CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 23:34 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114614 New | AU authlib authlib | 2.6 | Oct 22 | Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts |
| CVE-2026-115507 New | VI vikunja go-vikunja | 3.5 | Oct 22 | Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header |
| CVE-2026-115393 New | WA wasmtime bytecodealliance | 3.8 | Oct 22 | Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusion |
| CVE-2026-115389 New | WA wasmtime bytecodealliance | 2.3 | Oct 22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val API |
| CVE-2026-115386 New | WA wasmtime bytecodealliance | 2.6 | Oct 22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir |
| CVE-2026-115369 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs |
| CVE-2026-115366 New | OP openbao openbao | 2.6 | Oct 22 | OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs |
| CVE-2026-115364 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints |
| CVE-2026-115363 New | OP openbao openbao | 3.3 | Oct 22 | OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration |
| CVE-2026-115362 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypass |
| CVE-2026-115359 New | OP openbao openbao | 3.7 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing |
| CVE-2026-115358 New | OP openbao openbao | 2.0 | Oct 22 | OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters |
| CVE-2026-115357 New | OP openbao openbao | 2.2 | Oct 22 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Improper Audit Logging of Root Generation and Rekey Responses |
| CVE-2026-95721 New | AA ArubaOS (AOS) Hewlett Packard Enterprise (HPE) | 3.3 | Oct 22 | Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface |
| CVE-2026-115519 New | KB KNIME Business Hub KNIME | 2.1 | Oct 22 | Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub |
| CVE-2026-113875 New | HF HAPI FHIR SmileCDR | 3.1 | Oct 22 | SmileCDR HAPI FHIR unauthorized read via subscription |
| CVE-2026-54238 New | RE realtime supabase | 3.1 | Oct 22 | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization |
| CVE-2026-115246 New | ON online-clinic-management-system subhajitkhan | 3.5 | Oct 22 | subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting |
| CVE-2026-115319 New | FZ fzf junegunn | 2.5 | Oct 22 | fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents |
| CVE-2026-21812 New | AI AppScan Integration with Azure Boards for ASoC & A360 HCL Software | 2.2 | Oct 22 | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) |
| CVE-2026-21811 New | AI AppScan Integration with Azure Boards for ASoC & A360 HCL Software | 3.8 | Oct 22 | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) |
| CVE-2026-114459 New | MO mod_qos pbuchbinder | 3.7 | Oct 22 | Mod_qos: out-of-bounds reads in response-body substring matching |
| CVE-2026-114457 New | MO mod_qos pbuchbinder | 3.7 | Oct 22 | Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads |
| CVE-2026-88849 New | ML MasterStudy LMS WordPress Plugin | 2.7 | Oct 22 | MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment |
| CVE-2026-110011 New | MC MB Custom Post Types & Custom Taxonomies | 2.7 | Oct 22 | MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export |
| CVE-2026-109931 New | IG Infility Global | 3.7 | Oct 22 | Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update |
| CVE-2026-114723 New | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation |
| CVE-2026-114641 New | TR traefik traefik | 3.7 | Oct 22 | Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper |
| CVE-2026-114721 New | WE Webmail Roundcube | 3.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed |
| CVE-2026-114576 New | RE RE6250 Linksys | 3.7 | Oct 22 | Linksys RE6250 Web Management strcmp random values |
| CVE-2026-114719 New | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin |
| CVE-2026-84911 New | DR Drupal Drupal | 3.1 | Oct 22 | AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 |
| CVE-2026-84916 New | DR Drupal Drupal | 3.7 | Oct 22 | Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 |
| CVE-2026-16648 New | DR Drupal Drupal | 3.8 | Oct 22 | Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 |
| CVE-2026-84918 New | DR Drupal Drupal | 3.7 | Oct 22 | Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 |
| CVE-2026-87948 New | DR Drupal Drupal | 3.5 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 |
| CVE-2026-87949 New | DR Drupal Drupal | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 |
| CVE-2026-87951 New | DR Drupal Drupal | 3.8 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 |
| CVE-2026-87952 New | DR Drupal Drupal | 3.1 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 |
| CVE-2026-87953 New | DR Drupal Drupal | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 |
| CVE-2026-96360 New | DR Drupal Drupal | 3.5 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 |
| CVE-2026-96369 New | DR Drupal Drupal | 3.1 | Oct 22 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 |
| CVE-2026-96373 New | DR Drupal Drupal | 3.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 |
| CVE-2026-96384 New | DR Drupal Drupal | 3.5 | Oct 22 | Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 |
| CVE-2026-96387 New | DR Drupal Drupal | 3.8 | Oct 22 | Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 |
| CVE-2026-96392 New | DR Drupal Drupal | 3.5 | Oct 22 | AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 |
| CVE-2026-14288 | GI GitLab GitLab | 3.1 | Oct 21 | Use of Incorrectly-Resolved Name or Reference in GitLab |
| CVE-2026-103515 | GI GitLab GitLab | 2.7 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-105711 | GI GitLab GitLab | 3.5 | Oct 21 | Use of Cache Containing Sensitive Information in GitLab |
| CVE-2026-112326 | GI GitLab GitLab | 3.1 | Oct 21 | Improper Cleanup on Thrown Exception in GitLab |