CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:57 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-88016 | RC rclone rclone | 7.1 | Sep 10 | rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination |
| CVE-2026-88959 | AC Anchor CMS anchorcms | 8.8 | Sep 10 | Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints |
| CVE-2026-81468 | T1 ThinOS 10 Dell | 7.2 | Sep 10 | Dell ThinOS 10, versions prior to 2605_10 |
| CVE-2026-4130 | SY SystemLink NI | 7.1 | Sep 10 | Storage of Sensitive Information in Cleartext in NI SystemLink |
| CVE-2026-4129 | SY SystemLink NI | 8.1 | Sep 10 | Improper Access Controls in NI SystemLink |
| CVE-2026-81048 | T1 ThinOS 10 Dell | 8.8 | Sep 10 | Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability |
| CVE-2026-88011 | TR traefik traefik | 8.1 | Sep 10 | Traefik: ForwardAuth identity spoofing via dot-form header alias |
| CVE-2026-88939 | KN knowns knowns-dev | 8.3 | Sep 10 | knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption |
| CVE-2026-88937 | KN knowns knowns-dev | 8.8 | Sep 10 | knowns through 0.33.0 Path Traversal via Template Engine |
| CVE-2026-88009 | TR traefik traefik | 8.2 | Sep 10 | Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging |
| CVE-2026-88004 | TR traefik traefik | 7.4 | Sep 10 | Traefik entrypoint header-name sanitization bypassed via request trailers |
| CVE-2026-88924 | GV gvfs GNOME | 7.0 | Sep 10 | Gvfs: gvfs-admin socket ownership race permits local root |
| CVE-2026-84821 | WF WP Fast Total Search Epsiloncool | 7.5 | Sep 10 | WordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability |
| CVE-2026-84819 | WP WPAdverts Greg Winiarski | 7.1 | Sep 10 | WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-84816 | WP WPCS RealMag777 | 7.1 | Sep 10 | WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-81805 | SI SiteSkite SiteSkite | 8.1 | Sep 10 | WordPress SiteSkite plugin <= 2.1.5 - Privilege Escalation vulnerability |
| CVE-2026-81804 | ZB ZHBackup – Backup, Restore & Migration Zain Hassan | 7.5 | Sep 10 | WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability |
| CVE-2026-81803 | RE RepairBuddy Ateeq Rafeeq | 7.5 | Sep 10 | WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-81801 | WP WP-Stateless UDX Usability Dynamics | 8.1 | Sep 10 | WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability |
| CVE-2026-81799 | RR Return Refund and Exchange For WooCommerce WP Swings | 7.5 | Sep 10 | WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability |
| CVE-2026-81796 | WT WP Travel WEN Solutions | 7.3 | Sep 10 | WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability |
| CVE-2026-81795 | PV Page Visits Counter – Lite Denis Botić | 7.1 | Sep 10 | WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-81794 | SP Shirt Product Designer for WooCommerce mlfactory | 7.5 | Sep 10 | WordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability |
| CVE-2026-81789 | AP Advanced Product Fields Extended for WooCommerce Studio Wombat | 8.6 | Sep 10 | WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability |
| CVE-2026-81786 | TY Thank You Page Customizer for WooCommerce VillaTheme | 7.5 | Sep 10 | WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability |
| CVE-2026-81784 | WC Wise Chat Marcin | 8.1 | Sep 10 | WordPress Wise Chat plugin <= 3.4.2 - PHP Object Injection vulnerability |
| CVE-2026-81783 | MG MailMunch – Grow your Email List mailmunch | 7.1 | Sep 10 | WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability |
| CVE-2026-45747 | SU suricata OISF | 7.5 | Sep 10 | Suricata lua/tls: null dereference in TlsGetCertInfo |
| CVE-2026-46387 | SU suricata OISF | 7.5 | Sep 10 | Suricata http2: decompression bomb can cause denial of service in Suricata |
| CVE-2026-75584 | IO ION-DTN nasa-jpl | 7.5 | Sep 10 | ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion |
| CVE-2026-64838 | IC ICEcoder ICEcoder | 8.3 | Sep 10 | ICEcoder through 8.1 Path Traversal via oldFileName Parameter |
| CVE-2026-64837 | IC ICEcoder ICEcoder | 8.8 | Sep 10 | ICEcoder through 8.1 OS Command Injection via lib/properties.php |
| CVE-2026-64836 | IC ICEcoder ICEcoder | 8.8 | Sep 10 | ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement |
| CVE-2026-6285 | LI LIBRID/LIBREF Ankaref Innovation and Technology Inc. | 7.5 | Sep 10 | Improper Authentication in Ankaref's LIBRID/LIBREF |
| CVE-2026-85217 | FU Fusion Autodesk | 8.6 | Sep 10 | Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop |
| CVE-2026-88895 | CY cyberpanel usmannasir | 7.2 | Sep 10 | CyberPanel before 3.0.5 Authentication Bypass via API |
| CVE-2026-88893 | OP openpanel Openpanel-dev | 7.5 | Sep 10 | OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure |
| CVE-2026-88891 | OP openpanel Openpanel-dev | 8.3 | Sep 10 | OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations |
| CVE-2026-88890 | OP openpanel Openpanel-dev | 8.5 | Sep 10 | OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier |
| CVE-2026-88889 | ME mend-renovate-ce mend | 7.8 | Sep 10 | Renovate before 44.14.7 Command Injection via distributionType |
| CVE-2026-88888 | ME mend-renovate-ce mend | 7.0 | Sep 10 | Renovate before 44.14.7 Command Injection via Mix organization |
| CVE-2026-88887 | ME mend-renovate-ce mend | 8.6 | Sep 10 | Renovate before 44.11.2 Credential Exfiltration via Link Header |
| CVE-2026-88886 | ME mend-renovate-ce mend | 7.8 | Sep 10 | Renovate before 44.14.7 Command Injection via gradle-wrapper |
| CVE-2026-88885 | ME mend-renovate-ce mend | 7.0 | Sep 10 | Renovate before 44.14.7 Command Injection via depName |
| CVE-2026-88883 | ME mend-renovate-ce mend | 7.7 | Sep 10 | Renovate before 44.14.4 TLS Private Key Log Sanitisation |
| CVE-2026-88882 | ME mend-renovate-ce mend | 8.6 | Sep 10 | Renovate before 44.11.2 Credential Exfiltration via Link Header |
| CVE-2026-88881 | ME mend-renovate-ce mend | 8.6 | Sep 10 | Renovate before 44.11.3 Credential Exfiltration via Link Header |
| CVE-2026-88880 | ME mend-renovate-ce mend | 8.6 | Sep 10 | Renovate before 44.11.3 Credential Exfiltration via Link Header |
| CVE-2026-88879 | TR traefik traefik | 8.2 | Sep 10 | Traefik before v2.11.56 Identity Spoofing via Header Alias |
| CVE-2026-88876 | AV AVideo WWBN | 7.5 | Sep 10 | AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD |