CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 11:58 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-88270 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 6.5 | Sep 10 | GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service |
| CVE-2026-88269 | GV GV-LPC2011/LPC2211 GeoVision Inc. | 6.5 | Sep 10 | GV-LPC2011/LPC2211 - SSVR Guest Configuration and Credential Disclosure |
| CVE-2026-88268 | GV GV-LPCLPC2011/2211 GeoVision Inc. | 6.5 | Sep 10 | GV-LPC2011/LPC2211 - SSVR Fragment-Reassembly Stack Overflow Denial of Service |
| CVE-2026-88770 | RH Red Hat Build of Keycloak Red Hat | 6.5 | Sep 10 | Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts |
| CVE-2026-88763 | SI Service Interconnect 2 for RHEL 8 Red Hat | 5.9 | Sep 10 | Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service |
| CVE-2026-82582 | SH SHIRASAGI SHIRASAGI Project | 4.3 | Sep 10 | An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared… |
| CVE-2026-81635 | SH SHIRASAGI SHIRASAGI Project | 5.4 | Sep 10 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the… |
| CVE-2026-0304 | CX Cortex XDR Broker VM Palo Alto Networks | 4.8 | Sep 10 | Cortex XDR Broker VM: Privilege Escalation Vulnerability |
| CVE-2026-19840 | NO Notiqoo | 6.5 | Sep 10 | Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions |
| CVE-2026-0305 | PA Prisma Access Agent Palo Alto Networks | 4.3 | Sep 10 | Prisma Access Agent: Information Disclosure Vulnerability on Linux |
| CVE-2026-0306 | PA Prisma Access Agent Palo Alto Networks | 5.8 | Sep 10 | Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows |
| CVE-2026-0307 | GA GlobalProtect App Palo Alto Networks | 5.9 | Sep 10 | GlobalProtect App: Local Privilege Escalation Vulnerabilities |
| CVE-2026-0309 | PA PAN-OS Palo Alto Networks | 4.0 | Sep 10 | PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration |
| CVE-2026-85645 | FM Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 10web | 6.1 | Sep 10 | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting |
| CVE-2026-57822 | AA Apache ActiveMQ Artemis Apache Software Foundation | 6.5 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service |
| CVE-2026-75880 | AA Apache ActiveMQ Artemis Apache Software Foundation | 6.5 | Sep 10 | Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service |
| CVE-2026-4657 | EG Easy Google Fonts sunny_johal | 6.4 | Sep 10 | Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field |
| CVE-2026-15820 | BF Builderall for WordPress builderall | 6.4 | Sep 10 | Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting |
| CVE-2026-18594 | AC Advanced Contact form 7 DB vsourz1td | 4.3 | Sep 10 | Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id' |
| CVE-2026-18386 | WB WP BackItUp Community Edition cssimmon | 4.9 | Sep 10 | WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter |
| CVE-2026-15823 | BF Builderall for WordPress builderall | 4.3 | Sep 10 | Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter |
| CVE-2026-15796 | BF Builderall for WordPress builderall | 6.4 | Sep 10 | Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting |
| CVE-2026-87870 | NF Ninja Forms - Scheduled Exports Saturday Drive | 6.4 | Sep 10 | Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters |
| CVE-2026-84063 | BU BurgerEditor D-ZERO CO.,LTD. | 6.5 | Sep 10 | BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type |
| CVE-2026-84062 | BU BurgerEditor D-ZERO CO.,LTD. | 4.3 | Sep 10 | BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key |
| CVE-2026-52097 | Product not mapped yet | 6.8 | Sep 10 | An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex… |
| CVE-2026-79590 | Product not mapped yet | 6.5 | Sep 10 | A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0 |
| CVE-2026-36392 | Product not mapped yet | 5.4 | Sep 10 | FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2022-26962 | Product not mapped yet | 5.4 | Sep 10 | Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or… |
| CVE-2026-71642 | Product not mapped yet | 4.0 | Sep 10 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the… |
| CVE-2026-87926 | IN inventory-management-system Rizwan17 | 4.3 | Sep 9 | Rizwan17 inventory-management-system Login Page index.php cross site scripting |
| CVE-2026-87924 | IN inventory-management-system Rizwan17 | 6.5 | Sep 9 | Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication |
| CVE-2026-15460 | ZE zephyr zephyrproject | 5.4 | Sep 9 | Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path |
| CVE-2026-87923 | IN inventory-management-system Rizwan17 | 4.3 | Sep 9 | Rizwan17 inventory-management-system List DBOperation.php cross site scripting |
| CVE-2026-88002 | OP open-webui open-webui | 6.5 | Sep 9 | Open WebUI: Any authenticated user can hang the server via a cyclic chat message history |
| CVE-2026-88001 | OP open-webui open-webui | 5.0 | Sep 9 | Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets |
| CVE-2026-88000 | OP open-webui open-webui | 6.5 | Sep 9 | Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree |
| CVE-2026-87997 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions |
| CVE-2026-87994 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint |
| CVE-2026-87017 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends |
| CVE-2026-87015 | OP open-webui open-webui | 6.8 | Sep 9 | Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication |
| CVE-2026-87014 | OP open-webui open-webui | 6.5 | Sep 9 | Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes |
| CVE-2026-87013 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle |
| CVE-2026-87012 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value |
| CVE-2026-53956 | PY py-rattler conda | 5.4 | Sep 9 | Rattler vulnerable to package cache path traversal via conda package build string |
| CVE-2026-73789 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 5.3 | Sep 9 | Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface |
| CVE-2026-73788 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 6.5 | Sep 9 | Privilege Escalation in ClearPass OnGuard Agent |
| CVE-2026-87928 | MC MaxSite CMS MaxSite | 5.4 | Sep 9 | MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page |
| CVE-2026-85788 | AL AWS Labs MySQL MCP Server AWS | 5.5 | Sep 9 | Incomplete list of disallowed inputs in awslabs mysql-mcp-server |
| CVE-2026-40635 | PO PowerScale OneFS Dell | 5.4 | Sep 9 | Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability |