CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:35 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-89176 | WE WeenyGenius Howyar | 8.8 | Sep 11 | Howyar｜WeenyGenius - Missing Authentication |
| CVE-2026-89174 | EH EH1000B Kingdom Communication Associated | 7.5 | Sep 11 | Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection |
| CVE-2026-73785 | HI HPE IceWall products Hewlett Packard Enterprise | 7.5 | Sep 11 | HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability |
| CVE-2026-87908 | MU multiparty multiparty | 7.5 | Sep 11 | multiparty vulnerable to Denial of Service via unbounded part-header accumulation |
| CVE-2026-73784 | HI HPE IceWall products Hewlett Packard Enterprise | 8.8 | Sep 11 | HPE IceWall products, Remote Bypass of Security Restrictions |
| CVE-2026-85677 | GN Gutenverse News | 8.8 | Sep 11 | Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content |
| CVE-2026-74925 | MU MultiVendorX | 7.2 | Sep 11 | MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator |
| CVE-2026-89060 | RH Red Hat Advanced Cluster Management for Kubernetes 2.13 Red Hat | 7.7 | Sep 11 | Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references |
| CVE-2026-89161 | PC PCRE2 PCRE | 7.8 | Sep 11 | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context |
| CVE-2026-89157 | PC PCRE2 PCRE | 7.4 | Sep 11 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern |
| CVE-2026-19991 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 8.1 | Sep 11 | UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion |
| CVE-2026-81754 | V1 Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… fernandot | 7.2 | Sep 11 | Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-18561 | UE Unlimited Elements For Elementor unitecms | 7.5 | Sep 11 | Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection |
| CVE-2026-81825 | SA Simple Ajax Chat – Add a Fast, Secure Chat Box specialk | 7.2 | Sep 11 | Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-15462 | SC Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons gingerplugins | 7.5 | Sep 11 | Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection |
| CVE-2026-18579 | WP WP Photo Album Plus opajaap | 7.2 | Sep 11 | WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-88260 | ZE Zenius EMS 8.0 Brainzcompany | 8.7 | Sep 11 | Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code… |
| CVE-2026-78135 | ST strongSwan strongSwan | 7.3 | Sep 11 | libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine |
| CVE-2026-78134 | ST strongSwan strongSwan | 7.1 | Sep 11 | strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity |
| CVE-2026-78133 | ST strongSwan strongSwan | 7.5 | Sep 11 | libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling |
| CVE-2026-78132 | ST strongSwan strongSwan | 7.5 | Sep 11 | strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax |
| CVE-2026-78130 | ST strongSwan strongSwan | 7.5 | Sep 11 | strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser |
| CVE-2026-79362 | Product not mapped yet | 8.8 | Sep 11 | Certain Woltlab products are affected by RCE via Cache Poisoning |
| CVE-2026-79394 | Product not mapped yet | 7.5 | Sep 11 | An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships… |
| CVE-2026-79393 | Product not mapped yet | 7.5 | Sep 11 | A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837… |
| CVE-2026-71646 | Product not mapped yet | 7.5 | Sep 11 | An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the… |
| CVE-2026-71641 | Product not mapped yet | 7.5 | Sep 11 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via thenteraction… |
| CVE-2026-78807 | Product not mapped yet | 7.1 | Sep 11 | An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the… |
| CVE-2026-77807 | AA AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress acyba | 7.5 | Sep 10 | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter |
| CVE-2026-17176 | DB Deco BE11000 V2 TP-Link Systems Inc. | 7.7 | Sep 10 | OS Command Injection Vulnerability in Deco Devices |
| CVE-2026-16174 | ED Endpoint DLP Netskope | 8.7 | Sep 10 | Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow |
| CVE-2026-2310 | WI webMethods Integration Server IBM | 7.8 | Sep 10 | IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data |
| CVE-2026-75624 | AC App Connect Enterprise IBM | 8.8 | Sep 10 | IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service |
| CVE-2026-75777 | AE Aspera Enterprise WebApps IBM | 8.8 | Sep 10 | Multiple vulnerabilities in IBM Aspera Enterprise Webapps |
| CVE-2026-76059 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-78569 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-78571 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-45770 | SU suricata OISF | 7.5 | Sep 10 | Suricata lua: excessive flow variable registration can bypass sandbox |
| CVE-2026-78575 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-79742 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-80380 | DO DataStage on Cloud Pak for Data IBM | 7.1 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-45769 | SU suricata OISF | 7.5 | Sep 10 | ikev2: unbounded client transform storage can lead to resource exhaustion |
| CVE-2026-45768 | SU suricata OISF | 7.5 | Sep 10 | Suricata ldap: unbounded responses per transaction can lead to resource exhaustion |
| CVE-2026-80436 | DO DataStage on Cloud Pak for Data IBM | 8.5 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81207 | DO DataStage on Cloud Pak for Data IBM | 8.5 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81210 | DO DataStage on Cloud Pak for Data IBM | 7.7 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81211 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-81941 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-81213 | LO Langflow OSS IBM | 8.6 | Sep 10 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches |
| CVE-2026-81265 | LO Langflow OSS IBM | 7.5 | Sep 10 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches |