CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:58 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-87759 | AU Add User Autocomplete | 8.8 | Sep 12 | Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation |
| CVE-2026-84099 | WP wpstorecart | 8.1 | Sep 12 | IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php |
| CVE-2026-84047 | AC Album Cover Finder | 8.6 | Sep 12 | Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action |
| CVE-2026-81742 | BR BE REST Endpoints | 8.8 | Sep 12 | BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation |
| CVE-2026-81429 | EI Export & Import WPBakery Page Builder | 7.1 | Sep 12 | Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF |
| CVE-2026-81090 | GP Gpx2Graphics | 7.2 | Sep 12 | Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF |
| CVE-2026-80494 | YW Yogeta WP Cloud | 8.6 | Sep 12 | Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download |
| CVE-2026-80491 | SF SAMO Forms | 8.6 | Sep 12 | SAMO Forms <= 1.0.0 - Unauthenticated SQLi |
| CVE-2026-77752 | TL Temporary Login Without Password | 7.2 | Sep 12 | Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation |
| CVE-2026-77705 | BF Booking for Appointments and Events Calendar | 7.2 | Sep 12 | Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover |
| CVE-2026-89266 | ST stb_vorbis nothings | 8.2 | Sep 11 | stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands |
| CVE-2026-90456 | MA Malcolm CISA | 8.1 | Sep 11 | Use of default credentials in Malcolm |
| CVE-2026-90444 | MA Malcolm CISA | 8.8 | Sep 11 | OS Command Injection in Malcolm |
| CVE-2026-50013 | HO hoverfly SpectoLabs | 7.5 | Sep 11 | Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode |
| CVE-2026-49846 | LI libks signalwire | 7.5 | Sep 11 | libks has path traversal in kws HTTP parser via URI segment overflow |
| CVE-2026-90460 | KE Keystone OpenStack | 7.6 | Sep 11 | An issue was discovered in OpenStack Keystone before 29.0.3 |
| CVE-2026-54241 | LI libde265 strukturag | 7.4 | Sep 11 | libde265: SAO sequential filter heap buffer overflow via signed integer overflow |
| CVE-2026-54240 | LI libde265 strukturag | 7.4 | Sep 11 | libde265: Pixel accessor signed integer overflow causes heap OOB read/write |
| CVE-2026-44715 | OR org.openmrs.module:legacyui-api openmrs | 8.7 | Sep 11 | OpenMRS has Broken Access Control in HL7 Configuration |
| CVE-2026-54166 | SH shelf.nu Shelf-nu | 7.1 | Sep 11 | Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass |
| CVE-2026-54174 | AP apko chainguard-dev | 8.3 | Sep 11 | melange: Incomplete package integrity verification allows data section substitution |
| CVE-2026-47773 | AR ArduinoBLE arduino-libraries | 7.2 | Sep 11 | ArduinoBLE: Memory corruption via malformed ATT write request |
| CVE-2026-49464 | NL nl-portal-backend-libraries nl-portal | 8.1 | Sep 11 | NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak |
| CVE-2026-81907 | CC Concrete CMS Concrete CMS | 7.1 | Sep 11 | Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records |
| CVE-2026-89771 | LI Linux Linux | 7.8 | Sep 11 | ring-buffer: Fix subbuf resize race with ring buffer readers |
| CVE-2026-89769 | LI Linux Linux | 7.4 | Sep 11 | clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path |
| CVE-2026-89767 | LI Linux Linux | 7.8 | Sep 11 | ovl: fix double end_creating() on the casefold-mismatch path |
| CVE-2026-89764 | LI Linux Linux | 7.8 | Sep 11 | rust: devres: fix race between concurrent revokers |
| CVE-2026-89763 | LI Linux Linux | 7.8 | Sep 11 | KEYS: trusted: Fix TPM teardown ordering |
| CVE-2026-89762 | LI Linux Linux | 7.8 | Sep 11 | apparmor: fix cred UAF caused by begin_current_label_crit_section() |
| CVE-2026-89761 | LI Linux Linux | 7.8 | Sep 11 | apparmor: fix out-of-bounds write when null terminating a label vec |
| CVE-2026-89760 | LI Linux Linux | 7.8 | Sep 11 | mm, swap: don't free a hibernation slot that is in the swap cache |
| CVE-2026-89758 | LI Linux Linux | 7.8 | Sep 11 | mm/mempolicy: skip non-present PMDs when queueing folios |
| CVE-2026-89755 | LI Linux Linux | 7.8 | Sep 11 | mm/migrate_device: clear stale mapping after freeing swapcache |
| CVE-2026-89754 | LI Linux Linux | 7.8 | Sep 11 | mm/pagewalk: fix stale walk->action escaping walk_pmd_range() |
| CVE-2026-89750 | LI Linux Linux | 7.8 | Sep 11 | tracing/user_events: Clear copied tracing state before fork duplication |
| CVE-2026-89748 | LI Linux Linux | 7.8 | Sep 11 | tracing: Fix retry exhaustion in simple ring buffer reader swap |
| CVE-2026-89747 | LI Linux Linux | 7.8 | Sep 11 | tracing: Fix use-after-free in trace_pipe read on sub-buffer order change |
| CVE-2026-89746 | LI Linux Linux | 7.8 | Sep 11 | tracing: Fix use-after-free with same-name named triggers |
| CVE-2026-89744 | LI Linux Linux | 8.4 | Sep 11 | device property: fix infinite loop in fwnode_for_each_child_node() |
| CVE-2026-89743 | LI Linux Linux | 7.7 | Sep 11 | misc: nsm: bound the device-reported response length |
| CVE-2026-89742 | LI Linux Linux | 7.8 | Sep 11 | rapidio: mport_cdev: fix use-after-free in dma_req_free() |
| CVE-2026-89741 | LI Linux Linux | 7.8 | Sep 11 | Revert "media: v4l2-dev: fix error handling in __video_register_device()" |
| CVE-2026-89738 | LI Linux Linux | 7.8 | Sep 11 | usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed |
| CVE-2026-89736 | LI Linux Linux | 7.8 | Sep 11 | usb: gadget: u_audio: Fix use-after-free on sound card disconnect |
| CVE-2026-89733 | LI Linux Linux | 7.8 | Sep 11 | usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() |
| CVE-2026-89731 | LI Linux Linux | 7.1 | Sep 11 | cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read |
| CVE-2026-89729 | LI Linux Linux | 8.8 | Sep 11 | HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature |
| CVE-2026-89725 | LI Linux Linux | 8.8 | Sep 11 | media: cec: stm32: prevent out-of-bounds write on RX overflow |
| CVE-2026-89724 | LI Linux Linux | 7.8 | Sep 11 | media: vicodec: fix out-of-bounds write in FWHT encoder |