CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:49 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102855 | OF Office Microsoft | 8.8 | Oct 13 | Microsoft Office Visio Remote Code Execution Vulnerability |
| CVE-2026-70098 | VS Visual Studio Code Microsoft | 8.8 | Oct 13 | Visual Studio Code Remote Code Execution Vulnerability |
| CVE-2026-102238 | VS Visual Studio Code Microsoft | 9.6 | Oct 13 | Visual Studio Code Remote Code Execution Vulnerability |
| CVE-2026-102235 | VS Visual Studio Code Microsoft | 8.8 | Oct 13 | Visual Studio Code Remote Code Execution Vulnerability |
| CVE-2026-102234 | VS Visual Studio Code Microsoft | 7.4 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-102233 | VS Visual Studio Code Microsoft | 7.8 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-102232 | VS Visual Studio Code Microsoft | 7.0 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-102231 | VS Visual Studio Code Microsoft | 7.7 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-102229 | VS Visual Studio Code Microsoft | 6.8 | Oct 13 | Visual Studio Code Information Disclosure Vulnerability |
| CVE-2026-102227 | W1 Windows 10 Version 1607 Microsoft | 7.8 | Oct 13 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability |
| CVE-2026-108468 | W1 Windows 10 Version 1607 Microsoft | 7.0 | Oct 13 | Windows Installer Elevation of Privilege Vulnerability |
| CVE-2026-108457 | W1 Windows 10 Version 21H2 Microsoft | 8.1 | Oct 13 | Microsoft Windows PDF Remote Code Execution Vulnerability |
| CVE-2026-108400 | HV HEVC Video Extensions Microsoft | 8.8 | Oct 13 | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2026-105728 | MD Microsoft Dynamics NAV 2018 Microsoft | 7.5 | Oct 13 | Dynamics Business Central Information Disclosure Vulnerability |
| CVE-2026-105727 | MD Microsoft Dynamics NAV 2018 Microsoft | 8.8 | Oct 13 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
| CVE-2026-105725 | WS Windows Security App Microsoft | 7.0 | Oct 13 | Windows Security App Elevation of Privilege Vulnerability |
| CVE-2026-103572 | MV Microsoft Visual Studio 2022 version 17.14 Microsoft | 8.8 | Oct 13 | Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability |
| CVE-2026-102850 | OF Office Microsoft | 8.8 | Oct 13 | Microsoft Office Access Remote Code Execution Vulnerability |
| CVE-2026-102849 | OF Office Microsoft | 8.8 | Oct 13 | Microsoft Office Access Remote Code Execution Vulnerability |
| CVE-2026-110240 | LA lancet duke-git | 4.8 | Oct 13 | Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP |
| CVE-2026-110239 | RA rapyd-admin zofe | 4.4 | Oct 13 | Rapyd Admin before 9.20.0 Stored XSS via rich-text Component |
| CVE-2026-110238 | RA rapyd-admin zofe | 8.8 | Oct 13 | Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component |
| CVE-2026-110237 | VI vifm vifm | 7.3 | Oct 13 | Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution |
| CVE-2026-110236 | DO Dolphin KDE | 7.0 | Oct 13 | KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name |
| CVE-2026-110235 | MM MP Manager Abdurazaaq Mohammed | 5.5 | Oct 13 | MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass |
| CVE-2026-110234 | EL elio elio-fm | 4.4 | Oct 13 | Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture |
| CVE-2026-110233 | RO rovr NSPC911 | 7.8 | Oct 13 | rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe |
| CVE-2026-110232 | FF Fossify File Manager Fossify | 3.3 | Oct 13 | Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity |
| CVE-2026-110231 | MU muCommander muCommander | 4.7 | Oct 13 | muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP |
| CVE-2026-110230 | XB XBackBone sergix44 | 5.4 | Oct 13 | XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint |
| CVE-2026-110229 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips |
| CVE-2026-110228 | WA wallabag wallabag | 5.4 | Oct 13 | wallabag 2.6.13 through 2.6.14 Stored XSS via Failed HTML Import Upload |
| CVE-2026-110226 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation |
| CVE-2026-110225 | SH Shaarli shaarli | 2.7 | Oct 13 | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route |
| CVE-2026-110224 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Search Alias Validation Errors |
| CVE-2026-110223 | KA Kavita Kareadita | 3.1 | Oct 13 | Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint |
| CVE-2026-110222 | IF IFSC Razorpay | 5.3 | Oct 13 | Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup |
| CVE-2026-110221 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact Value |
| CVE-2026-110220 | MR Model Registry Kubeflow | 7.1 | Oct 13 | Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation |
| CVE-2026-110219 | QL QloApps Webkul | 5.4 | Oct 13 | QloApps through 1.7.0 Reflected XSS via Additional Facility Price Field |
| CVE-2026-110218 | AE Aureus ERP Webkul | 3.7 | Oct 13 | Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL |
| CVE-2026-110217 | VH vhr lenve | 6.5 | Oct 13 | vhr through commit 03abbd3 Information Disclosure of Operator Password Hashes via GET /chat/hrs |
| CVE-2026-110216 | YO youlai-boot youlaitech | 7.1 | Oct 13 | youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint |
| CVE-2026-110215 | YO youlai-boot youlaitech | 8.8 | Oct 13 | youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation |
| CVE-2026-110214 | SN Snowy xiaonuobase | 3.7 | Oct 13 | Snowy 3.6.5 Hard-coded Download Signature Key Allows Unauthenticated File Download |
| CVE-2026-110213 | AI ai-fusion-video Stonewuu | 4.3 | Oct 13 | ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints |
| CVE-2026-110212 | AI ai-fusion-video Stonewuu | 4.3 | Oct 13 | ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter |
| CVE-2026-110211 | SK skillhub iflytek | 8.1 | Oct 13 | SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint |
| CVE-2026-110210 | PC Phase Console Phase | 5.3 | Oct 13 | Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query |
| CVE-2026-110209 | AI ai-fusion-video Stonewuu | 6.5 | Oct 13 | ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials |