CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 07:22 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116487 New | MC mcuxsdk-middleware-usb NXP | 4.6 | Oct 26 | NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read |
| CVE-2026-116486 New | OB objenesis easymock | 4.5 | Oct 26 | Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache |
| CVE-2026-116485 New | DA danmu_api huangxd- | 9.8 | Oct 26 | danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints |
| CVE-2026-116219 New | DO dolibarr Dolibarr | 7.2 | Oct 26 | Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter |
| CVE-2026-116218 New | DO dolibarr Dolibarr | 7.6 | Oct 26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field |
| CVE-2026-116217 New | RO rosariosis francoisjacquet | 6.1 | Oct 26 | RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php |
| CVE-2026-116216 New | MA maccms10 maccmspro | 5.3 | Oct 26 | MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment |
| CVE-2026-116215 New | MA maccms10 maccmspro | 3.1 | Oct 26 | MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption |
| CVE-2026-116214 New | MA maccms10 maccmspro | 9.1 | Oct 26 | MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code |
| CVE-2026-116213 New | WF Webasyst Framework Webasyst | 4.9 | Oct 26 | Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks |
| CVE-2026-116212 New | WF Webasyst Framework Webasyst | 5.4 | Oct 26 | Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL |
| CVE-2026-116210 New | WF Webasyst Framework Webasyst | 6.5 | Oct 26 | Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions |
| CVE-2026-116281 New | KA Kameleo Kameleo | 3.3 | Oct 26 | Kameleo Profile Controller t.cs ListProfiles information disclosure |
| CVE-2026-107157 New | QT Qt qt | 2.0 | Oct 26 | Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework |
| CVE-2026-115196 New | Product not mapped yet | 5.4 | Oct 26 | An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic |
| CVE-2026-115195 New | Product not mapped yet | 6.5 | Oct 26 | A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}) |
| CVE-2026-115194 New | Product not mapped yet | 6.5 | Oct 26 | A path traversal vulnerability exists in the Mautic Asset API |
| CVE-2026-115193 New | Product not mapped yet | 8.2 | Oct 26 | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7 |
| CVE-2026-115192 New | Product not mapped yet | 7.1 | Oct 26 | An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}) |
| CVE-2026-116280 New | KA Kameleo Kameleo | 5.5 | Oct 26 | Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery |
| CVE-2026-115191 New | Product not mapped yet | 7.1 | Oct 26 | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax) |
| CVE-2026-115190 New | Product not mapped yet | 8.0 | Oct 26 | An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties |
| CVE-2026-115189 New | Product not mapped yet | 8.8 | Oct 26 | A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic |
| CVE-2026-115188 New | Product not mapped yet | 9.9 | Oct 26 | An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7 |
| CVE-2026-116275 New | AL AllenNLP AllenAI | 6.3 | Oct 26 | AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection |
| CVE-2026-116492 New | CR crm frappe | 6.5 | Oct 26 | Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API |
| CVE-2026-110475 New | CC CreditNirvana Collections Platform (CollectionWorkz) CreditNirvana | 9.3 | Oct 26 | Improper Authentication Vulnerability in CreditNirvana Collections Platform |
| CVE-2026-116274 New | JI JIZHICMS Jizhicms | 4.3 | Oct 26 | JIZHICMS Front-end Order OrderController.php pay improper authorization |
| CVE-2026-110474 New | AA Agentic AI Call Centre CreditNirvana | 8.7 | Oct 26 | Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application |
| CVE-2026-115720 New | BU builder frappe | 5.0 | Oct 26 | Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect |
| CVE-2026-116263 New | PI PictShare HaschekSolutions | 4.6 | Oct 26 | HaschekSolutions PictShare File Upload core.php architect race condition |
| CVE-2026-105947 New | LS Logsign SIEM Innotim Software, Telecommunications, and Consulting Co. Ltd. | 6.5 | Oct 26 | Arbitrary File Read in Innotim Software's Logsign SIEM |
| CVE-2026-116262 New | LI libimobiledevice Libimobiledevice | 5.4 | Oct 26 | libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow |
| CVE-2026-115717 New | BU builder frappe | 7.7 | Oct 26 | Frappe Builder before 1.36.1 SSRF via convert_to_webp |
| CVE-2026-115718 New | BU builder frappe | 4.3 | Oct 26 | Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt |
| CVE-2026-96432 New | QT qt qt | 2.1 | Oct 26 | Null pointer dereference vulnerability in QNetworkAccessManager impacts Qt |
| CVE-2026-116261 New | LI libimobiledevice Libimobiledevice | 3.5 | Oct 26 | libimobiledevice AFC File afc.c afc_file_open out-of-bounds |
| CVE-2026-94380 New | LM Liman MYS HAVELSAN Inc. | 8.1 | Oct 26 | Host Header Injection in HAVELSAN's Liman MYS |
| CVE-2026-116260 New | LI libimobiledevice Libimobiledevice | 7.3 | Oct 26 | libimobiledevice AFC Service afc.c service_receive double free |
| CVE-2026-116259 New | LI libimobiledevice Libimobiledevice | 5.3 | Oct 26 | libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption |
| CVE-2026-116258 New | LI libimobiledevice Libimobiledevice | 6.3 | Oct 26 | libimobiledevice AFC afc.c heap-based overflow |
| CVE-2026-89209 New | MS Mendix SAML (Mendix 10 compatible) Siemens | 6.8 | Oct 26 | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix… |
| CVE-2026-114708 New | JE JetSmartFilters Crocoblock | 6.5 | Oct 26 | WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115595 New | CF Contact Form by Supsystic Supsystic | 5.3 | Oct 26 | WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability |
| CVE-2026-116469 New | MI misp-guard MISP | 7.1 | Oct 26 | MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding |
| CVE-2026-115959 New | AS APIExperts Square for WooCommerce WPExperts | 5.3 | Oct 26 | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability |
| CVE-2026-115960 New | AS APIExperts Square for WooCommerce WPExperts | 4.3 | Oct 26 | WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability |
| CVE-2026-115955 New | AP Advanced Post Block - Post Grid for WordPress block editor bPlugins | 6.5 | Oct 26 | WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115956 New | PV Panorama Viewer – 360 Degree Image + Video Viewer bPlugins | 6.5 | Oct 26 | WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115961 New | BS B Slider bPlugins | 6.5 | Oct 26 | WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability |