CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 20:48 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90461 | IR Ironic OpenStack | 6.3 | Sep 11 | OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication |
| CVE-2026-54258 | ZO zoneminder ZoneMinder | 6.5 | Sep 11 | Cross-monitor event media authorization bypass in direct event media endpoints |
| CVE-2026-49992 | KI kimai kimai | 6.3 | Sep 11 | Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes |
| CVE-2026-50018 | HO hoverfly SpectoLabs | 6.5 | Sep 11 | Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions |
| CVE-2026-54248 | DO doco-cd kimdre | 6.5 | Sep 11 | Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration |
| CVE-2026-48496 | OP opentelemetry-ebpf-profiler open-telemetry | 6.2 | Sep 11 | opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent |
| CVE-2026-45056 | MA matrix-rust-sdk matrix-org | 6.9 | Sep 11 | Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution |
| CVE-2026-45057 | MA matrix-sdk-ui matrix-org | 4.9 | Sep 11 | matrix-sdk-ui: Incomplete edit validation |
| CVE-2026-49865 | KI kimai kimai | 5.3 | Sep 11 | Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs |
| CVE-2026-48490 | AR ArduinoCore-avr arduino | 6.9 | Sep 11 | ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler |
| CVE-2026-54165 | DO dobase smgdkngt | 6.4 | Sep 11 | Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim) |
| CVE-2026-49439 | OP openremote openremote | 4.3 | Sep 11 | OpenRemote read-only asset users can write predicted datapoints |
| CVE-2026-50025 | MO mousehole t-mart | 6.9 | Sep 11 | Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state |
| CVE-2026-81918 | CC Concrete CMS Concrete CMS | 4.8 | Sep 11 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block |
| CVE-2026-81917 | CC Concrete CMS Concrete CMS | 5.4 | Sep 11 | Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags |
| CVE-2026-68535 | CC Concrete CMS Concrete CMS | 4.3 | Sep 11 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions |
| CVE-2026-81916 | CC Concrete CMS Concrete CMS | 4.3 | Sep 11 | Incorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object |
| CVE-2026-49462 | NL nl.nl-portal:app nl-portal | 5.3 | Sep 11 | nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default |
| CVE-2026-81915 | CC Concrete CMS Concrete CMS | 5.3 | Sep 11 | In Concrete CMS below 9.5.3, Page Type update omits object-level authorization |
| CVE-2026-77490 | ME Microsoft Edge (Chromium-based) Microsoft | 6.1 | Sep 11 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
| CVE-2026-68526 | CC Concrete CMS Concrete CMS | 4.3 | Sep 11 | Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller |
| CVE-2026-81913 | CC Concrete CMS Concrete CMS | 6.1 | Sep 11 | Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. |
| CVE-2026-49463 | NL nl.nl-portal:besluiten nl-portal | 6.5 | Sep 11 | NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries |
| CVE-2026-81912 | CC Concrete CMS Concrete CMS | 5.7 | Sep 11 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature |
| CVE-2026-81911 | CC Concrete CMS Concrete CMS | 5.4 | Sep 11 | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description |
| CVE-2026-78546 | WA Workspace app for Windows Citirx | 4.8 | Sep 11 | Out-of-Bounds Read |
| CVE-2026-78547 | CW Citrix Workspace app for Windows Citrix | 4.4 | Sep 11 | Out-of-Bounds Write |
| CVE-2026-89332 | KI Kiro IDE AWS | 5.5 | Sep 11 | Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration |
| CVE-2026-89329 | RH Red Hat Enterprise Linux 10 Red Hat | 6.2 | Sep 11 | Device-mapper-multipath: local denial of service via blocking ipc send operations |
| CVE-2026-62088 | EL ElasticPress 10up | 5.3 | Sep 11 | WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability |
| CVE-2026-81910 | CC Concrete CMS Concrete CMS | 6.5 | Sep 11 | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values |
| CVE-2026-62139 | SK Site Kit by Google Google | 4.3 | Sep 11 | WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-62138 | VC Visual Composer Website Builder Visual Composer | 6.5 | Sep 11 | WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-62137 | BB bbPress John James Jacoby | 5.3 | Sep 11 | WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability |
| CVE-2026-62136 | FQ Flexible Quantity – Measurement Price Calculator for WooCommerce wpdesk | 5.3 | Sep 11 | WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability |
| CVE-2026-62135 | BO Booktics Arraytics | 5.3 | Sep 11 | WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability |
| CVE-2026-62134 | ST Starter Templates Brainstorm Force | 4.3 | Sep 11 | WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-62133 | RT RTMKit rometheme | 5.4 | Sep 11 | WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-62132 | ML Masteriyo - LMS masteriyo | 5.3 | Sep 11 | WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability |
| CVE-2026-62114 | PA Passster WP Chill | 5.3 | Sep 11 | WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability |
| CVE-2026-62113 | SS Slim SEO Anh Tran | 4.3 | Sep 11 | WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-62111 | SP Simple Payment Ido Kobelkowsky | 6.5 | Sep 11 | WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-62110 | BP Bold Page Builder boldthemes | 6.5 | Sep 11 | WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-27378 | DA Deposits and Partial Payments for WooCommerce magepeopleteam | 5.3 | Sep 11 | WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability |
| CVE-2026-62140 | QA Quiz And Survey Master ExpressTech Systems | 5.3 | Sep 11 | WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-81909 | CC Concrete CMS Concrete CMS | 5.9 | Sep 11 | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks |
| CVE-2026-18495 | RH Red Hat Enterprise Linux 10 Red Hat | 6.1 | Sep 11 | Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough |
| CVE-2026-68528 | CC Concrete CMS Concrete CMS | 6.0 | Sep 11 | Concrete CMS 9.5.2 and below is vulnerable to Stored XSS in RSS Displayer Block via Unescaped Remote Feed Item title |
| CVE-2026-7298 | SE Smart E-Commerce IdeaSoft Software Industry and Trade Inc. | 6.1 | Sep 11 | Reflected XSS in IdeaSoft's Smart E-Commerce |
| CVE-2026-87910 | CP CPython Python Software Foundation | 5.7 | Sep 11 | tarfile hardlink fallback ignores custom extraction filter rejection via None |