CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 09:48 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-66331 | AT Apache Thrift Apache Software Foundation | 6.9 | Oct 2 | Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize |
| CVE-2026-85209 | LM Learning Management System (LMS) AVEZ Electronics Communication Training and Consultancy Trade Inc. | 6.5 | Oct 2 | IDOR in AVEZ Electronics's LMS |
| CVE-2026-94652 | AT Apache Thrift Apache Software Foundation | 6.3 | Oct 2 | Apache Thrift: C++ `TEvhttpServer` leaks its `RequestContext` when the processor throws before calling back |
| CVE-2026-94638 | AT Apache Thrift Apache Software Foundation | 6.3 | Oct 2 | Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize` |
| CVE-2026-92834 | AT Apache Thrift Apache Software Foundation | 6.3 | Oct 2 | Apache Thrift: C++ WebSocket server transport does not read a full request length |
| CVE-2026-86536 | AT Apache Thrift Apache Software Foundation | 6.3 | Oct 2 | Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript |
| CVE-2026-104473 | YE yeswiki YesWiki | 6.1 | Oct 2 | YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages |
| CVE-2026-104470 | YE yeswiki YesWiki | 5.0 | Oct 2 | YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter |
| CVE-2026-104469 | YE yeswiki YesWiki | 6.8 | Oct 2 | YesWiki before 4.6.7 Session Fixation via Login in AuthController.php |
| CVE-2026-104468 | YE yeswiki YesWiki | 4.8 | Oct 2 | YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction |
| CVE-2026-104466 | YE yeswiki YesWiki | 5.4 | Oct 2 | YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute |
| CVE-2026-104465 | YE yeswiki YesWiki | 6.1 | Oct 2 | YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler |
| CVE-2026-104461 | YE yeswiki YesWiki | 5.4 | Oct 2 | YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField |
| CVE-2026-104459 | YE yeswiki YesWiki | 6.5 | Oct 2 | YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle |
| CVE-2026-104458 | YE yeswiki YesWiki | 6.5 | Oct 2 | YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses |
| CVE-2026-104455 | YE yeswiki YesWiki | 5.3 | Oct 2 | YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action |
| CVE-2026-104454 | YE yeswiki YesWiki | 5.3 | Oct 2 | YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint |
| CVE-2026-104453 | YE yeswiki YesWiki | 5.4 | Oct 2 | YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action |
| CVE-2026-104452 | YE yeswiki YesWiki | 5.4 | Oct 2 | YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler |
| CVE-2026-104451 | YE yeswiki YesWiki | 4.3 | Oct 2 | YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler |
| CVE-2026-104450 | YE yeswiki YesWiki | 6.5 | Oct 2 | YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action |
| CVE-2026-104449 | YE yeswiki YesWiki | 6.5 | Oct 2 | YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche |
| CVE-2026-104446 | YE yeswiki YesWiki | 6.5 | Oct 2 | YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler |
| CVE-2026-104442 | YE yeswiki YesWiki | 5.8 | Oct 2 | YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action |
| CVE-2026-104441 | YE yeswiki YesWiki | 5.3 | Oct 2 | YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action |
| CVE-2026-104440 | YE yeswiki YesWiki | 5.3 | Oct 2 | YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter |
| CVE-2026-104439 | YE yeswiki YesWiki | 5.3 | Oct 2 | YesWiki before 4.6.7 User Enumeration via Lost-Password Flow |
| CVE-2026-104438 | YE yeswiki YesWiki | 5.3 | Oct 2 | YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions |
| CVE-2026-104434 | ZE zebra ZcashFoundation | 6.5 | Oct 2 | Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC |
| CVE-2026-104432 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response |
| CVE-2026-104429 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages |
| CVE-2026-104428 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 |
| CVE-2026-104427 | ZE zebra ZcashFoundation | 5.9 | Oct 2 | Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry |
| CVE-2026-104426 | ZE zebra ZcashFoundation | 5.9 | Oct 2 | Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check |
| CVE-2026-104425 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions |
| CVE-2026-104421 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout |
| CVE-2026-104420 | ZE zebra ZcashFoundation | 5.3 | Oct 2 | Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks |
| CVE-2026-104419 | ZE zebra ZcashFoundation | 4.8 | Oct 2 | Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes |
| CVE-2026-104417 | GH Ghost TryGhost | 4.9 | Oct 2 | Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting |
| CVE-2026-104412 | GH Ghost TryGhost | 4.3 | Oct 2 | Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment |
| CVE-2026-103763 | SI siyuan siyuan-note | 5.8 | Oct 2 | SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo |
| CVE-2026-103762 | SI siyuan siyuan-note | 5.3 | Oct 2 | SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints |
| CVE-2026-85088 | AT Apache Thrift Apache Software Foundation | 6.9 | Oct 2 | Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match |
| CVE-2026-85087 | AT Apache Thrift Apache Software Foundation | 6.9 | Oct 2 | Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op |
| CVE-2026-85086 | AT Apache Thrift Apache Software Foundation | 6.9 | Oct 2 | Apache Thrift: Perl TLS client disables certificate verification by default |
| CVE-2026-85483 | AT Apache Thrift Apache Software Foundation | 6.3 | Oct 2 | Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end |
| CVE-2026-97876 | GR grub2 GNU | 6.4 | Oct 2 | Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address |
| CVE-2026-104606 | OA Online Admission System Project itsourcecode | 6.3 | Oct 2 | itsourcecode Online Admission System Project confirm.php sql injection |
| CVE-2026-59668 | RA Repasat application Repasat | 4.8 | Oct 2 | Multiple vulnerabilities in the Repasat application |
| CVE-2026-59667 | RA Repasat application Repasat | 4.8 | Oct 2 | Multiple vulnerabilities in the Repasat application |