CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 12:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115246 New | ON online-clinic-management-system subhajitkhan | 3.5 | Oct 22 | subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting |
| CVE-2026-115319 New | FZ fzf junegunn | 2.5 | Oct 22 | fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents |
| CVE-2026-21812 New | AI AppScan Integration with Azure Boards for ASoC & A360 HCL Software | 2.2 | Oct 22 | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) |
| CVE-2026-21811 New | AI AppScan Integration with Azure Boards for ASoC & A360 HCL Software | 3.8 | Oct 22 | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) |
| CVE-2026-114459 New | MO mod_qos pbuchbinder | 3.7 | Oct 22 | Mod_qos: out-of-bounds reads in response-body substring matching |
| CVE-2026-114457 New | MO mod_qos pbuchbinder | 3.7 | Oct 22 | Mod_qos: missing nul termination in json value escaping permits out-of-bounds reads |
| CVE-2026-88849 New | ML MasterStudy LMS WordPress Plugin | 2.7 | Oct 22 | MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment |
| CVE-2026-110011 New | MC MB Custom Post Types & Custom Taxonomies | 2.7 | Oct 22 | MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export |
| CVE-2026-109931 New | IG Infility Global | 3.7 | Oct 22 | Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update |
| CVE-2026-114723 New | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation |
| CVE-2026-114641 New | TR traefik traefik | 3.7 | Oct 22 | Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper |
| CVE-2026-114721 New | WE Webmail Roundcube | 3.1 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed |
| CVE-2026-114576 New | RE RE6250 Linksys | 3.7 | Oct 22 | Linksys RE6250 Web Management strcmp random values |
| CVE-2026-114719 New | WE Webmail Roundcube | 3.7 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin |
| CVE-2026-84911 New | DR Drupal Drupal | 3.1 | Oct 22 | AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119 |
| CVE-2026-84916 New | DR Drupal Drupal | 3.7 | Oct 22 | Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126 |
| CVE-2026-16648 New | DR Drupal Drupal | 3.8 | Oct 22 | Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 |
| CVE-2026-84918 New | DR Drupal Drupal | 3.7 | Oct 22 | Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130 |
| CVE-2026-87948 New | DR Drupal Drupal | 3.5 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146 |
| CVE-2026-87949 New | DR Drupal Drupal | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147 |
| CVE-2026-87951 New | DR Drupal Drupal | 3.8 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149 |
| CVE-2026-87952 New | DR Drupal Drupal | 3.1 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 |
| CVE-2026-87953 New | DR Drupal Drupal | 3.3 | Oct 22 | SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151 |
| CVE-2026-96360 New | DR Drupal Drupal | 3.5 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154 |
| CVE-2026-96369 New | DR Drupal Drupal | 3.1 | Oct 22 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-165 |
| CVE-2026-96373 New | DR Drupal Drupal | 3.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 |
| CVE-2026-96384 New | DR Drupal Drupal | 3.5 | Oct 22 | Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 |
| CVE-2026-96387 New | DR Drupal Drupal | 3.8 | Oct 22 | Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 |
| CVE-2026-96392 New | DR Drupal Drupal | 3.5 | Oct 22 | AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 |
| CVE-2026-14288 New | GI GitLab GitLab | 3.1 | Oct 21 | Use of Incorrectly-Resolved Name or Reference in GitLab |
| CVE-2026-103515 New | GI GitLab GitLab | 2.7 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-105711 New | GI GitLab GitLab | 3.5 | Oct 21 | Use of Cache Containing Sensitive Information in GitLab |
| CVE-2026-112326 New | GI GitLab GitLab | 3.1 | Oct 21 | Improper Cleanup on Thrown Exception in GitLab |
| CVE-2026-114377 New | WI wiki-go leomoon-studios | 3.8 | Oct 21 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal |
| CVE-2026-18748 New | ZE zephyr zephyrproject | 3.5 | Oct 21 | Out-of-bounds read in Bluetooth Classic A2DP codec information element handling |
| CVE-2026-105938 New | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all |
| CVE-2026-105933 New | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization |
| CVE-2026-105932 New | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints |
| CVE-2026-105931 New | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants |
| CVE-2026-105927 New | AP Apache Pulsar Apache Software Foundation | 2.3 | Oct 21 | Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission |
| CVE-2026-114130 New | NU nuxt nuxt | 2.3 | Oct 21 | Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled |
| CVE-2026-114127 New | AS astro withastro | 2.3 | Oct 21 | Astro: Arbitrary CSS injection in Astro View Transitions |
| CVE-2026-114124 New | EL electron electron | 3.9 | Oct 21 | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry |
| CVE-2026-114122 New | EL electron electron | 3.9 | Oct 21 | Electron: Frame subscription trusts GPU-supplied frame geometry |
| CVE-2026-113797 New | EL electron electron | 3.1 | Oct 21 | Electron: Extension tabs.query returns tab URLs and titles without the tabs permission |
| CVE-2026-114472 New | HM hMailServer Progressive Robot Ltd | 3.7 | Oct 21 | Insufficient Resource Pool in hMailServer |
| CVE-2026-114370 New | RH Red Hat build of Apache Camel for Spring Boot 4 Red Hat | 3.7 | Oct 21 | Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal |
| CVE-2026-113786 New | PY pypdf py-pdf | 2.3 | Oct 21 | pypdf: Unvalidated JPEG image data loading |
| CVE-2026-104949 New | WA WarehousePG EnterpriseDB | 2.3 | Oct 21 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby() |