CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 21:15 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-62109 | SA Sky Addons for Elementor wowDevs | 7.6 | Sep 11 | WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability |
| CVE-2026-62107 | ML Masteriyo - LMS masteriyo | 8.8 | Sep 11 | WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability |
| CVE-2026-62106 | SA SMS Alert Order Notifications Cozy Vision Technologies Pvt. Ltd. | 8.8 | Sep 11 | WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability |
| CVE-2026-62102 | GG Gato GraphQL Gato GraphQL | 8.8 | Sep 11 | WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability |
| CVE-2026-67211 | AO Apache OpenNLP Apache Software Foundation | 7.5 | Sep 11 | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer |
| CVE-2026-89099 | MO MongoDB MongoDB | 7.5 | Sep 11 | Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption |
| CVE-2026-72708 | SP SPIP SPIP | 7.5 | Sep 11 | SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html |
| CVE-2026-89066 | PR projen AWS | 7.8 | Sep 11 | OS command injection in the task synthesis component in projen |
| CVE-2026-89065 | PR projen AWS | 7.1 | Sep 11 | Relative path traversal in the generated file manifest cleanup component in projen |
| CVE-2026-7863 | PS Pardus Software TUBITAK BILGEM Software Technologies Research Institute | 8.4 | Sep 11 | OS Command Injection in TUBITAK BILGEM's Pardus Software |
| CVE-2026-89013 | DO Dolibarr Dolibarr | 7.5 | Sep 11 | Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php |
| CVE-2026-70341 | ME Microsoft Edge (Chromium-based) Microsoft | 8.8 | Sep 11 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-68497 | JA jackson-databind FasterXML | 7.5 | Sep 11 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service |
| CVE-2026-89262 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check |
| CVE-2026-89260 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint |
| CVE-2026-38056 | 3T 3315-Series terminals ST Engineering iDirect | 8.8 | Sep 11 | ST Engineering iDirect iQ-Series Terminals Missing Authorization |
| CVE-2026-38058 | 3T 3315-Series terminals ST Engineering iDirect | 8.1 | Sep 11 | ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere |
| CVE-2026-8301 | PB Pardus Boot Repair TUBITAK BILGEM Software Technologies Research Institute | 7.8 | Sep 11 | OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair |
| CVE-2026-85979 | PE Puppet Enterprise Perforce Software | 8.6 | Sep 11 | Command Injection in Puppet Enterprise |
| CVE-2026-82578 | MC Mirth Connect NextGen Healthcare | 7.5 | Sep 11 | NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference |
| CVE-2026-78224 | MC Mirth Connect NextGen Healthcare | 8.2 | Sep 11 | NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference |
| CVE-2026-82583 | MC Mirth Connect NextGen Healthcare | 8.3 | Sep 11 | NextGen Healthcare Mirth Connect SQL Injection |
| CVE-2026-8303 | PA Pardus-software TUBITAK BILGEM Software Technologies Research Institute | 7.8 | Sep 11 | Privilege Escalation in TUBITAK BILGEM's Pardus-software |
| CVE-2026-87020 | DS DICOM Server Orthanc | 8.1 | Sep 11 | Orthanc DICOM Server Integer Overflow or Wraparound |
| CVE-2026-57842 | NE NetBSD The NetBSD Foundation | 7.0 | Sep 11 | NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen |
| CVE-2026-71416 | HE headroom headroomlabs-ai | 8.8 | Sep 11 | Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) |
| CVE-2026-89212 | AK Akana Perforce | 8.6 | Sep 11 | XML External Entity in Akana API Platform |
| CVE-2026-87776 | CO compression compression | 7.5 | Sep 11 | compression vulnerable to Denial of Service via memory leak on premature response close |
| CVE-2026-89256 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo Bookmark Plugin Stored XSS via Chapter Names |
| CVE-2026-89255 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo LoginControl Stored XSS via PGP Public Key |
| CVE-2026-89254 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo CustomizeUser Stored XSS via field_name Parameter |
| CVE-2026-89253 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo Stored XSS via donationLink in watch page button |
| CVE-2026-89250 | AV AVideo WWBN | 7.5 | Sep 11 | WWBN AVideo Unauthenticated File Read via getRecordedFile.php |
| CVE-2026-89249 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo YPTWallet Stored XSS via CryptoWallet Configuration |
| CVE-2026-89243 | AV AVideo WWBN | 8.1 | Sep 11 | WWBN AVideo Stored XSS via UserGroups setGroup_name |
| CVE-2026-89242 | AV AVideo WWBN | 7.2 | Sep 11 | WWBN AVideo Unauthenticated SSRF via login.json.php |
| CVE-2026-89147 | NE Net-SNMP net-snmp | 7.5 | Sep 11 | Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read |
| CVE-2026-89146 | LI libp2p-rendezvous libp2p | 7.5 | Sep 11 | libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses |
| CVE-2026-17037 | KF Kirki – Freeform Page Builder, Website Builder & Customizer themeum | 7.2 | Sep 11 | Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter |
| CVE-2026-80469 | SC Sentio Creator Extension 'Device Manager' SICK AG | 8.3 | Sep 11 | No description published yet |
| CVE-2026-19486 | GE Gemini Enterprise Agent Platform App Builder Google Cloud | 8.7 | Sep 11 | SSRF in Gemini Enterprise Agent Platform App Builder |
| CVE-2025-15679 | BX BullSequana XH3406 Bull | 7.3 | Sep 11 | BMC root account active without password on BullSequana XH3406 and XH3515 |
| CVE-2026-89178 | WE WeenyGenius Howyar | 8.8 | Sep 11 | Howyar｜WeenyGenius - Origin Validation Error |
| CVE-2026-89177 | WE WeenyGenius Howyar | 8.8 | Sep 11 | Howyar｜WeenyGenius - Use of Insecure Protocol |
| CVE-2026-89176 | WE WeenyGenius Howyar | 8.8 | Sep 11 | Howyar｜WeenyGenius - Missing Authentication |
| CVE-2026-89174 | EH EH1000B Kingdom Communication Associated | 7.5 | Sep 11 | Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection |
| CVE-2026-73785 | HI HPE IceWall products Hewlett Packard Enterprise | 7.5 | Sep 11 | HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability |
| CVE-2026-87908 | MU multiparty multiparty | 7.5 | Sep 11 | multiparty vulnerable to Denial of Service via unbounded part-header accumulation |
| CVE-2026-73784 | HI HPE IceWall products Hewlett Packard Enterprise | 8.8 | Sep 11 | HPE IceWall products, Remote Bypass of Security Restrictions |
| CVE-2026-85677 | GN Gutenverse News | 8.8 | Sep 11 | Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content |