CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114259 New | FI file-management-system-php oretnom23 | 7.3 | Oct 21 | oretnom23 file-management-system-php admin_class.php save_files unrestricted upload |
| CVE-2026-76505 New | CI Cisco IOS XR Software Cisco | 7.5 | Oct 21 | Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets Denial of Service Vulnerability |
| CVE-2026-76524 New | CO Cisco Open Source Snort3 Cisco | 7.8 | Oct 21 | Open Source Snort 3 Control Channel Socket Aribitrary Command Execution Vulnerability |
| CVE-2026-76496 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.0 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities |
| CVE-2026-76495 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.8 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities |
| CVE-2026-76494 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.8 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities |
| CVE-2026-76493 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.5 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities |
| CVE-2026-76490 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 8.6 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities |
| CVE-2026-76492 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.5 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities |
| CVE-2026-76491 New | CT Cisco TelePresence Video Communication Server (VCS) Expressway Cisco | 7.5 | Oct 21 | Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities |
| CVE-2026-76481 New | CE Cisco Emergency Responder Cisco | 7.5 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions Vulnerabilities |
| CVE-2026-76479 New | CE Cisco Emergency Responder Cisco | 7.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities |
| CVE-2026-76478 New | CE Cisco Emergency Responder Cisco | 8.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities |
| CVE-2026-76476 New | CE Cisco Emergency Responder Cisco | 8.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities |
| CVE-2026-114258 New | FI file-management-system-php oretnom23 | 7.3 | Oct 21 | oretnom23 file-management-system-php File Management files.php sql injection |
| CVE-2026-76477 New | CE Cisco Emergency Responder Cisco | 8.8 | Oct 21 | Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities |
| CVE-2026-20356 New | CC Cisco Cyber Vision Cisco | 7.5 | Oct 21 | Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 |
| CVE-2026-20236 New | CC Cisco Cyber Vision Cisco | 7.5 | Oct 21 | Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 |
| CVE-2026-20291 New | CC Cisco Cyber Vision Cisco | 7.8 | Oct 21 | Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 |
| CVE-2026-114257 New | FI file-management-system-php oretnom23 | 7.3 | Oct 21 | oretnom23 file-management-system-php File Download download.php readfile sql injection |
| CVE-2026-114256 New | FI file-management-system-php oretnom23 | 7.3 | Oct 21 | oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection |
| CVE-2026-114490 New | HM hMailServer Progressive Robot Ltd | 7.8 | Oct 21 | Incorrect Authorization in hMailServer |
| CVE-2026-114489 New | HM hMailServer Progressive Robot Ltd | 8.1 | Oct 21 | Missing Authorization in hMailServer |
| CVE-2026-114255 New | FI file-management-system-php oretnom23 | 7.3 | Oct 21 | oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection |
| CVE-2026-114254 New | FI file-management-system-php oretnom23 | 7.3 | Oct 21 | oretnom23 file-management-system-php admin_class.php login sql injection |
| CVE-2026-114476 New | HM hMailServer Progressive Robot Ltd | 7.5 | Oct 21 | Incorrect Authorization in hMailServer |
| CVE-2026-102486 New | NT ntpsec NTPsec | 7.5 | Oct 21 | Out-of-bounds Read in ntpsec |
| CVE-2026-102483 New | NT ntpsec NTPsec | 7.5 | Oct 21 | Reachable Assertion in ntpsec |
| CVE-2023-7356 New | LI Linux Linux | 8.8 | Oct 21 | Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID |
| CVE-2026-98869 New | LI Linux Linux | 7.8 | Oct 21 | bpf: Infer zext_dst based on static register liveness analysis |
| CVE-2026-113779 New | PF pfSense-pkg-RESTAPI pfrest | 8.8 | Oct 21 | pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission |
| CVE-2026-111848 New | GM Geo Mashup Dylan Kuhn | 7.1 | Oct 21 | WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112221 New | SU SureCart Brainstorm Force | 7.1 | Oct 21 | WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-111833 New | WE weForms Bold Grid | 7.5 | Oct 21 | WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability |
| CVE-2026-111838 New | TC ThemeHunk Customizer ThemeHunk | 7.1 | Oct 21 | WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-111840 New | PV Paid Videochat Turnkey Site VideoWhisper.com | 7.1 | Oct 21 | WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-109619 In wildKEVNew | PH PHP PHP | 8.1 | Oct 21 | RCE via stale global state |
| CVE-2026-104948 New | WA WarehousePG EnterpriseDB | 7.1 | Oct 21 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions… |
| CVE-2026-114249 New | IN Insurance-Management-System dhikshitha29 | 7.3 | Oct 21 | dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization |
| CVE-2026-97313 New | B9 BIND 9 ISC | 7.5 | Oct 21 | Specific RPZ configurations and query patterns may result in an unexpected exit |
| CVE-2026-96888 New | B9 BIND 9 ISC | 7.5 | Oct 21 | Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization |
| CVE-2026-94300 New | B9 BIND 9 ISC | 8.1 | Oct 21 | Concurrent GSS-TSIG messages corrupt memory |
| CVE-2026-114245 New | IN Insurance-Management-System dhikshitha29 | 7.3 | Oct 21 | dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization |
| CVE-2026-19630 New | B9 BIND 9 ISC | 7.5 | Oct 21 | Amplified resource exhaustion in inbound message processing |
| CVE-2026-114403 New | PH PHPPresentation PHPOffice | 8.1 | Oct 21 | PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load |
| CVE-2026-114397 New | TR trudesk polonel | 7.4 | Oct 21 | Trudesk through 1.2.11 Missing Authentication on Debug Routes |
| CVE-2026-114396 New | TR trudesk polonel | 7.1 | Oct 21 | Trudesk through 1.2.11 MongoDB $where Injection via tickets search API |
| CVE-2026-114391 New | ZE zentaopms easysoft | 7.1 | Oct 21 | ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods |
| CVE-2026-114387 New | SH shopper shopperlabs | 8.8 | Oct 21 | Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components |
| CVE-2026-114405 New | VS vServer Velneo | 8.7 | Oct 21 | Denial of Service via Malformed VATP Packet in Velneo vServer |