVE-2026-82043 | UT UTMStack UTMStack | 5.3 | Oct 2 | UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint |
| CVE-2026-103918 | OR orpc middleapi | 6.5 | Oct 2 | @orpc/zod: Prototype injection in smart coercion |
| CVE-2026-82040 | UT UTMStack UTMStack | 5.0 | Oct 2 | UTMStack < 11.2.16 SSRF via IdentityProviderService |
| CVE-2026-103036 | OR orpc middleapi | 6.5 | Oct 2 | @orpc/json-schema: Prototype injection in smart coercion |
| CVE-2026-104872 | IN instrumentation-cassandra-driver @opentelemetry | 5.8 | Oct 2 | Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute |
| CVE-2026-104871 | AN angular-cli angular | 6.3 | Oct 2 | Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows |
| CVE-2026-12392 | MA MAAS Canonical | 5.3 | Oct 2 | RPC secret disclosure via vendor data endpoint in Canonical MAAS |
| CVE-2026-103957 | LO loom AWS | 6.2 | Oct 2 | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS |
| CVE-2026-19856 | AI All in One SEO | 6.5 | Oct 2 | All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query |
| CVE-2026-104853 | NX nx nrwl | 5.8 | Oct 2 | Nx: Path traversal in nx migrate package-migrations extraction |
| CVE-2026-104914 | MI MISP MISP | 5.3 | Oct 2 | MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View |
| CVE-2026-103627 | CH Chrome Google | 6.5 | Oct 2 | Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page |
| CVE-2026-103629 | CH Chrome Google | 4.3 | Oct 2 | Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page |
| CVE-2026-103621 | CH Chrome Google | 4.3 | Oct 2 | Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page |
| CVE-2026-96613 | IC IoT Cloud Platform OpenAPI Service Meari | 6.5 | Oct 2 | Missing Authorization in Meari IoT Cloud Platform OpenAPI Service |
| CVE-2026-104910 | MI MISP MISP | 5.3 | Oct 2 | MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization |
| CVE-2026-104907 | MI MISP MISP | 4.8 | Oct 2 | MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler |
| CVE-2026-104906 | MI MISP MISP | 6.2 | Oct 2 | MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output |
| CVE-2026-104844 | PO postcss-selector-parser postcss | 5.9 | Oct 2 | PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion |
| CVE-2026-104843 | UV uv astral-sh | 5.9 | Oct 2 | uv: Path traversal on Windows through wheel extraction |
| CVE-2026-94484 | NE next.js vercel | 4.8 | Oct 2 | Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service |
| CVE-2026-94485 | NE next.js vercel | 5.3 | Oct 2 | Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass |
| CVE-2026-104901 | MI MISP MISP | 5.1 | Oct 2 | MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server |
| CVE-2026-94483 | NE next.js vercel | 6.5 | Oct 2 | Next.js: Server-Side Request Forgery in Image Optimization |
| CVE-2026-94543 | NE next.js vercel | 5.3 | Oct 2 | Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications |
| CVE-2026-104900 | MI MISP MISP | 5.3 | Oct 2 | MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index |
| CVE-2026-94544 | NE next.js vercel | 4.2 | Oct 2 | Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages |
| CVE-2026-94486 | NE next.js vercel | 5.4 | Oct 2 | Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint |
| CVE-2026-104638 | HO HospitalManagementSystem onetwothreeneth | 5.3 | Oct 2 | onetwothreeneth HospitalManagementSystem sessions.php improper authentication |
| CVE-2026-39717 | LE LearnPress ThimPress | 4.3 | Oct 2 | WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability |
| CVE-2026-39600 | AA Aculect AI Companion Mehul Gohil | 4.7 | Oct 2 | WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability |
| CVE-2026-39444 | PS PublishPress Series PublishPress | 5.4 | Oct 2 | WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39439 | WE WebSamurai Kiera Howe | 6.5 | Oct 2 | WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability |
| CVE-2026-32585 | AM Airano MCP Bridge airano | 6.5 | Oct 2 | WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability |
| CVE-2026-32584 | SO Smart One Click Setup – Complete Demo Import & Export Chiranjit Hazarika | 5.3 | Oct 2 | WordPress Smart One Click Setup – Complete Demo Import & Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability |
| CVE-2026-104625 | SL Simple Loan Management System CodeAstro | 6.3 | Oct 2 | CodeAstro Simple Loan Management System index.php sql injection |
| CVE-2026-5782 | TU TurkHotspot MRV Technology Foreign Trade Ltd. Co. | 5.2 | Oct 2 | Reflected XSS in MRV Technology's TurkHotspot |
| CVE-2026-104614 | SP Simple Pharmacy Management System CodeAstro | 6.3 | Oct 2 | CodeAstro Simple Pharmacy Management System delete.php sql injection |
| CVE-2026-104721 | LO Logback-classic QOS.CH Sarl | 6.3 | Oct 2 | Logback: Incomplete protection against CVE-2026-19880 |
| CVE-2026-104613 | SP Simple Pharmacy Management System CodeAstro | 6.3 | Oct 2 | CodeAstro Simple Pharmacy Management System view.php sql injection |
| CVE-2026-66054 | AT Apache Thrift Apache Software Foundation | 6.9 | Oct 2 | Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize |
| CVE-2026-104612 | SR Student Result Management System SourceCodester | 4.3 | Oct 2 | SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting |
| CVE-2026-11795 | EP E-Commerce Pack Softtr Informatics Trading Limited Company | 5.3 | Oct 2 | User Enumeration in Softtr's E-Commerce Pack |