CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 16:26 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107645 | BC Blocksy Companion creativethemeshq | 9.1 | Oct 10 | Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter |
| CVE-2026-108474 | EX Exposed JetBrains | 9.8 | Oct 9 | In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions |
| CVE-2026-108269 | RA ra-tls-clients Privasys | 9.1 | Oct 9 | ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session |
| CVE-2026-108268 | EN enclave-os-virtual Privasys | 9.1 | Oct 9 | enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session |
| CVE-2026-108267 | GO go Privasys | 9.1 | Oct 9 | Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session |
| CVE-2026-108266 | RU rustls Privasys | 9.1 | Oct 9 | Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session |
| CVE-2026-108265 | EN enclave-os-mini Privasys | 9.1 | Oct 9 | enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session |
| CVE-2026-108264 | WI wizarr wizarrrr | 9.1 | Oct 9 | Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE) |
| CVE-2026-108263 | AS astron-agent iflytek | 9.9 | Oct 9 | Astron Agent: Unsandboxed code-node leads to cross-tenant RCE |
| CVE-2026-108261 | AP app @tinacms | 9.3 | Oct 9 | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment |
| CVE-2026-107845 | CO contao contao | 9.3 | Oct 9 | Contao: Cross-site scripting in the comments bundle |
| CVE-2026-107824 | X6 x64dbg-mcp-server duty1g | 9.3 | Oct 9 | x64dbg-MCP Server exposes debugger operations to unauthenticated network clients |
| CVE-2026-15340 | LS lwIP SMTP client Savannah | 9.8 | Oct 9 | Savannah lwIP SMTP client Classic Buffer Overflow |
| CVE-2026-108109 | PH phpnuxbill hotspotbilling | 9.1 | Oct 9 | PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code |
| CVE-2026-108107 | PH phpnuxbill hotspotbilling | 9.8 | Oct 9 | PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php |
| CVE-2026-105278 | OD openPDC (Docker image) Grid Protection Alliance | 9.8 | Oct 9 | Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials |
| CVE-2026-100730 | OP openHistorian Grid Protection Alliance | 9.8 | Oct 9 | Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data |
| CVE-2026-86405 | PV PrestaShop Virtual POS Module Sipay Electronic Money and Payment Services Inc. | 9.8 | Oct 9 | Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop |
| CVE-2026-85531 | OV OpenCart Virtual POS Module Sipay Electronic Money and Payment Services Inc. | 9.8 | Oct 9 | Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x |
| CVE-2026-107938 | AC Apache CXF Apache Software Foundation | 9.1 | Oct 9 | Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. |
| CVE-2026-97468 | AC Apache CXF Apache Software Foundation | 9.1 | Oct 9 | Apache CXF: Authentication bypass via weak cache keys for validated STS tokens |
| CVE-2026-71575 | AC Apache CXF Apache Software Foundation | 9.1 | Oct 9 | Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter |
| CVE-2026-93947 | TR Traveler Shinetheme | 9.3 | Oct 9 | WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability |
| CVE-2026-94503 | ZO Zombify PX-lab | 10.0 | Oct 9 | WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability |
| CVE-2026-96809 | EB EduAdmin Booking MultiNet Interactive AB | 9.3 | Oct 9 | WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability |
| CVE-2026-96331 | AS Ajax Search Pro wpdreams | 9.3 | Oct 9 | WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability |
| CVE-2026-96330 | TO tagDiv Opt-In Builder tagDiv | 9.3 | Oct 9 | WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability |
| CVE-2026-96328 | JP JNews - Pay Writer jegtheme | 9.3 | Oct 9 | WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability |
| CVE-2026-96327 | WP WPLMS VibeThemes | 9.3 | Oct 9 | WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability |
| CVE-2026-107935 | RH Red Hat Build of Podman Desktop Red Hat | 9.3 | Oct 9 | Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose |
| CVE-2026-76779 | SC Secure Connect Gateway (SCG) Policy Manager Dell | 9.8 | Oct 9 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability |
| CVE-2026-107909 | FA FalkorDB FalkorDB | 9.1 | Oct 9 | Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length |
| CVE-2026-107908 | FA FalkorDB FalkorDB | 9.8 | Oct 9 | Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message |
| CVE-2026-7826 | FA FalkorDB FalkorDB | 9.1 | Oct 9 | Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB |
| CVE-2026-5759 | FA FalkorDB FalkorDB | 9.8 | Oct 9 | Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB |
| CVE-2026-78797 | Product not mapped yet | 9.8 | Oct 9 | An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua |
| CVE-2026-78835 | Product not mapped yet | 9.8 | Oct 9 | Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials |
| CVE-2026-78796 | Product not mapped yet | 9.8 | Oct 9 | An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the… |
| CVE-2026-78663 | NE net/http Go standard library | 9.1 | Oct 8 | Double flow control refund on HTTP/2 server streams in net/http |
| CVE-2026-56857 | IN internal/syscall/windows Go standard library | 9.8 | Oct 8 | Root.Mkdir(All) can follow junctions out of the root on Windows in os |
| CVE-2026-96207 | MP Microsoft Partner Center Microsoft | 10.0 | Oct 8 | Microsoft Partner Center Elevation of Privilege Vulnerability |
| CVE-2026-94510 | MB Microsoft Bookings Microsoft | 9.9 | Oct 8 | Microsoft Bookings Elevation of Privilege Vulnerability |
| CVE-2026-88131 | MD Microsoft Dataverse Microsoft | 9.8 | Oct 8 | Microsoft Dataverse Remote Code Execution Vulnerability |
| CVE-2026-77900 | AA Azure App Service for Linux Microsoft | 9.8 | Oct 8 | Azure App Service Remote Code Execution Vulnerability |
| CVE-2026-107726 | HA hazelcast hazelcast | 9.3 | Oct 8 | Hazelcast: Arbitrary member memory access by low-privileged client |
| CVE-2026-107722 | FA fast-jwt nearform | 9.8 | Oct 8 | fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion |
| CVE-2026-75875 | GD Guardium Data Protection IBM | 9.8 | Oct 8 | Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection |
| CVE-2026-80381 | GD Guardium Data Protection IBM | 9.8 | Oct 8 | Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection |
| CVE-2026-82895 | GD Guardium Data Protection IBM | 9.8 | Oct 8 | Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection |
| CVE-2026-82900 | GD Guardium Data Protection IBM | 9.1 | Oct 8 | IBM Guardium Data Protection is affected by multiple vulnerabilities. |