CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:58 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-89314 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | Quadratic-time key_ops duplicate check lets a sub-1 MB JWKS body pin a CPU core for ~15 s |
| CVE-2026-89313 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.3 | Oct 23 | JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil |
| CVE-2026-89312 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 6.9 | Oct 23 | AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV |
| CVE-2025-58403 New | CC CGM CLININET CGM | 5.1 | Oct 23 | Reflected Cross-Site Scripting (XSS) in CGM CLININET |
| CVE-2025-30053 New | CC CGM CLININET CGM | 6.9 | Oct 23 | Missing Authentication in CGM CLININET |
| CVE-2025-30051 New | CC CGM CLININET CGM | 6.8 | Oct 23 | Insecure File Permissions in CGM CLININET |
| CVE-2026-115657 New | KA KNIME Analytics Platform KNIME | 4.8 | Oct 23 | KNIME Analytics Platform logs credentials of configured proxy when used as an executor |
| CVE-2026-112821 New | KP Knit Pay Knit Pay | 6.5 | Oct 23 | WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability |
| CVE-2026-112825 New | CR Car Rental Manager Magepeople inc. | 6.5 | Oct 23 | WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability |
| CVE-2026-4952 New | WA WebOrderSystem (AuftragsManager) VertiGIS Ltd. | 5.1 | Oct 23 | Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem |
| CVE-2026-4951 New | WK WebOrderSystem (KundenManager) VertiGIS Ltd. | 5.1 | Oct 23 | Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem |
| CVE-2026-4950 New | WK WebOrderSystem (KundenManager) VertiGIS Ltd. | 4.8 | Oct 23 | Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem |
| CVE-2026-63243 New | CS Creative Sound Blaster Katana V2, V2X, SE Creative Labs | 4.3 | Oct 23 | Firmware verification vulnerability |
| CVE-2026-94264 New | AC Advanced Custom Fields: Extended | 6.8 | Oct 23 | Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes |
| CVE-2026-113472 New | DP Depicter — Popup & Slider Builder | 5.4 | Oct 23 | Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload |
| CVE-2026-112219 New | DM Download Monitor | 4.9 | Oct 23 | Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route |
| CVE-2026-111966 New | UP User Profile Builder | 6.8 | Oct 23 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute |
| CVE-2026-111738 New | SO Speed Optimizer | 5.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option |
| CVE-2026-109935 New | OB Otter Blocks | 5.3 | Oct 23 | Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API |
| CVE-2026-109934 New | OB Otter Blocks | 5.3 | Oct 23 | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API |
| CVE-2026-109933 New | OB Otter Blocks | 6.8 | Oct 23 | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes |
| CVE-2026-55835 New | LO lookyloo Lookyloo | 6.9 | Oct 23 | Lookyloo: Potential sub-system DoS due to parameter missmatch in notification |
| CVE-2026-86020 New | PA Part-DB-server Part-DB | 4.6 | Oct 23 | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports |
| CVE-2026-86019 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Attachment Size Limit Bypass via API Base64 Upload |
| CVE-2026-86018 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads |
| CVE-2026-59188 New | PA Part-DB-server Part-DB | 5.4 | Oct 23 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer |
| CVE-2026-55600 New | PA Part-DB-server Part-DB | 5.7 | Oct 23 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name |
| CVE-2026-54631 New | PA Part-DB-server Part-DB | 6.3 | Oct 23 | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie |
| CVE-2026-90458 New | IR Ironic OpenStack | 5.4 | Oct 23 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service |
| CVE-2026-54615 New | PA Part-DB-server Part-DB | 6.0 | Oct 23 | Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap) |
| CVE-2026-89419 New | IR Ironic OpenStack | 5.0 | Oct 23 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific… |
| CVE-2026-115638 New | IR Ironic OpenStack | 4.3 | Oct 23 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb |
| CVE-2026-115537 New | HO HospitalManagement gedelumbung | 4.3 | Oct 23 | gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect |
| CVE-2026-115536 New | HO HospitalManagement gedelumbung | 4.3 | Oct 23 | gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting |
| CVE-2026-115485 New | RH Red Hat Enterprise Linux 10 Red Hat | 6.3 | Oct 23 | Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio |
| CVE-2026-115534 New | HO HospitalManagement gedelumbung | 4.3 | Oct 22 | gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting |
| CVE-2026-105265 New | EF E3 Firmware Kiloview | 5.3 | Oct 22 | Kiloview E3 NDI Encoder Path Traversal |
| CVE-2026-96616 New | EF E3 Firmware Kiloview | 6.5 | Oct 22 | Kiloview E3 NDI Encoder Insufficient Session Expiration |
| CVE-2026-111100 New | EF E3 Firmware Kiloview | 5.3 | Oct 22 | Kiloview E3 NDI Encoder Missing Authentication for Critical Function |
| CVE-2026-114620 New | AU authlib authlib | 5.4 | Oct 22 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF |
| CVE-2026-114619 New | AU authlib authlib | 4.6 | Oct 22 | Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens |
| CVE-2026-114618 New | AU authlib authlib | 6.8 | Oct 22 | Authlib: Default JWT bearer grant accepts assertions for the wrong audience |
| CVE-2026-114617 New | AU authlib authlib | 4.2 | Oct 22 | Authlib: ID token can disable its own nonce validation via the nonce_supported claim |
| CVE-2026-115221 New | RH Red Hat Enterprise Linux 10 Red Hat | 5.4 | Oct 22 | Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership |
| CVE-2026-115424 New | RH Red Hat OpenShift Container Platform 4 Red Hat | 5.5 | Oct 22 | Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination |
| CVE-2026-114583 New | CP CPython Python Software Foundation | 6.9 | Oct 22 | tar filter allows writing outside destination via empty-named symlink |
| CVE-2026-115509 New | JI jitsu jitsucom | 4.2 | Oct 22 | Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API |
| CVE-2026-115508 New | CR crawl4ai unclecode | 6.5 | Oct 22 | Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields |
| CVE-2026-115503 New | GH ghidra NationalSecurityAgency | 5.5 | Oct 22 | Ghidra before 12.2 Denial of Service via Compressed Extension Archive |
| CVE-2026-115398 New | GH ghidra NationalSecurityAgency | 5.5 | Oct 22 | Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount |