CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 00:06 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92994 | VP Verge3D Publishing and E-Commerce | 8.8 | Sep 30 | Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API |
| CVE-2026-91832 | WM WP Mobile Menu | 7.1 | Sep 30 | WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF |
| CVE-2026-89193 | RI Robin Image Optimizer | 7.5 | Sep 30 | Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser |
| CVE-2026-88797 | VX Vayu X | 7.1 | Sep 30 | Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation |
| CVE-2026-85573 | AI All in One Files Upload | 8.8 | Sep 30 | All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload |
| CVE-2026-75823 | UF User Frontend | 7.4 | Sep 30 | WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption |
| CVE-2026-102913 | CD Car Driving School Management System SourceCodester | 7.3 | Sep 30 | SourceCodester Car Driving School Management System Master.php save_enrollment sql injection |
| CVE-2026-103111 | PC PCRE2 PCRE | 7.6 | Sep 30 | PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data |
| CVE-2026-86134 | FO Fireware OS WatchGuard | 7.5 | Sep 30 | Fireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service |
| CVE-2026-102910 | OR Online Reviewer Management System SourceCodester | 7.3 | Sep 30 | SourceCodester Online Reviewer Management System exam-delete.php sql injection |
| CVE-2026-102909 | OR Online Reviewer Management System SourceCodester | 7.3 | Sep 30 | SourceCodester Online Reviewer Management System btn_functions.php sql injection |
| CVE-2026-103108 | IN Infinity Pexip | 7.5 | Sep 30 | Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software… |
| CVE-2026-103106 | IN Infinity Pexip | 7.8 | Sep 30 | Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access… |
| CVE-2026-102908 | OR Online Reviewer Management System SourceCodester | 7.3 | Sep 30 | SourceCodester Online Reviewer Management System questions-view.php sql injection |
| CVE-2026-103105 | IN Infinity Pexip | 8.8 | Sep 30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within… |
| CVE-2026-103104 | IN Infinity Pexip | 7.5 | Sep 30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software… |
| CVE-2026-103102 | IN Infinity Pexip | 8.6 | Sep 30 | Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a… |
| CVE-2026-96649 | FP Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms wpshuffle | 7.2 | Sep 30 | Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) |
| CVE-2026-103101 | IN Infinity Pexip | 7.5 | Sep 30 | Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node… |
| CVE-2026-103100 | IN Infinity Pexip | 7.5 | Sep 30 | Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting in a… |
| CVE-2026-102874 | AN AnyTool HKUDS | 7.3 | Sep 30 | HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection |
| CVE-2026-103099 | IN Infinity Pexip | 7.5 | Sep 30 | Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of… |
| CVE-2026-103088 | HA handlebars.java jknack | 7.5 | Sep 30 | Handlebars.java before 4.5.5 allows directory traversal |
| CVE-2026-103087 | GO gosub-engine gosub-io | 7.1 | Sep 30 | Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (stack… |
| CVE-2026-103055 | AI AiSOC beenuar | 7.5 | Sep 30 | AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret |
| CVE-2026-103054 | AI AiSOC beenuar | 7.1 | Sep 30 | AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP |
| CVE-2026-51570 | Product not mapped yet | 8.1 | Sep 30 | modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file |
| CVE-2026-51568 | Product not mapped yet | 8.1 | Sep 30 | modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file |
| CVE-2026-51853 | Product not mapped yet | 7.5 | Sep 30 | agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__ |
| CVE-2026-51852 | Product not mapped yet | 7.5 | Sep 30 | agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64 |
| CVE-2026-51860 | Product not mapped yet | 7.5 | Sep 30 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py |
| CVE-2026-86104 | FO Fireware OS WatchGuard | 7.5 | Sep 29 | Fireware OS Resource Exhaustion in Login Process Allows Denial of Service |
| CVE-2026-18145 | FO Fireware OS WatchGuard | 7.2 | Sep 29 | Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution |
| CVE-2026-13046 | FO Fireware OS WatchGuard | 7.2 | Sep 29 | Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution |
| CVE-2026-86133 | FO Fireware OS WatchGuard | 7.5 | Sep 29 | Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service |
| CVE-2026-90441 | FO Fireware OS WatchGuard | 8.1 | Sep 29 | Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B |
| CVE-2026-86105 | FO Fireware OS WatchGuard | 7.1 | Sep 29 | Fireware OS Improper Authorization in Access Portal Reverse Proxy |
| CVE-2026-86136 | FO Fireware OS WatchGuard | 8.1 | Sep 29 | Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A |
| CVE-2026-86132 | FO Fireware OS WatchGuard | 7.5 | Sep 29 | Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service |
| CVE-2026-86128 | FO Fireware OS WatchGuard | 7.5 | Sep 29 | Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service |
| CVE-2026-81433 | FO Fireware OS WatchGuard | 8.7 | Sep 29 | Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution |
| CVE-2026-103043 | AN anchorme alexcorvi | 7.5 | Sep 29 | anchorme through 3.0.8 Regular Expression Denial of Service |
| CVE-2026-103042 | LI LightLLM ModelTC | 7.5 | Sep 29 | LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value |
| CVE-2026-71302 | TM TMS7 Toptech Systems | 7.1 | Sep 29 | Toptech TMS7 and TopHAT Session Fixation |
| CVE-2026-74225 | UB u-boot u-boot | 7.1 | Sep 29 | U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6 |
| CVE-2026-74222 | UB u-boot u-boot | 8.2 | Sep 29 | U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback |
| CVE-2026-74221 | UB u-boot u-boot | 8.2 | Sep 29 | U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK |
| CVE-2026-74220 | UB u-boot u-boot | 8.2 | Sep 29 | U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply |
| CVE-2026-71971 | UB u-boot u-boot | 8.2 | Sep 29 | U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly |
| CVE-2026-91191 | GS G520 Series Lantronix | 7.5 | Sep 29 | Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature |