CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 03:44 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109934 New | OB Otter Blocks | 5.3 | Oct 23 | Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API |
| CVE-2026-109933 New | OB Otter Blocks | 6.8 | Oct 23 | Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes |
| CVE-2026-55835 New | LO lookyloo Lookyloo | 6.9 | Oct 23 | Lookyloo: Potential sub-system DoS due to parameter missmatch in notification |
| CVE-2026-86020 New | PA Part-DB-server Part-DB | 4.6 | Oct 23 | Part-DB: Spreadsheet Formula Injection in XLSX Part Exports |
| CVE-2026-86019 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Attachment Size Limit Bypass via API Base64 Upload |
| CVE-2026-86018 New | PA Part-DB-server Part-DB | 5.3 | Oct 23 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads |
| CVE-2026-59188 New | PA Part-DB-server Part-DB | 5.4 | Oct 23 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer |
| CVE-2026-55600 New | PA Part-DB-server Part-DB | 5.7 | Oct 23 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name |
| CVE-2026-54631 New | PA Part-DB-server Part-DB | 6.3 | Oct 23 | Part-DB: Hardcoded APP_SECRET enables forged remember-me cookie |
| CVE-2026-90458 New | IR Ironic OpenStack | 5.4 | Oct 23 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service |