CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 22:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-73496 | MC mcp-atlassian sooperset | 7.7 | Sep 14 | MCP Atlassian: Arbitrary server-side file read via attachment upload |
| CVE-2026-16428 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-16466 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-16673 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-17133 | AC App Connect Enterprise IBM | 7.8 | Sep 14 | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs |
| CVE-2026-17156 | AC App Connect Enterprise IBM | 7.8 | Sep 14 | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs |
| CVE-2026-17416 | AC App Connect Enterprise IBM | 7.8 | Sep 14 | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs |
| CVE-2026-17467 | CP Cloud Pak for Data System (Yosemite 1.0) IBM | 8.2 | Sep 14 | Vulnerabilities exists in IBM Cloud Pak for Data System |
| CVE-2026-19624 | EP Extra Packages for Enterprise Linux (EPEL) Fedora | 7.8 | Sep 14 | NetworkManager-l2tp: local privilege escalation via ipsec.conf injection |
| CVE-2026-82049 | CP CPython Python Software Foundation | 8.4 | Sep 14 | tarfile extraction filters allow file modification and content disclosure via hard link to symlink |
| CVE-2026-82035 | PY PyMuPDF PyMuPDF | 7.1 | Sep 14 | PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch |
| CVE-2026-89023 | DF Domain For Sale ThemeAtelier | 8.6 | Sep 14 | ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API |
| CVE-2026-90809 | NA nanobot HKUDS | 7.3 | Sep 14 | HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection |
| CVE-2026-77884 | GP Gallery - Private Photo Vault Brain Trust | 7.1 | Sep 14 | Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure |
| CVE-2026-86830 | IA iam-identity-center-team AWS | 7.2 | Sep 14 | Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center |
| CVE-2026-54180 | CR CRUD Laravel-Backpack | 7.6 | Sep 14 | backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) |
| CVE-2026-91080 | WE webhook adnanh | 7.5 | Sep 14 | webhook through 2.8.3 Memory Exhaustion via Oversized Request Body |
| CVE-2026-91079 | PL platform hcengineering | 8.5 | Sep 14 | Huly Platform through 0.7.426 SSRF via Print Service |
| CVE-2026-90946 | DE deepwiki-open AsyncFuncAI | 7.5 | Sep 14 | DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket |
| CVE-2026-90944 | LA laravel-crm krayin | 8.2 | Sep 14 | Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse |
| CVE-2026-54178 | CR CRUD Laravel-Backpack | 8.1 | Sep 14 | backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk |
| CVE-2026-54182 | CR CRUD Laravel-Backpack | 8.1 | Sep 14 | backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth) |
| CVE-2026-54175 | CR CRUD Laravel-Backpack | 7.6 | Sep 14 | backpack/crud: Unverified password change in MyAccountController via mass assignment |
| CVE-2026-86836 | EA Eclipse Ankaios Eclipse Foundation | 8.4 | Sep 14 | In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name… |
| CVE-2026-57577 | DO dotvvm riganti | 8.2 | Sep 14 | DotVVM: ReDOS in routing |
| CVE-2026-73494 | BL blaze http4s | 7.4 | Sep 14 | blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser |
| CVE-2026-53752 | DO docx4j-core org.docx4j | 7.5 | Sep 14 | docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service |
| CVE-2026-53659 | HT http4k http4k | 7.5 | Sep 14 | http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS |
| CVE-2026-85892 | ME Microsoft Edge (Chromium-based) Microsoft | 7.8 | Sep 14 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
| CVE-2026-55091 | FL flat-to-nested-js joaonuno | 7.5 | Sep 14 | flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key |
| CVE-2026-85921 | W1 Windows 11 version 26H1 Microsoft | 8.2 | Sep 14 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability |
| CVE-2026-54567 | FL flask-reuploaded jugmac00 | 7.5 | Sep 14 | Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641) |
| CVE-2026-90805 | ON online-clinic-management-system subhajitkhan | 7.3 | Sep 14 | subhajitkhan online-clinic-management-system doctorlogin.php sql injection |
| CVE-2026-70658 | PA pay pay-rails | 7.4 | Sep 14 | pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier |
| CVE-2026-49250 | CO conform edmundhung | 8.7 | Sep 14 | Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields |
| CVE-2026-54087 | EA EasyAdminBundle EasyCorp | 7.6 | Sep 14 | EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField |
| CVE-2026-34151 | XW xwiki-platform xwiki | 8.2 | Sep 14 | XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ |
| CVE-2026-19499 | GL glibc The GNU C Library | 7.7 | Sep 14 | Buffer overflow in strfmon and strfmon_l right-justification padding |
| CVE-2026-55253 | LA langchain-mongodb langchain-ai | 7.7 | Sep 14 | LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure |
| CVE-2026-50276 | DD dd-trace-rb DataDog | 7.5 | Sep 14 | dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-50270 | DD dd-java-agent com.datadoghq | 7.5 | Sep 14 | dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS |
| CVE-2026-59960 | AR argos-javascript argos-ci | 7.5 | Sep 14 | Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core |
| CVE-2026-57579 | AL alchemy_cms AlchemyCMS | 7.5 | Sep 14 | Alchemy: Unauthenticated nested page API leaks restricted & unpublished content |
| CVE-2026-55416 | PI pimcore pimcore | 8.8 | Sep 14 | Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization |
| CVE-2026-55072 | PI pimcore pimcore | 8.5 | Sep 14 | Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name |
| CVE-2026-55451 | GE gettext-converter locize | 8.3 | Sep 14 | gettext-converter: Prototype pollution in js2i18next() via crafted translation keys |
| CVE-2026-84445 | GR grpc-go grpc | 8.7 | Sep 14 | gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers |
| CVE-2026-76442 | CS Cisco Secure Email Cisco | 7.5 | Sep 14 | Cisco Secure Email Gateway Security Hardening Release |
| CVE-2026-54156 | NO node-opcua node-opcua | 7.5 | Sep 14 | node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS |
| CVE-2026-54155 | NO node-opcua node-opcua | 7.7 | Sep 14 | node-opcua: Missing nonce verification in UserNameIdentityToken authentication |