CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 20:02 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112851 New | HO HotLock ThemeREX Group | 9.8 | Oct 23 | WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability |
| CVE-2026-112853 New | HA Hallelujah axiomthemes | 9.8 | Oct 23 | WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability |
| CVE-2026-112856 New | VA Vagabonds ThemeREX Group | 9.8 | Oct 23 | WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability |
| CVE-2026-112857 New | RE Reprizo axiomthemes | 9.8 | Oct 23 | WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability |
| CVE-2026-112858 New | RH Rhodos axiomthemes | 9.8 | Oct 23 | WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability |
| CVE-2026-112859 New | LB Little Birdies ThemeREX Group | 9.8 | Oct 23 | WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability |
| CVE-2026-112855 New | RE Redy axiomthemes | 9.8 | Oct 23 | WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability |
| CVE-2026-99079 New | LI Linux Linux | 9.8 | Oct 23 | net/mlx5e: Prevent stale XSK buffer release on refill retry |
| CVE-2026-99078 New | LI Linux Linux | 9.8 | Oct 23 | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry |
| CVE-2026-98959 New | LI Linux Linux | 9.8 | Oct 23 | btrfs: fix xattr replace when multiple xattrs are packed in the same item |
| CVE-2026-57116 New | PR PraisonAI MervinPraison | 9.8 | Oct 23 | PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation |
| CVE-2026-107685 New | RE req_llm agentjido | 9.1 | Oct 23 | WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers |
| CVE-2026-25784 New | BL BlueSpice Hallo Welt! GmbH | 9.8 | Oct 23 | bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop |
| CVE-2025-30054 New | CC CGM CLININET CGM | 9.3 | Oct 23 | Local Privilege Escalation in CGM CLININET |
| CVE-2025-30050 New | CC CGM CLININET CGM | 9.4 | Oct 23 | Remote Code Execution in CGM CLININET |
| CVE-2025-30047 New | CC CGM CLININET CGM | 9.4 | Oct 23 | Remote Code Execution via Java Deserialization in CGM CLININET |
| CVE-2025-30046 New | CC CGM CLININET CGM | 9.0 | Oct 23 | Remote Code Execution in CGM CLININET |
| CVE-2026-112860 New | PD Participants Database xnau webdesign | 9.3 | Oct 23 | WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability |
| CVE-2026-112862 New | PD Participants Database xnau webdesign | 9.8 | Oct 23 | WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability |
| CVE-2026-63244 New | Product not mapped yet | 9.8 | Oct 23 | Authentication Bypass Vulnerability |
| CVE-2026-55981 New | CS Creative Sound Blaster Katana V2, V2X, SE Creative Labs | 9.6 | Oct 23 | Firmware verification vulnerability |
| CVE-2026-94267 New | AC Advanced Custom Fields: Extended | 9.0 | Oct 23 | Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action |
| CVE-2026-54630 New | PA Part-DB-server Part-DB | 9.6 | Oct 23 | Part-DB: Authenticated RCE via .phar attachment upload served from public/media |
| CVE-2026-115547 New | OA Okta Access Gateway Okta | 9.1 | Oct 23 | Command Execution via Admin Console Input in Okta Access Gateway |
| CVE-2026-19677 New | OF onPhase Forms onPhase | 9.3 | Oct 23 | Authentication Bypass Leading to Server-Side Command Execution |
| CVE-2026-110243 New | EF E3 Firmware Kiloview | 9.9 | Oct 22 | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-107861 New | EF E3 Firmware Kiloview | 9.9 | Oct 22 | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-109122 New | EF E3 Firmware Kiloview | 9.1 | Oct 22 | Kiloview E3 NDI Encoder OS Command Injection |
| CVE-2026-110063 New | VI VM Inspector for Azure Virtual Machines Microsoft | 10.0 | Oct 22 | VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability |
| CVE-2026-83938 New | AK Azure Kubernetes Configuration Service Microsoft | 10.0 | Oct 22 | Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability |
| CVE-2026-97785 New | ME Microsoft Entra application proxy Microsoft | 10.0 | Oct 22 | AAD App Proxy Elevation of Privilege Vulnerability |
| CVE-2026-105014 New | AP Azure Pipelines Microsoft | 9.1 | Oct 22 | Azure Pipelines Remote Code Execution Vulnerability |
| CVE-2026-114625 In wildKEVNew | VO VeloCloud Orchestrator Arista Networks | 9.9 | Oct 22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host |
| CVE-2026-115384 New | WA wasmtime bytecodealliance | 9.9 | Oct 22 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow |
| CVE-2026-115377 New | IN incus lxc | 9.9 | Oct 22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream |
| CVE-2026-115375 New | IN incus lxc | 9.9 | Oct 22 | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes |
| CVE-2022-51026 New | BY bytebase bytebase | 9.8 | Oct 22 | Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login |
| CVE-2026-79876 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 22 | Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing |
| CVE-2026-79875 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 22 | Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access |
| CVE-2026-79874 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 22 | Authentication Bypass in the API allows Administrative Access of AOS-10 |
| CVE-2026-79873 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.3 | Oct 22 | Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access |
| CVE-2026-79872 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.4 | Oct 22 | Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8 |
| CVE-2026-79871 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10 |
| CVE-2026-79870 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Authentication Bypass leads to Unauthorized Access in AOS-8 |
| CVE-2026-79869 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-10 |
| CVE-2026-79868 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8 |
| CVE-2026-79867 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Authentication Bypass Leading to Remote Code Execution in AOS-8 |
| CVE-2026-79866 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8 |
| CVE-2026-79865 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10 |
| CVE-2026-79864 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 9.6 | Oct 22 | Unauthenticated Adjacent Command Injection Vulnerability in AOS-10 |