CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 18:54 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116176 New | VL vllm vllm-project | 8.2 | Oct 25 | vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector |
| CVE-2026-116174 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate |
| CVE-2026-116173 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids |
| CVE-2026-116172 New | VL vllm vllm-project | 7.5 | Oct 25 | vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n |
| CVE-2026-116165 New | PA parse-server parse-community | 8.8 | Oct 25 | Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB |
| CVE-2026-116163 New | PA parse-server parse-community | 7.4 | Oct 25 | Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses |
| CVE-2026-116149 New | IM ImageMagick ImageMagick | 8.1 | Oct 25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images |
| CVE-2026-116068 New | DO dokploy Dokploy | 8.8 | Oct 25 | Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router |
| CVE-2026-116067 New | PA paisa ananthakumaran | 8.2 | Oct 25 | Paisa before 0.7.8 Path Traversal via Editor and Sheet API |
| CVE-2026-116050 New | ER Employee Recruitment System krupalshah | 7.3 | Oct 25 | krupalshah Employee Recruitment System Registration registerform3.php sql injection |
| CVE-2026-116049 New | EM EmployeeRecruitmentSystem krupalshah | 7.3 | Oct 25 | krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection |
| CVE-2026-116048 New | EM EmployeeRecruitmentSystem krupalshah | 7.3 | Oct 25 | krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection |
| CVE-2026-115251 New | DU Duplicator | 7.2 | Oct 25 | Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade |
| CVE-2026-116006 New | RU ruoyi-vue-pro YunaiV | 7.3 | Oct 25 | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication |
| CVE-2026-116000 New | PR PrivateGPT Zylon | 7.3 | Oct 25 | Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery |
| CVE-2026-115999 New | RE Restaurant_IMS mansi-k | 7.3 | Oct 25 | mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection |
| CVE-2026-115973 New | FH Faveo Helpdesk FaveoSuite | 7.3 | Oct 24 | FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery |
| CVE-2026-115970 New | OP Opptrix Travisun | 7.3 | Oct 24 | Travisun Opptrix Import Endpoint import code injection |
| CVE-2026-115969 New | OP Opptrix Travisun | 7.3 | Oct 24 | Travisun Opptrix Schedule API setup command injection |
| CVE-2026-114191 New | UQ UPI QR Code Payment Gateway for WooCommerce Knit Pay | 7.5 | Oct 24 | WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability |
| CVE-2026-114704 New | RE Relevanssi Christoph Vielgrader | 7.2 | Oct 24 | WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability |
| CVE-2026-116019 New | GR grav getgrav | 8.8 | Oct 24 | Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives |
| CVE-2026-116016 New | YU yudao-cloud YunaiV | 7.1 | Oct 24 | yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header |
| CVE-2026-116014 New | OP open62541 open62541 | 8.1 | Oct 24 | open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType |
| CVE-2026-116011 New | CR Crow CrowCpp | 7.5 | Oct 24 | Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load() |
| CVE-2026-116009 New | CA camaleon-cms owen2345 | 8.8 | Oct 24 | Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action |
| CVE-2026-110018 New | AG aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder kodezen | 8.8 | Oct 24 | aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute |
| CVE-2026-114695 New | VI VOD Infomaniak Infomaniak Network | 7.1 | Oct 24 | WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114694 New | EM Events Manager Pixelite | 7.1 | Oct 24 | WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114697 New | QA QA Analytics QuarkA | 7.1 | Oct 24 | WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114178 New | WT W3 Total Cache Bold Grid | 7.1 | Oct 24 | WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112869 New | WO We’re Open! Noah Hearle | 7.1 | Oct 24 | WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112844 New | WE WP Event Solution Arraytics | 7.1 | Oct 24 | WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-114179 New | BB BP Better Messages wordplus | 7.1 | Oct 24 | WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115975 New | CE cervantes CervantesSec | 7.1 | Oct 24 | Broken access control in JiraController |
| CVE-2026-113673 New | GE GeoDirectory | 7.2 | Oct 24 | GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export |
| CVE-2026-112207 New | DM Download Monitor | 7.1 | Oct 24 | Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link |
| CVE-2026-115807 New | UP User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor cozmoslabs | 7.1 | Oct 24 | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute |
| CVE-2026-115938 New | CM cms craftcms | 8.8 | Oct 23 | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE |
| CVE-2026-115937 New | CO commerce-mollie craftcms | 7.5 | Oct 23 | Unauthenticated payment reuse allows unpaid orders to be marked as paid |
| CVE-2026-115935 New | CM cms craftcms | 8.8 | Oct 23 | Control panel only API response emulation replaces "securityKey" and reaches server RCE |
| CVE-2026-115895 New | HA happy-dom capricorn86 | 8.8 | Oct 23 | Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution |
| CVE-2026-115887 New | GR graphql-scalars graphql-hive | 7.5 | Oct 23 | graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service |
| CVE-2026-65825 New | AP appointment-booking-software open-reception | 7.5 | Oct 23 | OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants |
| CVE-2026-65824 New | AP appointment-booking-software open-reception | 7.4 | Oct 23 | OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie |
| CVE-2026-58202 New | AP appointment-booking-software open-reception | 8.3 | Oct 23 | OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` |
| CVE-2026-115778 New | TW twisted twisted | 7.5 | Oct 23 | Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer |
| CVE-2026-115776 New | TW twisted twisted | 7.5 | Oct 23 | Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer |
| CVE-2026-115775 New | TW twisted twisted | 8.7 | Oct 23 | Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree |
| CVE-2026-79982 New | ZE zephyr zephyrproject | 8.8 | Oct 23 | Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI packet exceeds the bulk endpoint maximum packet size |