CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 03:54 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102095 | EP Email Protection Gateway Kiteworks | 9.1 | Sep 30 | Kiteworks Email Protection Gateway server-side request forgery |
| CVE-2026-102992 | PI piscina piscinajs | 9.2 | Sep 30 | piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env |
| CVE-2026-103547 | OP OpenBSD OpenBSD | 9.2 | Sep 30 | In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and… |
| CVE-2026-100512 | NP Nested Pages Hook & Filter | 9.8 | Sep 30 | WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability |
| CVE-2026-103475 | YI yii2-starter-kit yii2-starter-kit | 9.1 | Sep 30 | yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure |
| CVE-2026-55107 | KO kobako elct9620 | 10.0 | Sep 30 | Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) |
| CVE-2026-62308 | TU tugtainer Quenary | 9.1 | Sep 30 | Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint |
| CVE-2026-55494 | TU tugtainer Quenary | 9.8 | Sep 30 | Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset |
| CVE-2026-55181 | TU tugtainer Quenary | 9.4 | Sep 30 | Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false |
| CVE-2026-55176 | SE security Soft-Machine-io | 9.0 | Sep 30 | Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token |
| CVE-2026-75969 | L4 Link 4K 12X PTZOptics | 9.1 | Sep 30 | PTZOptics Missing Authentication in Firmware Upload |
| CVE-2026-102489 In wildKEV | ZA Zammad Zammad GmbH | 9.8 | Sep 30 | Undisclosed RCE in Zammad v6.3 and higher |
| CVE-2026-19445 | CP CPython Python Software Foundation | 9.2 | Sep 30 | Use-after-free of a server-side SSLContext when sni_callback switches contexts |
| CVE-2026-103470 | GR Grouper Internet2 | 9.3 | Sep 30 | In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges |
| CVE-2026-100277 | YO YouTrack JetBrains | 9.8 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature |
| CVE-2026-100273 | YO YouTrack JetBrains | 9.8 | Sep 30 | In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution |
| CVE-2026-100255 | TE TeamCity JetBrains | 9.8 | Sep 30 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset |
| CVE-2026-102427 | OJ OrdaSoft Joomla CCK ordasoft.com | 10.0 | Sep 30 | Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 |
| CVE-2026-103395 | LI LightLLM ModelTC | 9.8 | Sep 30 | LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service |
| CVE-2026-76570 | JE JCTables extension for Joomla joomcode.com | 9.1 | Sep 30 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1 |
| CVE-2026-18782 | TM Trex MES Trex Digital Smart Manufacturing Systems Inc. | 9.8 | Sep 30 | SQL Injection in Trex Digital Manufacturing's Trex MES |
| CVE-2026-93903 | LW LiteSpeed Web Server litespeedtech | 9.4 | Sep 30 | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case." |
| CVE-2026-82307 | SO SOPLOG Dolusoft Software Technologies | 9.8 | Sep 30 | Multiple Vulnerabilities in Dolusoft Software's SOPLOG |
| CVE-2026-76504 In wildKEV | CC Cisco Catalyst SD-WAN Manager Cisco | 9.8 | Sep 30 | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability |
| CVE-2026-97274 | OS OAuth Single Sign On – SSO (OAuth Client) miniOrange | 9.8 | Sep 30 | WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability |
| CVE-2026-97248 | BA Booking Activities Booking Activities Team | 9.8 | Sep 30 | WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability |
| CVE-2026-96822 | BG Books Gallery Hossni Mubarak | 9.3 | Sep 30 | WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability |
| CVE-2026-96350 | ES Estatik Estatik | 9.8 | Sep 30 | WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability |
| CVE-2026-96349 | SI SiteSkite SiteSkite | 10.0 | Sep 30 | WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-94389 | AS AcyMailing SMTP Newsletter AcyMailing Newsletter Team | 9.0 | Sep 30 | WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-74865 | SO sogo_yhn YunoHost-Apps | 9.2 | Sep 30 | Authentication Bypass in sogo_yhn |
| CVE-2026-74864 | SO sogo_yhn YunoHost-Apps | 9.3 | Sep 30 | Authentication Bypass in sogo_yhn |
| CVE-2026-89238 | AW Apache WSS4J Apache Software Foundation | 9.1 | Sep 30 | Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection |
| CVE-2026-88920 | AW Apache WSS4J Apache Software Foundation | 9.8 | Sep 30 | Apache WSS4J: SAML Sender-Vouches Authentication Bypass |
| CVE-2026-87830 | AW Apache WSS4J Apache Software Foundation | 9.1 | Sep 30 | Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. |
| CVE-2026-77185 | AM Apache MINA SSHD Apache Software Foundation | 9.1 | Sep 30 | Apache MINA SSHD: Asynchronous authentication can bypass signature verification |
| CVE-2026-94053 | AM Apache MINA SSHD Apache Software Foundation | 9.1 | Sep 30 | Apache MINA SSHD: LDAP injection in sshd-ldap |
| CVE-2026-94052 | AM Apache MINA SSHD Apache Software Foundation | 9.1 | Sep 30 | Apache MINA SSHD: LDAP password authentication ineffective |
| CVE-2026-102458 | EN EasyFlow .NET DigiWin | 9.8 | Sep 30 | DigiWin｜EasyFlow .NET - Missing Authentication |
| CVE-2026-102455 | EN EasyFlow .NET DigiWin | 9.8 | Sep 30 | DigiWin｜EasyFlow .NET - Insecure Deserialization |
| CVE-2026-102508 | AP Apache PLC4X Apache Software Foundation | 9.2 | Sep 30 | Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade |
| CVE-2026-97196 | GI GiveWP Liquid Web / StellarWP | 9.1 | Sep 30 | WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability |
| CVE-2026-75873 | ZT Zella Theme | 9.8 | Sep 30 | Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload |
| CVE-2026-102911 | PI pi-llm-wiki zosmaai | 9.9 | Sep 30 | zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection |
| CVE-2026-103110 | IN Infinity Pexip | 9.8 | Sep 30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a… |
| CVE-2026-103109 | IN Infinity Pexip | 9.4 | Sep 30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory… |
| CVE-2026-103056 | AI AiSOC beenuar | 9.0 | Sep 30 | AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR |
| CVE-2026-51861 | Product not mapped yet | 9.8 | Sep 30 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py |
| CVE-2026-51858 | Product not mapped yet | 9.8 | Sep 30 | In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary |
| CVE-2026-51867 | Product not mapped yet | 9.8 | Sep 30 | agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts |