CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 23:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104182 | ST stream-json uhop | 6.2 | Oct 1 | stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk |
| CVE-2026-104181 | FI filament filamentphp | 5.4 | Oct 1 | Filament: Multi-factor authentication (app) management actions do not require password reauthentication |
| CVE-2026-55394 | AW Aware2 Teledyne FLIR | 5.3 | Oct 1 | Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2 |
| CVE-2026-55252 | OP openrun openrundev | 5.1 | Oct 1 | OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect |
| CVE-2026-55251 | DE devicetype-library netbox-community | 6.5 | Oct 1 | NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files |
| CVE-2026-100251 | WO Wormhole Wormhole App | 6.5 | Oct 1 | Wormhole.app SSRF |
| CVE-2026-93832 | SA Setup App Motorola | 4.4 | Oct 1 | A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps |
| CVE-2026-102671 | JO Joyland.ai Joyland | 5.3 | Oct 1 | Joyland AI WebView accepts invalid SSL certificates |
| CVE-2026-102670 | JO Joyland.ai Joyland | 4.3 | Oct 1 | Joyland AI enables HTTP |
| CVE-2026-102669 | JO Joyland.ai Joyland | 5.3 | Oct 1 | Joyland AI hostname checking disabled |
| CVE-2026-102668 | JO Joyland.ai Joyland | 5.3 | Oct 1 | Joyland AI accepts TLS certificates without validation |
| CVE-2026-82358 | CO C-Open RT-Labs AB | 6.5 | Oct 1 | RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass |
| CVE-2026-102666 | JO Joyland.ai Joyland | 6.5 | Oct 1 | Joyland AI hard-coded credentials for push notifications |
| CVE-2026-82357 | CO C-Open RT-Labs AB | 6.5 | Oct 1 | RT-Labs AB C-Open CANopen NULL pointer dereference |
| CVE-2026-27872 | EI Easy IO FG Johnson Controls | 5.6 | Oct 1 | - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force) |
| CVE-2026-104058 | PO podgrab akhilrex | 5.3 | Oct 1 | Podgrab Missing Authentication on WebSocket /ws Endpoint |
| CVE-2026-78577 | TC Tapo C120 v1 TP-Link Systems Inc. | 5.3 | Oct 1 | Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200 |
| CVE-2026-103884 | RH Red Hat Build of Keycloak Red Hat | 6.5 | Oct 1 | Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read |
| CVE-2026-56098 | RH Red Hat Satellite 6 Red Hat | 4.3 | Oct 1 | Rubygem-katello: improper authorization logic allows resource enumeration |
| CVE-2026-56097 | RH Red Hat Satellite 6 Red Hat | 6.5 | Oct 1 | Rubygem-katello: sql injection in registry proxy via labels |
| CVE-2026-12545 | RH Red Hat Satellite 6 Red Hat | 6.7 | Oct 1 | Rubygem-hammer_cli: command injection via insecure editor invocation |
| CVE-2026-77387 | GE geopy geopy | 4.0 | Oct 1 | geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point |
| CVE-2026-101890 | PM Prime Mover Codexonics | 5.4 | Oct 1 | Prime Mover < 2.2.1 Stored XSS via Package Metadata |
| CVE-2026-101889 | PM Prime Mover Codexonics | 6.5 | Oct 1 | Prime Mover < 2.2.1 Path Traversal via wprime-config.json |
| CVE-2026-79768 | HS HTTP Server Apache | 5.3 | Oct 1 | Apache HTTP Server: mod_userdir information disclosure |
| CVE-2025-31980 | HB HCL BigFix Service Management HCL Software | 4.3 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-67171 | HB HCL BigFix Service Management HCL Software | 5.3 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-58415 | HS HTTP Server Apache | 5.3 | Oct 1 | Apache HTTP Server: mod_dav_fs property database read access |
| CVE-2026-9864 | CP Core Privileged Access Manager (BoKS) Fortra | 4.8 | Oct 1 | Fortra BoKS Server Agent adjoin machine-account password generation vulnerability |
| CVE-2026-103690 | LM Leave Management System itsourcecode | 6.3 | Oct 1 | itsourcecode Leave Management System controller.php sql injection |
| CVE-2026-42528 | HS HTTP Server Apache | 4.3 | Oct 1 | Apache HTTP Server: mod_dav shared lock overflow |
| CVE-2026-103505 | AW aws-efs-csi-driver AWS | 6.5 | Oct 1 | AWS EFS CSI Driver Mount Option Injection via mounttargetipmap |
| CVE-2026-17053 | ZE zephyr zephyrproject | 4.4 | Oct 1 | SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state |
| CVE-2026-67106 | HB HCL BigFix Service Management HCL Software | 5.3 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-67104 | HB HCL BigFix Service Management HCL Software | 5.3 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-97280 | RS Review Schema Mamunur Rashid | 6.5 | Oct 1 | WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability |
| CVE-2026-103004 | NE next.js vercel | 5.3 | Oct 1 | next.js cache leak on warm `use cache` handlers accessing root param |
| CVE-2026-103347 | HF hCaptcha for WP hcaptcha | 5.3 | Oct 1 | WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability |
| CVE-2026-97281 | WP WP Project Manager weDevs | 6.3 | Oct 1 | WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability |
| CVE-2026-97269 | WP WPFunnels WPFunnels | 6.5 | Oct 1 | WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-97258 | AM Aruba Migration Tool Aruba.it | 6.5 | Oct 1 | WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability |
| CVE-2026-97251 | BT Bus Ticket Booking with Seat Reservation magepeopleteam | 6.5 | Oct 1 | WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-79900 | BM BoKS Manager boks-server Fortra | 6.5 | Oct 1 | Heap overflow in KSL checksum initialization |
| CVE-2026-66247 | IC iControl HCL Software | 4.3 | Oct 1 | iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included… |
| CVE-2026-102505 | IM Imager Tonycoz | 6.3 | Oct 1 | Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp |
| CVE-2026-62058 | CA CF7 Apps WPExperts | 5.3 | Oct 1 | WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability |
| CVE-2026-62061 | PR ProfileGrid Metagauss | 5.3 | Oct 1 | WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-62063 | WP WpTravelly Magepeople inc. | 5.4 | Oct 1 | WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability |
| CVE-2026-102394 | EA Essential Addons for Elementor WPDeveloper | 6.5 | Oct 1 | WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-103339 | ME Metform Wpmet | 6.5 | Oct 1 | WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability |