CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116207 New | YE yeswiki YesWiki | 9.1 | Oct 25 | YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API |
| CVE-2026-115214 New | DP Datawiza Proxy Auth Plugin | 9.8 | Oct 25 | Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers |
| CVE-2026-115995 New | UG Unitree Go2 Unitree Robotics | 9.6 | Oct 24 | Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection |
| CVE-2026-114820 New | OG Oracle GraalVM Enterprise Edition Oracle Corporation | 9.1 | Oct 24 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) |
| CVE-2026-115933 New | PO postiz-app GitroomHQ | 9.9 | Oct 24 | Forged signed tokens let any registered user take over other users and organizations |
| CVE-2026-115557 New | CP CPython Python Software Foundation | 9.4 | Oct 24 | Distrust compromised intermediate certificates in ssl module |
| CVE-2026-115932 New | PO postiz-app GitroomHQ | 9.6 | Oct 24 | Path traversal in post media lets any registered user read server files |
| CVE-2026-114196 New | PA Paytium paytiumsupport | 9.8 | Oct 24 | WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability |
| CVE-2026-112866 New | PF Product Filter by WBW WPFactory | 9.3 | Oct 24 | WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability |
| CVE-2026-94075 New | NE Newsletters Tribulant Software | 9.8 | Oct 24 | WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability |
| CVE-2026-111402 New | NE Newsletters Tribulant Software | 9.3 | Oct 24 | WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability |
| CVE-2026-110956 New | AS asVereinbase | 9.8 | Oct 24 | asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation |
| CVE-2026-115806 New | PM Prime Mover – Backup and Migration codexonics | 9.8 | Oct 24 | Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace |
| CVE-2026-115931 New | PO postiz-app GitroomHQ | 9.9 | Oct 23 | Arbitrary file read and backend crash through unrestricted provider method calls |
| CVE-2026-115893 New | WA wasmtime bytecodealliance | 9.9 | Oct 23 | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction |
| CVE-2026-115889 New | WA wasmtime bytecodealliance | 9.9 | Oct 23 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation |
| CVE-2026-115812 New | MU multi-model-server AWS | 9.8 | Oct 23 | Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server |
| CVE-2026-53942 New | IN infrastructure conda | 9.9 | Oct 23 | Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN |
| CVE-2026-55486 New | GO goobi-viewer-core intranda | 9.3 | Oct 23 | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS |
| CVE-2026-46652 New | GO goobi-viewer-core intranda | 9.8 | Oct 23 | Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewer |
| CVE-2026-46651 New | GO goobi-viewer-core intranda | 9.8 | Oct 23 | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer |
| CVE-2026-114357 New | CZ CrystalSky ZS600C DJI | 9.3 | Oct 23 | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) |
| CVE-2026-53921 New | OD odhcpd openwrt | 9.8 | Oct 23 | odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) |
| CVE-2026-112848 New | HV Hostme v2 AivahThemes | 9.8 | Oct 23 | WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability |
| CVE-2026-112854 New | HC Holistic Center axiomthemes | 9.8 | Oct 23 | WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability |
| CVE-2026-112847 New | ZE ZenSoul ThemeREX | 9.8 | Oct 23 | WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability |
| CVE-2026-112846 New | SL Save Life ThemeREX Group | 9.8 | Oct 23 | WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability |
| CVE-2026-112851 New | HO HotLock ThemeREX Group | 9.8 | Oct 23 | WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability |
| CVE-2026-112853 New | HA Hallelujah axiomthemes | 9.8 | Oct 23 | WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability |
| CVE-2026-112856 New | VA Vagabonds ThemeREX Group | 9.8 | Oct 23 | WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability |
| CVE-2026-112857 New | RE Reprizo axiomthemes | 9.8 | Oct 23 | WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability |
| CVE-2026-112858 New | RH Rhodos axiomthemes | 9.8 | Oct 23 | WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability |
| CVE-2026-112859 New | LB Little Birdies ThemeREX Group | 9.8 | Oct 23 | WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability |
| CVE-2026-112855 New | RE Redy axiomthemes | 9.8 | Oct 23 | WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability |
| CVE-2026-99079 New | LI Linux Linux | 9.8 | Oct 23 | net/mlx5e: Prevent stale XSK buffer release on refill retry |
| CVE-2026-99078 New | LI Linux Linux | 9.8 | Oct 23 | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry |
| CVE-2026-98959 New | LI Linux Linux | 9.8 | Oct 23 | btrfs: fix xattr replace when multiple xattrs are packed in the same item |
| CVE-2026-57116 New | PR PraisonAI MervinPraison | 9.8 | Oct 23 | PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation |
| CVE-2026-107685 New | RE req_llm agentjido | 9.1 | Oct 23 | WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers |
| CVE-2026-25784 New | BL BlueSpice Hallo Welt! GmbH | 9.8 | Oct 23 | bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop |
| CVE-2025-30054 New | CC CGM CLININET CGM | 9.3 | Oct 23 | Local Privilege Escalation in CGM CLININET |
| CVE-2025-30050 New | CC CGM CLININET CGM | 9.4 | Oct 23 | Remote Code Execution in CGM CLININET |
| CVE-2025-30047 New | CC CGM CLININET CGM | 9.4 | Oct 23 | Remote Code Execution via Java Deserialization in CGM CLININET |
| CVE-2025-30046 New | CC CGM CLININET CGM | 9.0 | Oct 23 | Remote Code Execution in CGM CLININET |
| CVE-2026-112860 New | PD Participants Database xnau webdesign | 9.3 | Oct 23 | WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability |
| CVE-2026-112862 New | PD Participants Database xnau webdesign | 9.8 | Oct 23 | WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability |
| CVE-2026-63244 New | Product not mapped yet | 9.8 | Oct 23 | Authentication Bypass Vulnerability |
| CVE-2026-55981 New | CS Creative Sound Blaster Katana V2, V2X, SE Creative Labs | 9.6 | Oct 23 | Firmware verification vulnerability |
| CVE-2026-94267 New | AC Advanced Custom Fields: Extended | 9.0 | Oct 23 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action |
| CVE-2026-54630 New | PA Part-DB-server Part-DB | 9.6 | Oct 23 | Part-DB: Authenticated RCE via .phar attachment upload served from public/media |