CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 17:49 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115269 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit |
| CVE-2026-108525 New | BA bandit mtrudel | 8.7 | Oct 26 | HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit |
| CVE-2026-116219 New | DO dolibarr Dolibarr | 7.2 | Oct 26 | Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter |
| CVE-2026-116218 New | DO dolibarr Dolibarr | 7.6 | Oct 26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field |
| CVE-2026-115193 New | Product not mapped yet | 8.2 | Oct 26 | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7 |
| CVE-2026-115192 New | Product not mapped yet | 7.1 | Oct 26 | An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}) |
| CVE-2026-115191 New | Product not mapped yet | 7.1 | Oct 26 | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax) |
| CVE-2026-115190 New | Product not mapped yet | 8.0 | Oct 26 | An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties |
| CVE-2026-115189 New | Product not mapped yet | 8.8 | Oct 26 | A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic |
| CVE-2026-110474 New | AA Agentic AI Call Centre CreditNirvana | 8.7 | Oct 26 | Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application |
| CVE-2026-115717 New | BU builder frappe | 7.7 | Oct 26 | Frappe Builder before 1.36.1 SSRF via convert_to_webp |
| CVE-2026-94380 New | LM Liman MYS HAVELSAN Inc. | 8.1 | Oct 26 | Host Header Injection in HAVELSAN's Liman MYS |
| CVE-2026-116260 New | LI libimobiledevice Libimobiledevice | 7.3 | Oct 26 | libimobiledevice AFC Service afc.c service_receive double free |
| CVE-2026-116469 New | MI misp-guard MISP | 7.1 | Oct 26 | MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding |
| CVE-2026-116257 New | BI BillaBear Billabear | 7.3 | Oct 26 | BillaBear Installation InstallController.php processInstall missing authentication |
| CVE-2026-115608 New | JE JetEngine Crocoblock | 8.5 | Oct 26 | WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability |
| CVE-2026-116256 New | RH RhaPHP geesondog | 7.3 | Oct 26 | geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery |
| CVE-2026-115948 New | ML Media LIbrary Assistant David Lingren | 8.5 | Oct 26 | WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability |
| CVE-2026-116253 New | DE DedeCMS Dedecms | 7.3 | Oct 26 | DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection |
| CVE-2026-116237 New | PX Pugongying X5 Pro Oray | 8.4 | Oct 26 | Oray Pugongying X5 Pro Dnsmasq crlf injection |
| CVE-2026-116236 New | PX Pugongying X5 Pro Oray | 7.2 | Oct 26 | Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload |
| CVE-2026-82947 New | SO SOEM RT-Labs AB | 7.1 | Oct 26 | Multiple Out-of-Bounds Reads in Frame Processing |
| CVE-2026-82944 New | SO SOEM RT-Labs AB | 8.8 | Oct 26 | Buffer Overflow in CoE SDO Upload Multi-Segment Data Transfers |
| CVE-2026-111841 New | FA FunnelKit Automations Aman | 8.8 | Oct 26 | WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-116372 New | MI misp-guard MISP | 7.7 | Oct 26 | MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules |
| CVE-2026-70388 New | SO SOEM RT-Labs AB | 8.3 | Oct 26 | Memory Corruption via Integer Underflow in Message Length Validation |
| CVE-2026-116230 New | PI Plague Inc Evolved Ndemic Creations | 7.8 | Oct 26 | Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization |
| CVE-2026-96581 New | AS ash ash-project | 7.6 | Oct 26 | An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records |
| CVE-2026-107900 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107899 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107898 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107897 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107896 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107895 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-107894 New | VS V-SFT FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. | 7.8 | Oct 26 | V-SFT provided by FUJI ELECTRIC CO., LTD |
| CVE-2026-113345 New | ED Electronic delivery item Inspection Support System Ministry of Land, Infrastructure, Transport and Tourism, Japan | 7.8 | Oct 26 | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission… |
| CVE-2026-116117 New | HA halo halo-dev | 7.3 | Oct 26 | halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal |
| CVE-2026-116116 New | GC GM8135S Camera Yoosee | 8.2 | Oct 26 | Yoosee GM8135S Camera Secure Boot signature verification |
| CVE-2026-116112 New | ED edoc-doctor-appointment-system HashenUdara | 7.3 | Oct 26 | HashenUdara edoc-doctor-appointment-system add-new.php sql injection |
| CVE-2026-116110 New | LI LiveWallPaper GiantappMan | 7.3 | Oct 26 | GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication |
| CVE-2026-116106 New | HA HeyCyan App Heycyan App | 7.3 | Oct 26 | HeyCyan App FileProvider access control |
| CVE-2026-106781 New | Product not mapped yet | 7.8 | Oct 26 | An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges |
| CVE-2026-107091 New | Product not mapped yet | 7.8 | Oct 26 | An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic |
| CVE-2026-104591 New | Product not mapped yet | 7.5 | Oct 26 | libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c |
| CVE-2026-104596 New | Product not mapped yet | 7.5 | Oct 26 | libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c |
| CVE-2026-104594 New | Product not mapped yet | 7.5 | Oct 26 | libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c |
| CVE-2026-116638 New | Product not mapped yet | 7.5 | Oct 26 | The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords |
| CVE-2026-116099 New | SC SCP Containment Breach Multiplayer Fusion Creators Studio | 8.8 | Oct 25 | Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write |
| CVE-2026-116098 New | RA Ravenfield SteelRaven7 | 7.8 | Oct 25 | SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization |
| CVE-2026-116094 New | EY EyouCMS Eyoucms | 7.3 | Oct 25 | EyouCMS function.php remote_file_to_local server-side request forgery |