CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:35 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116137 New | AD adm-zip cthackers | 3.7 | Oct 25 | adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names |
| CVE-2026-115183 New | QA Qi Addons For Elementor | 2.4 | Oct 25 | Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget |
| CVE-2026-114743 New | IC InstaWP Connect | 3.1 | Oct 25 | InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings |
| CVE-2026-114742 New | WP WPVR | 2.7 | Oct 25 | WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR |
| CVE-2026-114741 New | WP WPVR | 3.8 | Oct 25 | WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR |
| CVE-2026-111981 New | GI GiveWP | 2.7 | Oct 25 | GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses |
| CVE-2025-15705 New | CF Contact Form by Supsystic | 3.5 | Oct 25 | Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS |
| CVE-2026-116007 New | RU ruoyi-vue-pro YunaiV | 3.7 | Oct 25 | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication |
| CVE-2026-116004 New | ON Onyx onyx-dot-app | 3.5 | Oct 25 | onyx-dot-app Onyx PreviewTab.tsx cross site scripting |
| CVE-2026-115996 New | UG Unitree Go2 Unitree Robotics | 3.7 | Oct 24 | Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation |
| CVE-2026-115981 New | PH phpIPAM Phpipam | 2.4 | Oct 24 | phpIPAM index.php cross site scripting |
| CVE-2026-116013 New | LU lua-resty-dns openresty | 3.7 | Oct 24 | OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing |
| CVE-2026-116012 New | GH ghidra NationalSecurityAgency | 3.6 | Oct 24 | Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser |
| CVE-2026-113674 New | GE GeoDirectory | 3.7 | Oct 24 | GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification |
| CVE-2026-115897 New | SE serialize-javascript yahoo | 2.1 | Oct 23 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body |
| CVE-2026-83813 New | TW twisted twisted | 3.1 | Oct 23 | Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation |
| CVE-2026-115797 New | F6 F6 Tenda | 3.7 | Oct 23 | Tenda F6 Web Management cleartext transmission |
| CVE-2026-79978 New | ZE zephyr zephyrproject | 3.6 | Oct 23 | Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path |
| CVE-2026-115569 New | FA fallow-node @fallow-cli | 3.3 | Oct 23 | Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root |
| CVE-2026-106071 New | NO node nodejs | 3.6 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule |
| CVE-2026-106070 New | NO node nodejs | 3.7 | Oct 23 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails |
| CVE-2026-106073 New | NO node nodejs | 3.3 | Oct 23 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks |
| CVE-2026-115751 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname |
| CVE-2026-115750 New | MC mcp-from-openapi agentfront | 3.7 | Oct 23 | mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects |
| CVE-2026-115749 New | HY hydra-ray-launcher hydra-ecosystem | 3.3 | Oct 23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import |
| CVE-2026-115730 New | I1 i18next-http-backend i18next | 3.1 | Oct 23 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl |
| CVE-2026-54711 New | PG pghoard Aiven-Open | 2.4 | Oct 23 | PGHoard: Password written to debug log |
| CVE-2026-115724 New | VF VLC for Android VideoLAN | 2.9 | Oct 23 | VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider |
| CVE-2026-95620 New | QT qt qt | 2.1 | Oct 23 | Use-after-free vulnerability in QNetworkAccessManager HTTP/2 support impacts Qt |
| CVE-2026-113501 New | LC LiteSpeed Cache | 3.1 | Oct 23 | LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal |
| CVE-2026-112230 New | PB Popup Builder | 3.7 | Oct 23 | Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter |
| CVE-2026-111737 New | SO Speed Optimizer | 3.5 | Oct 23 | Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists |
| CVE-2026-110537 New | EA Essential Addons for Elementor | 3.8 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action |
| CVE-2026-110510 New | EA Essential Addons for Elementor | 3.5 | Oct 23 | Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag |
| CVE-2026-115535 New | HO HospitalManagement gedelumbung | 2.4 | Oct 23 | gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting |
| CVE-2026-115449 New | RH Red Hat Enterprise Linux 10 Red Hat | 3.5 | Oct 22 | Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest |
| CVE-2026-114614 New | AU authlib authlib | 2.6 | Oct 22 | Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts |
| CVE-2026-115507 New | VI vikunja go-vikunja | 3.5 | Oct 22 | Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header |
| CVE-2026-115393 New | WA wasmtime bytecodealliance | 3.8 | Oct 22 | Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion |
| CVE-2026-115389 New | WA wasmtime bytecodealliance | 2.3 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API |
| CVE-2026-115386 New | WA wasmtime bytecodealliance | 2.6 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir |
| CVE-2026-115369 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs |
| CVE-2026-115366 New | OP openbao openbao | 2.6 | Oct 22 | OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs |
| CVE-2026-115364 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints |
| CVE-2026-115363 New | OP openbao openbao | 3.3 | Oct 22 | OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration |
| CVE-2026-115362 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass |
| CVE-2026-115359 New | OP openbao openbao | 3.7 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing |
| CVE-2026-115358 New | OP openbao openbao | 2.0 | Oct 22 | OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters |
| CVE-2026-115357 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses |
| CVE-2026-95721 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 3.3 | Oct 22 | Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface |