CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 17:41 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-84062 | BU BurgerEditor D-ZERO CO.,LTD. | 4.3 | Sep 10 | BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key |
| CVE-2026-52097 | Product not mapped yet | 6.8 | Sep 10 | An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex… |
| CVE-2026-79590 | Product not mapped yet | 6.5 | Sep 10 | A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0 |
| CVE-2022-26962 | Product not mapped yet | 5.4 | Sep 10 | Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or… |
| CVE-2026-36392 | Product not mapped yet | 5.4 | Sep 10 | FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2026-71642 | Product not mapped yet | 4.0 | Sep 10 | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the… |
| CVE-2026-87926 | IN inventory-management-system Rizwan17 | 4.3 | Sep 9 | Rizwan17 inventory-management-system Login Page index.php cross site scripting |
| CVE-2026-87924 | IN inventory-management-system Rizwan17 | 6.5 | Sep 9 | Rizwan17 inventory-management-system Invoice Generation invoice_bill.php missing authentication |
| CVE-2026-15460 | ZE zephyr zephyrproject | 5.4 | Sep 9 | Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path |
| CVE-2026-87923 | IN inventory-management-system Rizwan17 | 4.3 | Sep 9 | Rizwan17 inventory-management-system List DBOperation.php cross site scripting |
| CVE-2026-88002 | OP open-webui open-webui | 6.5 | Sep 9 | Open WebUI: Any authenticated user can hang the server via a cyclic chat message history |
| CVE-2026-88001 | OP open-webui open-webui | 5.0 | Sep 9 | Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets |
| CVE-2026-88000 | OP open-webui open-webui | 6.5 | Sep 9 | Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree |
| CVE-2026-87997 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions |
| CVE-2026-87994 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint |
| CVE-2026-87017 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends |
| CVE-2026-87015 | OP open-webui open-webui | 6.8 | Sep 9 | Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication |
| CVE-2026-87014 | OP open-webui open-webui | 6.5 | Sep 9 | Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes |
| CVE-2026-87013 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle |
| CVE-2026-87012 | OP open-webui open-webui | 4.3 | Sep 9 | Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value |
| CVE-2026-53956 | PY py-rattler conda | 5.4 | Sep 9 | Rattler vulnerable to package cache path traversal via conda package build string |
| CVE-2026-73789 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 5.3 | Sep 9 | Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface |
| CVE-2026-73788 | CP ClearPass Policy Manager (CPPM) Hewlett Packard Enterprise (HPE) | 6.5 | Sep 9 | Privilege Escalation in ClearPass OnGuard Agent |
| CVE-2026-87928 | MC MaxSite CMS MaxSite | 5.4 | Sep 9 | MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page |
| CVE-2026-85788 | AL AWS Labs MySQL MCP Server AWS | 5.5 | Sep 9 | Incomplete list of disallowed inputs in awslabs mysql-mcp-server |
| CVE-2026-40635 | PO PowerScale OneFS Dell | 5.4 | Sep 9 | Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability |
| CVE-2026-70425 | PO PowerScale OneFS Dell | 6.7 | Sep 9 | Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability |
| CVE-2026-87872 | RH Red Hat Ceph Storage 5 Red Hat | 6.8 | Sep 9 | Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure |
| CVE-2026-87875 | RH Red Hat Enterprise Linux 10 Red Hat | 4.3 | Sep 9 | Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound |
| CVE-2026-79947 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.5 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an… |
| CVE-2026-79945 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.5 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an… |
| CVE-2026-81330 | CE C6 Ear Camera Softish | 6.5 | Sep 9 | Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information |
| CVE-2026-79735 | SC Secure Connect Gateway 5.0 - Appliance Dell | 4.4 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability |
| CVE-2026-79946 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.3 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax… |
| CVE-2026-79741 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.3 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a… |
| CVE-2026-83530 | CE cel-go Google | 4.3 | Sep 9 | Uncontrolled Memory Allocation in cel-go |
| CVE-2026-82530 | IC IP2Location Country Blocker IP2Location | 5.3 | Sep 9 | IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header |
| CVE-2026-78483 | SC Secure Connect Gateway 5.0 - Appliance Dell | 5.9 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability |
| CVE-2026-79731 | SC Secure Connect Gateway 5.0 - Appliance Dell | 4.4 | Sep 9 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability |
| CVE-2026-64857 | TI tirreno tirrenotechnologies | 5.3 | Sep 9 | tirreno has Session Fixation in Login Authentication |
| CVE-2026-86774 | SN snipe-it grokability | 6.3 | Sep 9 | Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy |
| CVE-2026-86773 | SN snipe-it grokability | 5.4 | Sep 9 | Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints |
| CVE-2026-86772 | SN snipe-it grokability | 5.4 | Sep 9 | Snipe-IT 8.6.3 Stored XSS via Department Names |
| CVE-2026-86769 | SN snipe-it grokability | 4.3 | Sep 9 | Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout |
| CVE-2026-86768 | SN snipe-it grokability | 5.4 | Sep 9 | Snipe-IT before 8.7.0 Improper Input Validation via API Checkout |
| CVE-2026-86767 | SN snipe-it grokability | 5.0 | Sep 9 | Snipe-IT before 8.7.0 Cross-Company Read via requested-assets |
| CVE-2026-86766 | SN snipe-it grokability | 6.5 | Sep 9 | Snipe-IT 8.6.3 Race Condition via Consumable Checkout |
| CVE-2026-86765 | SN snipe-it grokability | 6.5 | Sep 9 | Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint |
| CVE-2026-86764 | SN snipe-it grokability | 6.5 | Sep 9 | Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components |
| CVE-2026-86761 | SN snipe-it grokability | 4.3 | Sep 9 | snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints |