CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 04:27 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-55083 | DH dhis2-core dhis2 | 9.1 | Oct 1 | DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) |
| CVE-2026-103922 | AN android @capacitor | 9.3 | Oct 1 | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path |
| CVE-2026-96659 | RH Red Hat Satellite 6.16 for RHEL 8 Red Hat | 9.1 | Oct 1 | Foreman: excessive permissions for viewer role on preview |
| CVE-2026-59797 | HS HTTP Server Apache | 9.8 | Oct 1 | Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function |
| CVE-2026-57941 | HS HTTP Server Apache | 9.8 | Oct 1 | Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy |
| CVE-2026-56154 | HS HTTP Server Apache | 9.8 | Oct 1 | Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} |
| CVE-2026-94620 | CL classroom50 foundation50 | 9.4 | Oct 1 | Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download) |
| CVE-2026-12627 | FC Fortra's Core Privileged Access Manager (BoKS) Fortra | 9.8 | Oct 1 | Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability |
| CVE-2026-79898 | BM BoKS Manager Fortra | 9.1 | Oct 1 | Fortra BoKS Manager crlserver command injection vulnerability |
| CVE-2026-62071 | WF WordPress File Upload nickboss | 9.3 | Oct 1 | WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability |
| CVE-2026-103752 | AU Authorizer Paul Ryan | 9.8 | Oct 1 | WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability |
| CVE-2026-79901 | BM BoKS Manager boks-server Fortra | 9.9 | Oct 1 | Predictable Active Directory service-account passwords in BoKS Manager |
| CVE-2026-103264 | FL fleet fleetdm | 9.1 | Oct 1 | Fleet before 4.87.0 Authentication Bypass via Device Identifiers |
| CVE-2026-103255 | N8 n8n n8n-io | 9.0 | Oct 1 | n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase |
| CVE-2026-103248 | N8 n8n n8n-io | 9.0 | Oct 1 | n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase |
| CVE-2026-103244 | GR ground-station sgoudelis | 9.8 | Oct 1 | ground-station before 0.8.0 Authentication Bypass via setup.restore |
| CVE-2026-103655 | MI MISP MISP | 9.3 | Oct 1 | MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period |
| CVE-2026-15989 | SF Super Forms – Drag & Drop Form Builder WebRehab | 9.8 | Oct 1 | Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter |
| CVE-2026-75957 | UM Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform superdav42 | 9.8 | Oct 1 | Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter |
| CVE-2025-41753 | 07 0750-811x-xxxx-xxxx WAGO | 9.8 | Oct 1 | Path traversal in dynamically created BACnet File Objects |
| CVE-2026-101148 | BW BackupSheep WordPress Backup Plugin | 10.0 | Oct 1 | BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key |
| CVE-2026-82824 | HC Hitachi Coding Software Suite Hitachi Industrial Equipment Systems | 9.8 | Oct 1 | Path traversal may allow arbitrary files to be viewed, created, modified, or deleted |
| CVE-2026-82825 | HC Hitachi Coding Software Suite Hitachi Industrial Equipment Systems | 9.8 | Oct 1 | Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed |
| CVE-2026-82827 | HC Hitachi Coding Software Suite Hitachi Industrial Equipment Systems | 9.8 | Oct 1 | A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens |
| CVE-2026-82829 | HC Hitachi Coding Software Suite Hitachi Industrial Equipment Systems | 9.8 | Oct 1 | Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process |
| CVE-2026-76142 | GN Genian NAC 5.0.75 LTS Release Genians, Inc | 9.3 | Oct 1 | Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface |
| CVE-2026-92966 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 9.1 | Oct 1 | Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field |
| CVE-2026-14157 | RO Router ASUS | 9.4 | Oct 1 | Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the… |
| CVE-2026-51880 | Product not mapped yet | 9.8 | Oct 1 | deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute |
| CVE-2026-51881 | Product not mapped yet | 9.8 | Oct 1 | deeptutor 1.4.0 contains code injection in ExecTool.execute |
| CVE-2026-51884 | Product not mapped yet | 9.8 | Oct 1 | The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal |
| CVE-2026-51897 | Product not mapped yet | 9.8 | Oct 1 | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app) |
| CVE-2026-51886 | Product not mapped yet | 9.8 | Oct 1 | langflow-ai langflow v1.9.3 is affected by: Code Injection |
| CVE-2026-51893 | Product not mapped yet | 9.8 | Oct 1 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap |
| CVE-2026-51876 | Product not mapped yet | 9.1 | Oct 1 | DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow |
| CVE-2026-51875 | Product not mapped yet | 9.1 | Oct 1 | In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project… |
| CVE-2026-51883 | Product not mapped yet | 9.1 | Oct 1 | The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal |
| CVE-2026-51882 | Product not mapped yet | 9.1 | Oct 1 | The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal |
| CVE-2026-51879 | Product not mapped yet | 9.1 | Oct 1 | deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file |
| CVE-2026-101283 | IP iperf3 esnet | 9.2 | Sep 30 | iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length… |
| CVE-2026-101276 | IP iperf3 esnet | 9.2 | Sep 30 | iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their… |
| CVE-2026-92173 | MH Meta Horizon OS Meta Platforms, Inc | 9.1 | Sep 30 | Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an… |
| CVE-2026-102105 | EP Email Protection Gateway Kiteworks | 9.1 | Sep 30 | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102106 | EP Email Protection Gateway Kiteworks | 9.1 | Sep 30 | Kiteworks Email Protection Gateway improper authentication |
| CVE-2026-102115 | CO Core Kiteworks | 9.8 | Sep 30 | Kiteworks Core Authentication Bypass in the Password Reset Workflow |
| CVE-2026-102104 | EP Email Protection Gateway Kiteworks | 9.1 | Sep 30 | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102103 | EP Email Protection Gateway Kiteworks | 9.1 | Sep 30 | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102102 | EP Email Protection Gateway Kiteworks | 9.1 | Sep 30 | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102149 | EP Email Protection Gateway Kiteworks | 9.4 | Sep 30 | Kiteworks Email Protection Gateway Improper Access Control |
| CVE-2026-102147 | CO Core Kiteworks | 9.3 | Sep 30 | Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) |