CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 19:37 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-89013 | DO Dolibarr Dolibarr | 7.5 | Sep 11 | Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php |
| CVE-2026-70341 | ME Microsoft Edge (Chromium-based) Microsoft | 8.8 | Sep 11 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-68497 | JA jackson-databind FasterXML | 7.5 | Sep 11 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service |
| CVE-2026-89262 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check |
| CVE-2026-89260 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint |
| CVE-2026-38056 | 3T 3315-Series terminals ST Engineering iDirect | 8.8 | Sep 11 | ST Engineering iDirect iQ-Series Terminals Missing Authorization |
| CVE-2026-38058 | 3T 3315-Series terminals ST Engineering iDirect | 8.1 | Sep 11 | ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere |
| CVE-2026-8301 | PB Pardus Boot Repair TUBITAK BILGEM Software Technologies Research Institute | 7.8 | Sep 11 | OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair |
| CVE-2026-85979 | PE Puppet Enterprise Perforce Software | 8.6 | Sep 11 | Command Injection in Puppet Enterprise |
| CVE-2026-82578 | MC Mirth Connect NextGen Healthcare | 7.5 | Sep 11 | NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference |
| CVE-2026-78224 | MC Mirth Connect NextGen Healthcare | 8.2 | Sep 11 | NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference |
| CVE-2026-82583 | MC Mirth Connect NextGen Healthcare | 8.3 | Sep 11 | NextGen Healthcare Mirth Connect SQL Injection |
| CVE-2026-8303 | PA Pardus-software TUBITAK BILGEM Software Technologies Research Institute | 7.8 | Sep 11 | Privilege Escalation in TUBITAK BILGEM's Pardus-software |
| CVE-2026-87020 | DS DICOM Server Orthanc | 8.1 | Sep 11 | Orthanc DICOM Server Integer Overflow or Wraparound |
| CVE-2026-57842 | NE NetBSD The NetBSD Foundation | 7.0 | Sep 11 | NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen |
| CVE-2026-71416 | HE headroom headroomlabs-ai | 8.8 | Sep 11 | Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) |
| CVE-2026-89212 | AK Akana Perforce | 8.6 | Sep 11 | XML External Entity in Akana API Platform |
| CVE-2026-87776 | CO compression compression | 7.5 | Sep 11 | compression vulnerable to Denial of Service via memory leak on premature response close |
| CVE-2026-89256 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo Bookmark Plugin Stored XSS via Chapter Names |
| CVE-2026-89255 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo LoginControl Stored XSS via PGP Public Key |
| CVE-2026-89254 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo CustomizeUser Stored XSS via field_name Parameter |
| CVE-2026-89253 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo Stored XSS via donationLink in watch page button |
| CVE-2026-89250 | AV AVideo WWBN | 7.5 | Sep 11 | WWBN AVideo Unauthenticated File Read via getRecordedFile.php |
| CVE-2026-89249 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo YPTWallet Stored XSS via CryptoWallet Configuration |
| CVE-2026-89243 | AV AVideo WWBN | 8.1 | Sep 11 | WWBN AVideo Stored XSS via UserGroups setGroup_name |
| CVE-2026-89242 | AV AVideo WWBN | 7.2 | Sep 11 | WWBN AVideo Unauthenticated SSRF via login.json.php |
| CVE-2026-89147 | NE Net-SNMP net-snmp | 7.5 | Sep 11 | Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read |
| CVE-2026-89146 | LI libp2p-rendezvous libp2p | 7.5 | Sep 11 | libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses |
| CVE-2026-17037 | KF Kirki – Freeform Page Builder, Website Builder & Customizer themeum | 7.2 | Sep 11 | Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter |
| CVE-2026-80469 | SC Sentio Creator Extension 'Device Manager' SICK AG | 8.3 | Sep 11 | No description published yet |
| CVE-2026-19486 | GE Gemini Enterprise Agent Platform App Builder Google Cloud | 8.7 | Sep 11 | SSRF in Gemini Enterprise Agent Platform App Builder |
| CVE-2025-15679 | BX BullSequana XH3406 Bull | 7.3 | Sep 11 | BMC root account active without password on BullSequana XH3406 and XH3515 |
| CVE-2026-89178 | WE WeenyGenius Howyar | 8.8 | Sep 11 | Howyar｜WeenyGenius - Origin Validation Error |
| CVE-2026-89177 | WE WeenyGenius Howyar | 8.8 | Sep 11 | Howyar｜WeenyGenius - Use of Insecure Protocol |
| CVE-2026-89176 | WE WeenyGenius Howyar | 8.8 | Sep 11 | Howyar｜WeenyGenius - Missing Authentication |
| CVE-2026-89174 | EH EH1000B Kingdom Communication Associated | 7.5 | Sep 11 | Kingdom Communication Associated｜Smart Video Intercom System - Missing Burte-force Protection |
| CVE-2026-73785 | HI HPE IceWall products Hewlett Packard Enterprise | 7.5 | Sep 11 | HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability |
| CVE-2026-87908 | MU multiparty multiparty | 7.5 | Sep 11 | multiparty vulnerable to Denial of Service via unbounded part-header accumulation |
| CVE-2026-73784 | HI HPE IceWall products Hewlett Packard Enterprise | 8.8 | Sep 11 | HPE IceWall products, Remote Bypass of Security Restrictions |
| CVE-2026-85677 | GN Gutenverse News | 8.8 | Sep 11 | Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content |
| CVE-2026-74925 | MU MultiVendorX | 7.2 | Sep 11 | MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator |
| CVE-2026-89060 | RH Red Hat Advanced Cluster Management for Kubernetes 2.13 Red Hat | 7.7 | Sep 11 | Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references |
| CVE-2026-89161 | PC PCRE2 PCRE | 7.8 | Sep 11 | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context |
| CVE-2026-89157 | PC PCRE2 PCRE | 7.4 | Sep 11 | PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern |
| CVE-2026-19991 | UF UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP stiofansisland | 8.1 | Sep 11 | UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion |
| CVE-2026-81754 | V1 Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… fernandot | 7.2 | Sep 11 | Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-18561 | UE Unlimited Elements For Elementor unitecms | 7.5 | Sep 11 | Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection |
| CVE-2026-81825 | SA Simple Ajax Chat – Add a Fast, Secure Chat Box specialk | 7.2 | Sep 11 | Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2026-15462 | SC Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons gingerplugins | 7.5 | Sep 11 | Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection |
| CVE-2026-18579 | WP WP Photo Album Plus opajaap | 7.2 | Sep 11 | WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting |