CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 11:20 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102484 New | NT ntpsec NTPsec | 6.4 | Oct 21 | Heap-based Buffer Overflow in ntpsec |
| CVE-2026-114462 New | VS vServer Velneo | 6.0 | Oct 21 | Arbitrary File Read via Symlink in Velneo vServer HTTP Server |
| CVE-2026-114253 New | FI file-management-system-php oretnom23 | 6.3 | Oct 21 | oretnom23 file-management-system-php index.php include file inclusion |
| CVE-2026-114252 New | SA Sales-and-Inventory-System itsourcecode | 6.3 | Oct 21 | itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection |
| CVE-2026-114251 New | SA Sales-and-Inventory-System itsourcecode | 6.3 | Oct 21 | itsourcecode Sales-and-Inventory-System cust_del.php sql injection |
| CVE-2026-114250 New | SA Sales-and-Inventory-System itsourcecode | 6.3 | Oct 21 | itsourcecode Sales-and-Inventory-System cust_edit.php sql injection |
| CVE-2026-111835 New | BS BjornTech Swish for WooCommerce bjorntech | 6.5 | Oct 21 | WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability |
| CVE-2026-111837 New | CG Contest Gallery Wasiliy Strecker | 6.5 | Oct 21 | WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-6423 New | WA WSO2 API Manager WSO2 | 4.0 | Oct 21 | Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage |
| CVE-2026-104947 New | WA WarehousePG EnterpriseDB | 5.3 | Oct 21 | WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts() |
| CVE-2026-114437 New | CH chi go-chi | 4.8 | Oct 21 | Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For |
| CVE-2024-7478 New | WA WSO2 API Manager WSO2 | 5.8 | Oct 21 | Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery |
| CVE-2024-5563 New | WI WSO2 Identity Server WSO2 | 4.8 | Oct 21 | Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks |
| CVE-2024-4989 New | WA WSO2 API Manager WSO2 | 5.4 | Oct 21 | Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks |
| CVE-2024-5139 New | WA WSO2 API Manager WSO2 | 6.1 | Oct 21 | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection |
| CVE-2026-111849 New | WP WpTravelly Magepeople inc. | 5.3 | Oct 21 | WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability |
| CVE-2026-114248 New | IN Insurance-Management-System dhikshitha29 | 5.3 | Oct 21 | dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php missing authentication |
| CVE-2026-114404 New | PH PHPPresentation PHPOffice | 6.1 | Oct 21 | PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions |
| CVE-2026-114402 New | TR trudesk polonel | 4.3 | Oct 21 | Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload |
| CVE-2026-114401 New | TR trudesk polonel | 5.3 | Oct 21 | Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login |
| CVE-2026-114400 New | TR trudesk polonel | 5.9 | Oct 21 | Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads |
| CVE-2026-114399 New | TR trudesk polonel | 6.5 | Oct 21 | Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API |
| CVE-2026-114398 New | TR trudesk polonel | 5.4 | Oct 21 | Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo |
| CVE-2026-114395 New | TR trudesk polonel | 4.3 | Oct 21 | Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send |
| CVE-2026-114394 New | TR trudesk polonel | 4.3 | Oct 21 | Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs |
| CVE-2026-114393 New | TR trudesk polonel | 4.3 | Oct 21 | Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints |
| CVE-2026-114392 New | TR trudesk polonel | 5.3 | Oct 21 | Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid |
| CVE-2026-114390 New | CH chamilo-lms chamilo | 5.3 | Oct 21 | Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers |
| CVE-2026-114389 New | CH chamilo-lms chamilo | 4.3 | Oct 21 | Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade |
| CVE-2026-114388 New | CH chamilo-lms chamilo | 5.3 | Oct 21 | Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController |
| CVE-2026-114386 New | PY pydantic-ai-harness pydantic | 4.8 | Oct 21 | Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code |
| CVE-2026-114120 New | SC SchedulePress WPDeveloper | 5.4 | Oct 21 | SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action |
| CVE-2026-90484 New | AB Apache bRPC Apache Software Foundation | 6.5 | Oct 21 | Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash |
| CVE-2026-87849 New | AB Apache bRPC Apache Software Foundation | 4.3 | Oct 21 | Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing |
| CVE-2026-84727 New | AB Apache bRPC Apache Software Foundation | 5.4 | Oct 21 | Apache bRPC: Use-After-Free in RTMP Chunk Stream Handling via Abort Message |
| CVE-2026-82953 New | AB Apache bRPC Apache Software Foundation | 5.3 | Oct 21 | Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service |
| CVE-2026-114407 New | E1 e107 e107inc | 6.1 | Oct 21 | e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter |