CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 01:44 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-104994 | TR Trivy aquasec | 2.5 | Oct 2 | Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root |
| CVE-2026-104855 | WA wasmtime bytecodealliance | 2.0 | Oct 2 | Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state |
| CVE-2026-39601 | BC Booking Calendar WPdevelop | 3.7 | Oct 2 | WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability |
| CVE-2026-104436 | ZE zebra ZcashFoundation | 3.7 | Oct 2 | Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length |
| CVE-2026-104424 | ZE zebra ZcashFoundation | 3.7 | Oct 2 | Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate |
| CVE-2026-104415 | GH Ghost TryGhost | 3.1 | Oct 2 | Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API |
| CVE-2026-102002 | OB Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE themeisle | 3.1 | Oct 2 | Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget |
| CVE-2026-91023 | MO Motors | 3.1 | Oct 2 | Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured |
| CVE-2026-103923 | KA KaTeX KaTeX | 2.1 | Oct 1 | KaTeX: Existing prototype pollution can bypass trust restrictions |
| CVE-2026-21833 | AI AION HCL Software | 3.7 | Oct 1 | HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833) |
| CVE-2026-67172 | HB HCL BigFix Service Management HCL Software | 3.7 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-42356 | HS HTTP Server Apache | 3.7 | Oct 1 | Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories |
| CVE-2026-56599 | HB HCL BigFix Service Management HCL Software | 2.2 | Oct 1 | HCL BigFix Service Management is affected by multiple security vulnerabilities. |
| CVE-2026-103686 | DO dom-sanitizer rhukster | 3.5 | Oct 1 | rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting |
| CVE-2026-66253 | IC iControl HCL Software | 3.1 | Oct 1 | HCL iControl is affected by a Session Timeout vulnerability |
| CVE-2026-66249 | IC iControl HCL Software | 3.1 | Oct 1 | HCL iControl is affected by a Missing Secure Attribute vulnerability |
| CVE-2026-66248 | IC iControl HCL Software | 3.1 | Oct 1 | HCL iControl is affected by an Improper Error Handling vulnerability |
| CVE-2026-94220 | AA Apache APISIX Apache Software Foundation | 2.1 | Oct 1 | Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin |
| CVE-2026-103290 | GH Ghost TryGhost | 3.8 | Oct 1 | Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize |
| CVE-2026-103287 | GH Ghost TryGhost | 2.7 | Oct 1 | Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook |
| CVE-2026-87973 | ID If-So Dynamic Content | 3.1 | Oct 1 | If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name |
| CVE-2026-76144 | GS Genian SSL PNS (frodo-core) Genians, Inc | 1.8 | Oct 1 | Genians, Inc Genian SSL PNS Unrestricted File Upload |
| CVE-2026-101887 | BL bluez-alsa arkq | 3.5 | Oct 1 | BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS |
| CVE-2026-103585 | MM MediaWiki MediaSearch extension The Wikimedia Foundation | 1.2 | Sep 30 | attacker-controlled javascript license URL via XSS |
| CVE-2026-103584 | MC MediaWiki CommonsMetadata extension The Wikimedia Foundation | 1.1 | Sep 30 | attacker-controlled javascript license URL via XSS |
| CVE-2026-102138 | CO Core Kiteworks | 3.3 | Sep 30 | Kiteworks Core Server-Side Request Forgery (SSRF) |
| CVE-2026-103440 | MP MediaWiki PageTriage extension The Wikimedia Foundation | 1.2 | Sep 30 | pagetriagelist discloses suppressed reviewer usernames |
| CVE-2026-103439 | MW MediaWiki Wikbase extension The Wikimedia Foundation | 0.3 | Sep 30 | Various rawParams() and escaped() updates to prevent XSS in Wikibase extension |
| CVE-2026-103438 | MW MediaWiki Wikistories extension The Wikimedia Foundation | 0.3 | Sep 30 | Various rawParams() and escaped() updates to prevent XSS in Wikistories extension |
| CVE-2026-103437 | MR MediaWiki ReadingLists extension The Wikimedia Foundation | 1.1 | Sep 30 | ReadingLists imported metadata permits JavaScript URL XSS |
| CVE-2026-103445 | MP MediaWiki Page_Forms extension The Wikimedia Foundation | 1.2 | Sep 30 | Stored XSS through PageForms #autoedit redirect links |
| CVE-2026-103444 | MW MediaWiki WikiForum extension The Wikimedia Foundation | 1.1 | Sep 30 | Stored XSS through system messages in WikiForum |
| CVE-2026-103443 | MC MediaWiki Collection (Book) extension The Wikimedia Foundation | 1.1 | Sep 30 | API permits session-seeded javascript URL XSS |
| CVE-2026-103436 | AP apcupsd apcupsd | 3.7 | Sep 30 | apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi |
| CVE-2026-100271 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects |
| CVE-2026-100270 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations |
| CVE-2026-100268 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates |
| CVE-2026-100264 | YO YouTrack JetBrains | 2.7 | Sep 30 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
| CVE-2026-27085 | AW Astra WordPress Theme Brainstorm Force | 2.7 | Sep 30 | WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability |
| CVE-2026-103012 | AN @anthropic-ai/claude-code Anthropic | 2.0 | Sep 30 | Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise… |
| CVE-2026-102587 | MO Moodle Moodle | 2.7 | Sep 30 | Moodle: user list filters bypass profile field visibility |
| CVE-2026-102583 | MO Moodle Moodle | 2.7 | Sep 30 | Moodle: incorrect capability check in ai generate image web service |
| CVE-2026-94297 | ML Media Library Organizer | 2.7 | Sep 30 | Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation |
| CVE-2026-88791 | SR Safe Redirect Manager | 3.4 | Sep 30 | Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules |
| CVE-2026-82127 | SS Schema & Structured Data for WP & AMP | 3.5 | Sep 30 | Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields |
| CVE-2026-102844 | HO HospitalManagement gedelumbung | 2.7 | Sep 30 | gedelumbung HospitalManagement laporan_data_pasien.php detail authorization |
| CVE-2026-51936 | SQ SQLCipher Zetetic | 2.1 | Sep 30 | Zetetic SQLCipher before 4.15.0 allows SQL injection |
| CVE-2026-71189 | TM TMS7 Toptech Systems | 3.5 | Sep 29 | Toptech TMS7 and TopHAT Cross-site Scripting |
| CVE-2026-69662 | TM TMS7 Toptech Systems | 3.7 | Sep 29 | Toptech TMS7 and TopHAT Eval Injection |
| CVE-2026-102621 | PO Poppler Freedesktop | 3.3 | Sep 29 | Freedesktop Poppler SplashClip.cc clipToPath integer overflow |