CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:35 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-96398 New | DR Drupal Drupal | 4.3 | Oct 22 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 |
| CVE-2026-96356 New | DR Drupal Drupal | 5.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 |
| CVE-2026-96375 New | DR Drupal Drupal | 4.8 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 |
| CVE-2026-96376 New | DR Drupal Drupal | 6.4 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 |
| CVE-2026-96374 New | DR Drupal Drupal | 4.2 | Oct 22 | Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 |
| CVE-2026-96378 New | DR Drupal Drupal | 4.3 | Oct 22 | Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179 |
| CVE-2026-96385 New | DR Drupal Drupal | 6.5 | Oct 22 | REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 |
| CVE-2026-96388 New | DR Drupal Drupal | 5.4 | Oct 22 | Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 |
| CVE-2026-96390 New | DR Drupal Drupal | 4.3 | Oct 22 | Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 |
| CVE-2026-96377 New | DR Drupal Drupal | 5.3 | Oct 22 | Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 |
| CVE-2026-96380 New | DR Drupal Drupal | 6.5 | Oct 22 | CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 |
| CVE-2026-96386 New | DR Drupal Drupal | 6.5 | Oct 22 | Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 |
| CVE-2026-96382 New | DR Drupal Drupal | 4.6 | Oct 22 | Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 |
| CVE-2026-114717 New | WE Webmail Roundcube | 4.0 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment |
| CVE-2026-114715 New | WE Webmail Roundcube | 6.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin |
| CVE-2026-114714 New | WE Webmail Roundcube | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin |
| CVE-2025-69723 New | Product not mapped yet | 6.1 | Oct 22 | A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL |
| CVE-2025-65200 New | Product not mapped yet | 5.4 | Oct 22 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the… |
| CVE-2026-78801 New | Product not mapped yet | 4.3 | Oct 22 | An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the… |
| CVE-2026-114574 New | MA massCode massCodeIO | 4.3 | Oct 21 | massCodeIO massCode Local HTTP Service index.ts information disclosure |
| CVE-2026-12664 New | GI GitLab GitLab | 6.8 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-13319 New | GI GitLab GitLab | 6.5 | Oct 21 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-16255 New | GI GitLab GitLab | 5.9 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-105777 New | GI GitLab GitLab | 6.5 | Oct 21 | Insertion of Sensitive Information Into Sent Data in GitLab |
| CVE-2026-112378 New | GI GitLab GitLab | 4.3 | Oct 21 | Use of Less Trusted Source in GitLab |
| CVE-2026-100420 New | DB Deco BE63 V2.0 TP-Link Systems Inc. | 6.8 | Oct 21 | Information disclosure vulnerability in the cloud-client daemon of Deco BE63 |
| CVE-2026-76406 New | SS Splunk SOAR Splunk | 5.9 | Oct 21 | Information Disclosure through REST API Authentication in Splunk SOAR |
| CVE-2026-76308 New | SS Splunk SOAR Splunk | 6.5 | Oct 21 | Missing Authorization through the REST API in Splunk SOAR |
| CVE-2026-76305 New | SS Splunk SOAR Splunk | 6.5 | Oct 21 | Improper Access Control during App Downloads in Splunk SOAR |
| CVE-2026-76304 New | SS Splunk SOAR Splunk | 4.3 | Oct 21 | Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR |
| CVE-2026-76303 New | SS Splunk SOAR Splunk | 5.7 | Oct 21 | Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR |
| CVE-2026-76297 New | SE Splunk Enterprise Splunk | 4.2 | Oct 21 | Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise |
| CVE-2026-76296 New | SE Splunk Enterprise Splunk | 4.3 | Oct 21 | Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise |
| CVE-2026-76295 New | SE Splunk Enterprise Splunk | 4.3 | Oct 21 | SPL Injection through the REST API in Splunk Secure Gateway |
| CVE-2026-76294 New | SE Splunk Enterprise Splunk | 4.3 | Oct 21 | Improper Access Control in Field Extraction Management in Splunk Enterprise |
| CVE-2026-76292 New | SE Splunk Enterprise Splunk | 6.5 | Oct 21 | Missing Authorization through REST API Endpoints in Splunk Secure Gateway |
| CVE-2026-76289 New | SE Splunk Enterprise Splunk | 6.5 | Oct 21 | Denial of Service (DoS) through the REST API in Splunk Enterprise |
| CVE-2026-76287 New | SE Splunk Enterprise Splunk | 5.4 | Oct 21 | Authorization Bypass in the Data Management REST API in Splunk Enterprise |
| CVE-2026-89052 New | AC Archer C6 V2 TP-Link Systems Inc. | 5.9 | Oct 21 | Hardcoded AES encryption key in Archer C6 |
| CVE-2026-114384 New | OC Online Cake Ordering System itsourcecode | 6.3 | Oct 21 | itsourcecode Online Cake Ordering System transactionsave.php sql injection |
| CVE-2026-114508 New | FR framework laravel | 6.5 | Oct 21 | Laravel relationship inclusion can trigger unauthorized data destruction |
| CVE-2026-114501 New | PI Pillow python-pillow | 5.3 | Oct 21 | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 |
| CVE-2026-114381 New | OC Online Cake Ordering System itsourcecode | 6.3 | Oct 21 | itsourcecode Online Cake Ordering System orderdetail.php sql injection |
| CVE-2026-96636 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) |
| CVE-2026-96637 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS |
| CVE-2026-114380 New | OC Online Cake Ordering System itsourcecode | 6.3 | Oct 21 | itsourcecode Online Cake Ordering System inserttrans.php sql injection |
| CVE-2026-114406 New | RH Red Hat Advanced Cluster Security 4 Red Hat | 6.8 | Oct 21 | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns |
| CVE-2026-96643 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time |
| CVE-2026-96641 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise |
| CVE-2026-96642 New | PI Pillow python-pillow | 6.5 | Oct 21 | Pillow: TarIO negative size field causes infinite CPU-spin loop |