CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:37 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-32557 | WA WooCommerce Appointments BookingWP | 9.3 | Oct 6 | WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability |
| CVE-2026-85153 | SD Schmooze dating mobile Application Schmooze | 9.3 | Oct 6 | Information Disclosure Vulnerability in Schmooze dating mobile Application |
| CVE-2026-105778 | AC AC5 Tenda | 9.9 | Oct 6 | Tenda AC5 Wifi setWifi stack-based overflow |
| CVE-2026-94293 | SA Software AAS Edge Client all versions Murrelektronik | 9.8 | Oct 6 | Missing authentication for critical function in the aas-edge-client REST API |
| CVE-2026-105484 | X6 X6000R TOTOLINK | 10.0 | Oct 6 | TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection |
| CVE-2025-71383 | Product not mapped yet | 9.8 | Oct 6 | Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field |
| CVE-2026-77178 | Product not mapped yet | 9.1 | Oct 6 | Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network… |
| CVE-2026-82989 | VC vCast Viewsonic | 9.8 | Oct 5 | There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service… |
| CVE-2026-105763 | TW twenty twentyhq | 9.6 | Oct 5 | Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL |
| CVE-2026-91107 | OP openSIS-Classic OS4ED | 9.3 | Oct 5 | openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR) |
| CVE-2026-105740 | LA langflow langflow-ai | 9.9 | Oct 5 | Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server |
| CVE-2026-105697 | LA langflow langflow-ai | 9.9 | Oct 5 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration |
| CVE-2026-105691 | PE penpot penpot | 9.9 | Oct 5 | Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color |
| CVE-2026-104711 | ST Struts Apache | 9.8 | Oct 5 | Apache Struts: OGNL injection in the legacy RESTful action mapper |
| CVE-2026-105641 | PL plane makeplane | 9.8 | Oct 5 | Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass |
| CVE-2026-105640 | PL plane makeplane | 9.1 | Oct 5 | Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab) |
| CVE-2026-105639 | PL plane makeplane | 9.8 | Oct 5 | Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane |
| CVE-2026-105638 | PL plane makeplane | 9.1 | Oct 5 | Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force |
| CVE-2026-103352 | WB WP BASE Booking WP BASE | 9.3 | Oct 5 | WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability |
| CVE-2026-97283 | AP Advanced Post Manager Liquid Web / StellarWP | 9.8 | Oct 5 | WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability |
| CVE-2026-105637 | PL plane makeplane | 9.6 | Oct 5 | Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) |
| CVE-2026-105636 | PL plane makeplane | 9.9 | Oct 5 | Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set) |
| CVE-2026-102780 | TC TF Content for Joomla joomlafry.com | 9.8 | Oct 5 | Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 |
| CVE-2026-102428 | OJ OrdaSoft Joomla CCK ordasoft.com | 9.8 | Oct 5 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 |
| CVE-2026-79820 | HI HPE Integrated Lights-Out (iLO) 7 Hewlett Packard Enterprise (HPE) | 9.0 | Oct 5 | A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware |
| CVE-2026-105285 | A3 A3002MU Totolink | 10.0 | Oct 5 | Totolink A3002MU QoS Rule formIpQoS stack-based overflow |
| CVE-2026-105284 | A3 A3002MU Totolink | 10.0 | Oct 5 | Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization |
| CVE-2026-103510 | PH P4 (Helix Core) Perforce | 9.5 | Oct 5 | Authentication bypass via blank auth token in P4Search |
| CVE-2026-100102 | PH P4 (Helix Core) Perforce | 9.5 | Oct 5 | RCE via exposed JDWP debug agent in P4Search |
| CVE-2026-100103 | PH P4 (Helix Core) Perfoce | 10.0 | Oct 5 | Authentication bypass via default auth token in P4Search |
| CVE-2017-20285 | Product not mapped yet | 9.1 | Oct 5 | YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes |
| CVE-2026-88391 | Product not mapped yet | 9.8 | Oct 5 | Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no… |
| CVE-2026-88424 | Product not mapped yet | 9.8 | Oct 5 | FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter() |
| CVE-2026-37719 | Product not mapped yet | 9.8 | Oct 5 | An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component |
| CVE-2026-88395 | Product not mapped yet | 9.8 | Oct 5 | GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter |
| CVE-2026-88393 | Product not mapped yet | 9.8 | Oct 5 | WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export |
| CVE-2026-105215 | ZI zitadel zitadel | 9.1 | Oct 4 | ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback |
| CVE-2026-105209 | ZI zitadel zitadel | 9.6 | Oct 4 | ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment |
| CVE-2026-105207 | ZI zitadel zitadel | 9.8 | Oct 4 | ZITADEL before 4.17.3 Account Takeover via External IdP Linking |
| CVE-2026-103355 | UE Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Unlimited Elements | 9.3 | Oct 4 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability |
| CVE-2026-105135 | MI MindSearch InternLM | 10.0 | Oct 4 | InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection |
| CVE-2026-105134 In wildKEV | AH AhsayCBS Ahsay | 10.0 | Oct 4 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection |
| CVE-2026-105105 | AI AIT-Core NASA-AMMOS | 9.8 | Oct 3 | Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration |
| CVE-2026-71885 | BC BC-JAVA Legion of the Bouncy Castle Inc. | 9.2 | Oct 3 | MLS X.509 credential not bound to the LeafNode signature key |
| CVE-2026-92084 | BB Beaver Builder Page Builder – Drag and Drop Website Builder beaverbuilder | 9.1 | Oct 3 | Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output |
| CVE-2026-87115 | VS VikAppointments Services Booking Calendar e4jvikwp | 9.1 | Oct 3 | VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter |
| CVE-2026-105080 | CO ConvertX C4illin | 9.9 | Oct 3 | In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre |
| CVE-2026-84411 | RO RouterOS MikroTik | 9.8 | Oct 2 | MikroTik RouterOS Integer Underflow |
| CVE-2026-95102 | MO monta.app Monta | 9.4 | Oct 2 | Monta monta.app Missing Authentication for Critical Function |
| CVE-2026-75937 | AP AnywhereUSB Plus Family Digi International | 9.4 | Oct 2 | OS Command Injection in Digi Accelerated Linux (DAL OS) |