CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 18:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-81825 | SA Simple Ajax Chat – Add a Fast, Secure Chat Box specialk | 7.2 | Sep 11 | Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-15462 | SC Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons gingerplugins | 7.5 | Sep 11 | Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection |
| CVE-2026-18579 | WP WP Photo Album Plus opajaap | 7.2 | Sep 11 | WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-88260 | ZE Zenius EMS 8.0 Brainzcompany | 8.7 | Sep 11 | Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vulnerability in Brainzcompany Zenius EMS 8.0 allows Remote Code… |
| CVE-2026-78135 | ST strongSwan strongSwan | 7.3 | Sep 11 | libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine |
| CVE-2026-78134 | ST strongSwan strongSwan | 7.1 | Sep 11 | strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity |
| CVE-2026-78133 | ST strongSwan strongSwan | 7.5 | Sep 11 | libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling |
| CVE-2026-78132 | ST strongSwan strongSwan | 7.5 | Sep 11 | strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax |
| CVE-2026-78130 | ST strongSwan strongSwan | 7.5 | Sep 11 | strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser |
| CVE-2026-79362 | Product not mapped yet | 8.8 | Sep 11 | Certain Woltlab products are affected by RCE via Cache Poisoning |
| CVE-2026-79393 | Product not mapped yet | 7.5 | Sep 11 | A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837… |
| CVE-2026-79394 | Product not mapped yet | 7.5 | Sep 11 | An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships… |
| CVE-2026-71641 | Product not mapped yet | 7.5 | Sep 11 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via thenteraction… |
| CVE-2026-71646 | Product not mapped yet | 7.5 | Sep 11 | An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the… |
| CVE-2026-78807 | Product not mapped yet | 7.1 | Sep 11 | An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the… |
| CVE-2026-77807 | AA AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress acyba | 7.5 | Sep 10 | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter |
| CVE-2026-17176 | DB Deco BE11000 V2 TP-Link Systems Inc. | 7.7 | Sep 10 | OS Command Injection Vulnerability in Deco Devices |
| CVE-2026-16174 | ED Endpoint DLP Netskope | 8.7 | Sep 10 | Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow |
| CVE-2026-2310 | WI webMethods Integration Server IBM | 7.8 | Sep 10 | IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data |
| CVE-2026-75624 | AC App Connect Enterprise IBM | 8.8 | Sep 10 | IBM App Connect Enterprise is vulnerable to privilege escalation and Denial of Service |
| CVE-2026-75777 | AE Aspera Enterprise WebApps IBM | 8.8 | Sep 10 | Multiple vulnerabilities in IBM Aspera Enterprise Webapps |
| CVE-2026-76059 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-78569 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-78571 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-45770 | SU suricata OISF | 7.5 | Sep 10 | Suricata lua: excessive flow variable registration can bypass sandbox |
| CVE-2026-78575 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-79742 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-80380 | DO DataStage on Cloud Pak for Data IBM | 7.1 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-45769 | SU suricata OISF | 7.5 | Sep 10 | ikev2: unbounded client transform storage can lead to resource exhaustion |
| CVE-2026-45768 | SU suricata OISF | 7.5 | Sep 10 | Suricata ldap: unbounded responses per transaction can lead to resource exhaustion |
| CVE-2026-80436 | DO DataStage on Cloud Pak for Data IBM | 8.5 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81207 | DO DataStage on Cloud Pak for Data IBM | 8.5 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81210 | DO DataStage on Cloud Pak for Data IBM | 7.7 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81211 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-81941 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-81213 | LO Langflow OSS IBM | 8.6 | Sep 10 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches |
| CVE-2026-81265 | LO Langflow OSS IBM | 7.5 | Sep 10 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches |
| CVE-2026-81268 | LO Langflow OSS IBM | 8.1 | Sep 10 | Langflow is vulnerable to authentication bypass and insufficient session expiration |
| CVE-2026-81540 | DO DataStage on Cloud Pak for Data IBM | 8.5 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81550 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81551 | DO DataStage on Cloud Pak for Data IBM | 8.1 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-81940 | LO Langflow OSS IBM | 8.8 | Sep 10 | Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards |
| CVE-2026-82095 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-82097 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-45766 | SU suricata OISF | 7.5 | Sep 10 | Suricata nfs: unbounded stateful structures can lead to resource exhaustion |
| CVE-2026-82098 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-82099 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 10 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-45765 | SU suricata OISF | 7.5 | Sep 10 | Suricata dnp3: unbounded reassembly can lead to resource exhaustion |
| CVE-2026-84889 | LO Langflow OSS IBM | 8.8 | Sep 10 | A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem |
| CVE-2026-86093 | DB Db2 IBM | 7.5 | Sep 10 | IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions |