CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 20:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-96371 New | DR Drupal Drupal | 5.4 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166 |
| CVE-2026-96372 New | DR Drupal Drupal | 5.4 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167 |
| CVE-2026-96373 New | DR Drupal Drupal | 3.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168 |
| CVE-2026-96366 New | DR Drupal Drupal | 5.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169 |
| CVE-2026-96365 New | DR Drupal Drupal | 7.5 | Oct 22 | Webform - Less critical - Denial of service - SA-CONTRIB-2026-170 |
| CVE-2026-96364 New | DR Drupal Drupal | 5.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-171 |
| CVE-2026-96357 New | DR Drupal Drupal | 4.6 | Oct 22 | Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172 |
| CVE-2026-96398 New | DR Drupal Drupal | 4.3 | Oct 22 | Webform - Less critical - Access bypass - SA-CONTRIB-2026-173 |
| CVE-2026-96356 New | DR Drupal Drupal | 5.3 | Oct 22 | Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174 |
| CVE-2026-96355 New | DR Drupal Drupal | 9.1 | Oct 22 | Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 |
| CVE-2026-96375 New | DR Drupal Drupal | 4.8 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-176 |
| CVE-2026-96376 New | DR Drupal Drupal | 6.4 | Oct 22 | Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177 |
| CVE-2026-96374 New | DR Drupal Drupal | 4.2 | Oct 22 | Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178 |
| CVE-2026-96378 New | DR Drupal Drupal | 4.3 | Oct 22 | Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179 |
| CVE-2026-96384 New | DR Drupal Drupal | 3.5 | Oct 22 | Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180 |
| CVE-2026-96379 New | DR Drupal Drupal | – | Oct 22 | CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181 |
| CVE-2026-96385 New | DR Drupal Drupal | 6.5 | Oct 22 | REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182 |
| CVE-2026-96387 New | DR Drupal Drupal | 3.8 | Oct 22 | Stop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-183 |
| CVE-2026-96388 New | DR Drupal Drupal | 5.4 | Oct 22 | Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184 |
| CVE-2026-96390 New | DR Drupal Drupal | 4.3 | Oct 22 | Editoria11y Accessibility Checker - Moderately critical - Access bypass - SA-CONTRIB-2026-185 |
| CVE-2026-96391 New | DR Drupal Drupal | – | Oct 22 | Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186 |
| CVE-2026-96392 New | DR Drupal Drupal | 3.5 | Oct 22 | AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 |
| CVE-2026-96377 New | DR Drupal Drupal | 5.3 | Oct 22 | Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188 |
| CVE-2026-96380 New | DR Drupal Drupal | 6.5 | Oct 22 | CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189 |
| CVE-2026-96386 New | DR Drupal Drupal | 6.5 | Oct 22 | Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190 |
| CVE-2026-96382 New | DR Drupal Drupal | 4.6 | Oct 22 | Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191 |
| CVE-2026-114717 New | WE Webmail Roundcube | 4.0 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment |
| CVE-2026-114716 New | WE Webmail Roundcube | 8.5 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability |
| CVE-2026-114715 New | WE Webmail Roundcube | 6.8 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin |
| CVE-2026-114714 New | WE Webmail Roundcube | 5.3 | Oct 22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin |
| CVE-2026-114575 New | A9 A950RG TOTOLINK | 10.0 | Oct 22 | TOTOLINK A950RG product.so UploadCustomModule command injection |
| CVE-2026-110264 New | GI GitLab GitLab | 10.0 | Oct 22 | Integer Overflow or Wraparound in GitLab |
| CVE-2026-78846 New | Product not mapped yet | 9.8 | Oct 22 | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing |
| CVE-2025-69723 New | Product not mapped yet | 6.1 | Oct 22 | A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL |
| CVE-2025-65200 New | Product not mapped yet | 5.4 | Oct 22 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the… |
| CVE-2026-78801 New | Product not mapped yet | 4.3 | Oct 22 | An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the… |
| CVE-2026-107079 New | Product not mapped yet | – | Oct 22 | An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html component |
| CVE-2026-51954 New | Product not mapped yet | – | Oct 22 | An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri |
| CVE-2026-114574 New | MA massCode massCodeIO | 4.3 | Oct 21 | massCodeIO massCode Local HTTP Service index.ts information disclosure |
| CVE-2026-12664 New | GI GitLab GitLab | 6.8 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-13319 New | GI GitLab GitLab | 6.5 | Oct 21 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-14288 New | GI GitLab GitLab | 3.1 | Oct 21 | Use of Incorrectly-Resolved Name or Reference in GitLab |
| CVE-2026-15723 New | GI GitLab GitLab | 8.2 | Oct 21 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab |
| CVE-2026-16255 New | GI GitLab GitLab | 5.9 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-103515 New | GI GitLab GitLab | 2.7 | Oct 21 | Incorrect Authorization in GitLab |
| CVE-2026-105711 New | GI GitLab GitLab | 3.5 | Oct 21 | Use of Cache Containing Sensitive Information in GitLab |
| CVE-2026-105777 New | GI GitLab GitLab | 6.5 | Oct 21 | Insertion of Sensitive Information Into Sent Data in GitLab |
| CVE-2026-112378 New | GI GitLab GitLab | 4.3 | Oct 21 | Use of Less Trusted Source in GitLab |
| CVE-2026-112212 New | GI GitLab GitLab | 7.5 | Oct 21 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab |
| CVE-2026-112326 New | GI GitLab GitLab | 3.1 | Oct 21 | Improper Cleanup on Thrown Exception in GitLab |