CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 20:48 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82428 | AS Apache Storm Client Apache Software Foundation | 8.8 | Sep 14 | Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys |
| CVE-2026-82429 | AS Apache Storm Worker Launcher Apache Software Foundation | 7.8 | Sep 14 | Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher |
| CVE-2026-82430 | AS Apache Storm Worker Launcher Apache Software Foundation | 7.8 | Sep 14 | Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant |
| CVE-2026-90789 | LM Leave Management System itsourcecode | 7.3 | Sep 14 | itsourcecode Leave Management System login.php sql injection |
| CVE-2026-82432 | AS Apache Storm Nimbus Apache Software Foundation | 8.1 | Sep 14 | Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides |
| CVE-2026-15600 | RA raty Alior Bank | 8.6 | Sep 14 | SQL Injection in Alior Bank raty PrestaShop module |
| CVE-2026-7848 | RA raty Alior Bank | 8.6 | Sep 14 | SQL Injection in Alior Bank raty PrestaShop module |
| CVE-2026-82438 | AS Apache Storm Webapp Apache Software Foundation | 8.1 | Sep 14 | Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins |
| CVE-2026-90787 | ST StudentManagement Soarkey | 7.3 | Sep 14 | Soarkey StudentManagement Registration Workflow register.html RegisterServlet.doPost privileges management |
| CVE-2026-73195 | AS Apache Syncope Apache Software Foundation | 7.3 | Sep 14 | Apache Syncope: CSV export spreadsheet formula injection |
| CVE-2026-73236 | AS Apache Syncope Apache Software Foundation | 7.5 | Sep 14 | Apache Syncope: Cross-Realm authorization bypass in delegated administration |
| CVE-2026-90949 | RH Red Hat Enterprise Linux 6 Red Hat | 7.8 | Sep 14 | Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch |
| CVE-2026-90948 | RH Red Hat Enterprise Linux 6 Red Hat | 7.8 | Sep 14 | Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions |
| CVE-2026-73178 | AS Apache Syncope Apache Software Foundation | 7.5 | Sep 14 | Apache Syncope: JWT Access Token takeover |
| CVE-2026-90938 | LA LangBot langbot-app | 8.6 | Sep 14 | LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket |
| CVE-2026-90933 | LA laradashboard laradashboard | 7.1 | Sep 14 | laradashboard through 1.2.2 Missing Authorization via License API |
| CVE-2026-90932 | LA laradashboard laradashboard | 7.2 | Sep 14 | LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE |
| CVE-2026-90929 | FI filebrowser filebrowser | 8.1 | Sep 14 | File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup |
| CVE-2024-58383 | FR froxlor froxlor | 7.3 | Sep 14 | Froxlor before 2.2.0 Insecure File Permissions mysql.conf |
| CVE-2026-90715 | GR Gravity marcobambini | 7.3 | Sep 14 | marcobambini Gravity udp json-parser gravity_json.c integer overflow |
| CVE-2026-78336 | AS Apache Syncope Apache Software Foundation | 7.5 | Sep 14 | Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user |
| CVE-2026-90710 | TA tarzan-cms taisan | 7.3 | Sep 14 | taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery |
| CVE-2026-90708 | CM CMS Yot | 7.3 | Sep 14 | Yot CMS Cookie global.php login sql injection |
| CVE-2026-81564 | SP SP Page Builder (Free and Pro) extension for Joomla joomshaper.com | 7.0 | Sep 14 | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 |
| CVE-2026-78375 | SP SP Page Builder (Free and Pro) extension for Joomla joomshaper.com | 8.6 | Sep 14 | Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 |
| CVE-2026-90707 | OP Open5GS Open5gs | 8.3 | Sep 14 | Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free |
| CVE-2026-20773 | PI PingFederate Ping Identity | 8.5 | Sep 14 | Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint |
| CVE-2026-87779 | AS Apache Syncope Apache Software Foundation | 7.5 | Sep 14 | Apache Syncope: AES Secret Key disclosure via log output |
| CVE-2026-8821 | MA Mattermost Mattermost | 7.1 | Sep 14 | Playbooks run owner channel membership permission bypass |
| CVE-2026-89180 | EF EFence Thinking Software Technology | 7.5 | Sep 14 | Thinking Software Technology｜EFence - SQL Injection |
| CVE-2026-72524 | AD Apache Doris Apache Software Foundation | 8.8 | Sep 14 | Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables |
| CVE-2026-90894 | PD Parallels Desktop for Mac Parallels | 7.8 | Sep 14 | Parallels Desktop local privilege escalation via appliance extract argument injection |
| CVE-2026-90895 | MI MISP MISP | 8.4 | Sep 14 | MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection |
| CVE-2026-90701 | ON online-clinic-management-system subhajitkhan | 7.3 | Sep 14 | subhajitkhan online-clinic-management-system listdoctor.php sql injection |
| CVE-2026-12518 | LO Logi Options+ Logitech | 8.5 | Sep 14 | Local privilege escalation in the Logi Options+ updater service on Windows |
| CVE-2026-71198 | GL Glance OpenStack | 7.0 | Sep 14 | In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image |
| CVE-2026-82794 | SV SV-CPT-MC310 Contec Co., Ltd. | 8.8 | Sep 14 | SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings |
| CVE-2026-82793 | CA CAN-2-USB Contec Co., Ltd. | 7.2 | Sep 14 | Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit |
| CVE-2026-82765 | FX FXA3000 Contec Co., Ltd. | 8.1 | Sep 14 | Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series |
| CVE-2026-82791 | CA CAN-2-USB Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit |
| CVE-2026-90691 | HA HexStrike AI 0x4m4 | 8.3 | Sep 14 | 0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal |
| CVE-2026-82789 | CH CONPROSYS HMI System(CHS) Contec | 8.8 | Sep 14 | An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS) |
| CVE-2026-82780 | CP CPS-TM341G5MB-ADSC1-931 Contec Co., Ltd | 8.8 | Sep 14 | Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series |
| CVE-2026-82779 | CP CPS-TM341G5MB-ADSC1-931 Contec Co., Ltd | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series |
| CVE-2026-82777 | CT Configurable type CPS-PCS341[][]-DS1-1201 Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series |
| CVE-2026-82774 | MC M2M Controller Configurable type CPS-MCS341* Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series |
| CVE-2026-82772 | EC ECE1000 Contec Co., Ltd. | 8.8 | Sep 14 | Buffer overflow vulnerability exists in Contec EC1000 series |
| CVE-2026-82770 | RP RP-WAH-SR1 Contec Co., Ltd. | 8.8 | Sep 14 | Buffer overflow vulnerability exists in Contec RP-WAH-SR Series |
| CVE-2026-82768 | SG SGA1000 Contec Co., Ltd. | 8.1 | Sep 14 | Path traversal vulnerability exists in SGA1000 |
| CVE-2026-82766 | SG SGA1000 Contec Co., Ltd. | 8.8 | Sep 14 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000 |