CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 17:52 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-8937 | GI GitLab GitLab | 4.3 | Sep 29 | Missing Authorization in GitLab |
| CVE-2026-10518 | GI GitLab GitLab | 4.3 | Sep 29 | Incorrect Authorization in GitLab |
| CVE-2026-8067 | RS RTU500 series CMU firmware Hitachi Energy | 6.5 | Sep 29 | An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset… |
| CVE-2026-95391 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Use After Free in Wireshark |
| CVE-2026-95386 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark |
| CVE-2026-95390 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | NULL Pointer Dereference in Wireshark |
| CVE-2026-95395 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Missing Release of Memory after Effective Lifetime in Wireshark |
| CVE-2026-95394 | WI Wireshark Wireshark Foundation | 4.7 | Sep 29 | Unchecked Input for Loop Condition in Wireshark |
| CVE-2026-95393 | WI Wireshark Wireshark Foundation | 4.7 | Sep 29 | Heap-based Buffer Overflow in Wireshark |
| CVE-2026-95392 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Buffer Over-read in Wireshark |
| CVE-2026-95388 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Heap-based Buffer Overflow in Wireshark |
| CVE-2026-96422 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Reachable Assertion in Wireshark |
| CVE-2026-96421 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Improperly Controlled Sequential Memory Allocation in Wireshark |
| CVE-2026-96417 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Heap-based Buffer Overflow in Wireshark |
| CVE-2026-96418 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark |
| CVE-2026-96420 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Buffer Over-read in Wireshark |
| CVE-2026-96416 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Heap-based Buffer Overflow in Wireshark |
| CVE-2026-96415 | WI Wireshark Wireshark Foundation | 5.5 | Sep 29 | Stack-based Buffer Overflow in Wireshark |
| CVE-2026-102474 | RH Red Hat Enterprise Linux 6 Red Hat | 4.0 | Sep 29 | Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation |
| CVE-2026-102473 | RH Red Hat Enterprise Linux 6 Red Hat | 5.5 | Sep 29 | Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled |
| CVE-2026-91085 | AK Apache Karaf Apache Software Foundation | 6.3 | Sep 29 | Apache Karaf: config:install missing ACL entry allows privilege escalation to admin |
| CVE-2026-86157 | PT Progress® Telerik® Fiddler® Everywhere Progress Software | 5.6 | Sep 29 | Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere |
| CVE-2026-102292 | MA MateisHomePage-Website coolbeans1212 | 4.3 | Sep 29 | coolbeans1212 MateisHomePage-Website users.php cross site scripting |
| CVE-2026-102263 | RO robo-cafe-rms mwasikz | 4.7 | Sep 29 | mwasikz robo-cafe-rms manage-food.php unrestricted upload |
| CVE-2026-102261 | CC Camaleon CMS owen2345 | 5.4 | Sep 29 | owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization |
| CVE-2026-97029 | RH Red Hat Enterprise Linux 10 Red Hat | 5.7 | Sep 29 | Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group |
| CVE-2026-102247 | FA FastAdmin Fastadmin | 6.8 | Sep 29 | FastAdmin Database Management database.php unnecessary privileges |
| CVE-2026-102244 | SU SurfSense MODSetter | 4.3 | Sep 29 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery |
| CVE-2026-101859 | RA raspap-webgui RaspAP | 5.4 | Sep 29 | RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection |
| CVE-2026-101858 | RA raspap-webgui RaspAP | 4.7 | Sep 29 | RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection |
| CVE-2026-102374 | GE GestSup GestSup | 6.1 | Sep 29 | GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector |
| CVE-2026-102373 | GE GestSup GestSup | 6.5 | Sep 29 | GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter |
| CVE-2026-102372 | GE GestSup GestSup | 6.1 | Sep 29 | GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector |
| CVE-2026-101279 | OP OpenDMARC Trusted Domain Project | 6.5 | Sep 29 | Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow |
| CVE-2026-101278 | OP OpenDMARC Trusted Domain Project | 4.3 | Sep 29 | Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation |
| CVE-2026-79535 | Product not mapped yet | 6.3 | Sep 29 | mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection |
| CVE-2026-79534 | Product not mapped yet | 5.9 | Sep 29 | mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helper.go) |
| CVE-2024-31027 | Product not mapped yet | 5.4 | Sep 29 | Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first… |
| CVE-2026-79417 | Product not mapped yet | 5.3 | Sep 29 | Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a… |
| CVE-2026-79348 | Product not mapped yet | 4.3 | Sep 29 | KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API |
| CVE-2026-101277 | OP OpenDKIM Trusted Domain Project | 6.5 | Sep 28 | Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source |
| CVE-2026-102367 | MA mall4j gz-yami | 5.4 | Sep 28 | mall4j through 4.0 Insufficient Session Expiration via Token Refresh |
| CVE-2026-102366 | MA mall4j gz-yami | 4.4 | Sep 28 | mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints |
| CVE-2026-102365 | MA mall4j gz-yami | 6.5 | Sep 28 | mall4j through 4.0 Missing Authorization in Admin User Address Endpoints |
| CVE-2026-102364 | MA mall4j gz-yami | 5.4 | Sep 28 | mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API |
| CVE-2026-102362 | MA mall4j gz-yami | 5.3 | Sep 28 | mall4j through 4.0 Missing Authentication in Product Review Deletion |
| CVE-2026-18747 | ZE zephyr zephyrproject | 6.8 | Sep 28 | Integer underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read |
| CVE-2026-18746 | ZE zephyr zephyrproject | 5.9 | Sep 28 | NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted |
| CVE-2026-18417 | ZE zephyr zephyrproject | 6.5 | Sep 28 | Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error |
| CVE-2026-102333 | HT httpdbg cle-b | 6.1 | Sep 28 | httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL |