CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 11:26 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-117472 New | PS Psono esaqa GmbH | 4.3 | Oct 27 | URL prefix handling permits API key read-scope bypass in Psono Server |
| CVE-2026-117471 New | PS Psono esaqa GmbH | 5.4 | Oct 27 | User-controlled Duo host permits authenticated SSRF in Psono Server |
| CVE-2026-117470 New | PS Psono esaqa GmbH | 6.5 | Oct 27 | WebAuthn assertion replay permits second-factor bypass in Psono Server |
| CVE-2026-117469 New | PS Psono esaqa GmbH | 5.4 | Oct 27 | File-transfer type confusion permits unauthorized repository writes in Psono Server |
| CVE-2026-117468 New | PS Psono esaqa GmbH | 6.5 | Oct 27 | Device-code claim permits restricted token escalation in Psono Server |
| CVE-2026-88781 New | MF motherboards firmware ASUS | 6.8 | Oct 27 | Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to… |
| CVE-2026-116844 New | FT ftpserverlib fclairamb | 4.8 | Oct 27 | Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P |
| CVE-2026-116842 New | DE DevilutionX diasurgical | 6.1 | Oct 27 | DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup |
| CVE-2026-116841 New | DE DevilutionX diasurgical | 5.5 | Oct 27 | DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup |
| CVE-2026-116840 New | LL llama.cpp ggml-org | 6.1 | Oct 27 | llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader |
| CVE-2026-116829 New | LL llama.cpp ggml-org | 6.6 | Oct 27 | llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader |
| CVE-2025-71439 New | LL llama.cpp ggml-org | 5.5 | Oct 27 | llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info |
| CVE-2024-58399 New | LL llama.cpp ggml-org | 6.1 | Oct 27 | llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets |
| CVE-2026-116608 New | VI VideoLLaMA2 DAMO Academy | 5.4 | Oct 27 | DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check |
| CVE-2026-116605 New | OF Online Food Ordering System SourceCodester | 5.3 | Oct 27 | SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security |
| CVE-2026-116604 New | OF Online Food Ordering System SourceCodester | 6.5 | Oct 26 | SourceCodester Online Food Ordering System delete_admin.php missing authentication |
| CVE-2026-116603 New | OF Online Food Ordering System SourceCodester | 4.7 | Oct 26 | SourceCodester Online Food Ordering System add_food.php unrestricted upload |
| CVE-2026-116828 New | YE yeswiki YesWiki | 4.9 | Oct 26 | YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand |
| CVE-2026-116827 New | YE yeswiki YesWiki | 6.8 | Oct 26 | YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import |
| CVE-2026-116826 New | YE yeswiki YesWiki | 6.8 | Oct 26 | YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile |
| CVE-2026-116825 New | YE yeswiki YesWiki | 6.5 | Oct 26 | YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox |
| CVE-2026-116824 New | YE yeswiki YesWiki | 6.1 | Oct 26 | YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler |
| CVE-2026-116823 New | YE yeswiki YesWiki | 6.1 | Oct 26 | YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback |
| CVE-2026-116822 New | YE yeswiki YesWiki | 5.3 | Oct 26 | YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter |
| CVE-2026-116821 New | YE yeswiki YesWiki | 6.5 | Oct 26 | YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames |
| CVE-2026-116820 New | YE yeswiki YesWiki | 5.3 | Oct 26 | YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter |
| CVE-2026-116817 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board |
| CVE-2026-116815 New | OP openpanel Openpanel-dev | 4.3 | Oct 26 | OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts |
| CVE-2026-116814 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs |
| CVE-2026-116813 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts |
| CVE-2026-116812 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter |
| CVE-2026-116810 New | OP openpanel Openpanel-dev | 5.3 | Oct 26 | OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences |
| CVE-2026-116809 New | OP openpanel Openpanel-dev | 5.3 | Oct 26 | OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure |
| CVE-2026-116807 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query |
| CVE-2026-116806 New | OP openpanel Openpanel-dev | 5.4 | Oct 26 | OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation |
| CVE-2026-116805 New | OP openpanel Openpanel-dev | 4.3 | Oct 26 | OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list |
| CVE-2026-116804 New | DO DOMPurify cure53 | 6.1 | Oct 26 | DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content |
| CVE-2026-116803 New | DO DOMPurify cure53 | 6.1 | Oct 26 | DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees |
| CVE-2026-116802 New | DO DOMPurify cure53 | 6.1 | Oct 26 | DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode |
| CVE-2026-116801 New | PA parse-server parse-community | 4.3 | Oct 26 | Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query |
| CVE-2026-116800 New | AV AVideo WWBN | 6.2 | Oct 26 | WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header |
| CVE-2026-116602 New | OF Online Food Ordering System SourceCodester | 6.5 | Oct 26 | SourceCodester Online Food Ordering System delete.php unlink path traversal |
| CVE-2026-2270 New | KU Kubernetes Kubernetes | 5.9 | Oct 26 | StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation |
| CVE-2026-76654 New | KU Kubernetes Kubernetes | 5.8 | Oct 26 | Subpath symlinking on Windows nodes permits NTLM coercion |
| CVE-2026-116515 New | OB Online Book Store itsourcecode | 6.3 | Oct 26 | itsourcecode Online Book Store book.php sql injection |
| CVE-2026-116746 New | QL qloapps qloapps | 5.3 | Oct 26 | QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview |
| CVE-2026-116745 New | QL qloapps qloapps | 6.5 | Oct 26 | QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation |
| CVE-2026-116744 New | ND nDPI ntop | 5.3 | Oct 26 | ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector |
| CVE-2026-116743 New | LI libmsiecf libyal | 5.5 | Oct 26 | libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data |
| CVE-2026-116742 New | HT htslib samtools | 4.4 | Oct 26 | HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count |