CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110230 | XB XBackBone sergix44 | 5.4 | Oct 13 | XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint |
| CVE-2026-110229 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips |
| CVE-2026-110228 | WA wallabag wallabag | 5.4 | Oct 13 | wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload |
| CVE-2026-110226 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation |
| CVE-2026-110225 | SH Shaarli shaarli | 2.7 | Oct 13 | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route |
| CVE-2026-110224 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors |
| CVE-2026-110223 | KA Kavita Kareadita | 3.1 | Oct 13 | Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint |
| CVE-2026-110222 | IF IFSC Razorpay | 5.3 | Oct 13 | Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup |
| CVE-2026-110221 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value |
| CVE-2026-110220 | MR Model Registry Kubeflow | 7.1 | Oct 13 | Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation |
| CVE-2026-110219 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field |
| CVE-2026-110218 | AE Aureus ERP Webkul | 3.7 | Oct 13 | Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL |
| CVE-2026-110217 | VH vhr lenve | 6.5 | Oct 13 | vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs |
| CVE-2026-110216 | YO youlai-boot youlaitech | 7.1 | Oct 13 | youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint |
| CVE-2026-110215 | YO youlai-boot youlaitech | 8.8 | Oct 13 | youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation |
| CVE-2026-110214 | SN Snowy xiaonuobase | 3.7 | Oct 13 | Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download |
| CVE-2026-110213 | AI ai-fusion-video Stonewuu | 4.3 | Oct 13 | ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints |
| CVE-2026-110212 | AI ai-fusion-video Stonewuu | 4.3 | Oct 13 | ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter |
| CVE-2026-110211 | SK skillhub iflytek | 8.1 | Oct 13 | SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint |
| CVE-2026-110210 | PC Phase Console Phase | 5.3 | Oct 13 | Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query |
| CVE-2026-110209 | AI ai-fusion-video Stonewuu | 6.5 | Oct 13 | ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials |
| CVE-2026-110208 | WA Wukong AICRM WuKongOpenSource | 7.1 | Oct 13 | Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys |
| CVE-2026-110207 | WA Wukong AICRM WuKongOpenSource | 8.8 | Oct 13 | Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs |
| CVE-2026-110206 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position |
| CVE-2026-110205 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution |
| CVE-2026-110204 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution |
| CVE-2026-110203 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization |
| CVE-2026-110202 | RO Roo-Code RooCodeInc | 8.8 | Oct 13 | Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping |
| CVE-2026-92088 | UI upKeeper Instant Privilege Access upKeeper Solutions | 8.6 | Oct 13 | Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation |
| CVE-2026-110036 | RH Red Hat Enterprise Linux 10 Red Hat | 3.3 | Oct 13 | Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices |
| CVE-2026-103937 | MI misskey misskey-dev | 8.7 | Oct 13 | Misskey: Denial of service resulting from insufficient cleanup processing during file uploads |
| CVE-2026-104817 | MI misskey misskey-dev | 8.7 | Oct 13 | Misskey: Lack of rate limiting and size restrictions in RSS fetching API |
| CVE-2026-104816 | MI misskey misskey-dev | 8.5 | Oct 13 | Misskey: Cross-site scripting in RSS feed item links |
| CVE-2026-104340 | AF Adobe FrameMaker 2022 Adobe | 7.8 | Oct 13 | Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-103856 | AF Adobe FrameMaker 2022 Adobe | 5.5 | Oct 13 | Adobe Framemaker | Out-of-bounds Read (CWE-125) |
| CVE-2026-104343 | AF Adobe FrameMaker 2022 Adobe | 5.5 | Oct 13 | Adobe Framemaker | NULL Pointer Dereference (CWE-476) |
| CVE-2026-103966 | AF Adobe FrameMaker 2022 Adobe | 7.8 | Oct 13 | Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-106625 | AF Adobe FrameMaker 2022 Adobe | 7.8 | Oct 13 | Adobe Framemaker | Out-of-bounds Write (CWE-787) |
| CVE-2026-104341 | AF Adobe FrameMaker 2022 Adobe | 7.8 | Oct 13 | Adobe Framemaker | Out-of-bounds Write (CWE-787) |
| CVE-2026-104342 | AF Adobe FrameMaker 2022 Adobe | 7.8 | Oct 13 | Adobe Framemaker | Use After Free (CWE-416) |
| CVE-2026-104344 | AF Adobe FrameMaker 2022 Adobe | 7.8 | Oct 13 | Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) |
| CVE-2026-103967 | AF Adobe FrameMaker 2022 Adobe | 7.8 | Oct 13 | Adobe Framemaker | Out-of-bounds Write (CWE-787) |
| CVE-2026-103857 | AF Adobe FrameMaker 2022 Adobe | 5.5 | Oct 13 | Adobe Framemaker | Out-of-bounds Read (CWE-125) |
| CVE-2026-54086 | SL sleapi-j esa | 5.3 | Oct 13 | SLE API for Java: Uncontrolled Memory Allocation / handled exception leading to Denial of Service |
| CVE-2026-109429 | MI mistral-vibe mistralai | 8.8 | Oct 13 | Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform |
| CVE-2026-85747 | DI distribution distribution | 6.8 | Oct 13 | Distribution: Client `manifests.Get()` does not verify returned content against requested digest |
| CVE-2026-107607 | SW SWIFI-SE2KIC Swann Communications | 6.2 | Oct 13 | Missing authentication for critical function in Swann Communications SWIFI-SE2KIC |
| CVE-2026-107606 | SW SWIFI-SE2KIC Swann Communications | 6.2 | Oct 13 | Missing authentication for critical function in Swann Communications SWIFI-SE2KIC |
| CVE-2026-107605 | SW SWIFI-SE2KIC Swann Communications | 6.2 | Oct 13 | Missing authentication for critical function in Swann Communications SWIFI-SE2KIC |
| CVE-2026-109428 | MI mistral-vibe mistralai | 8.8 | Oct 13 | Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation |