CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 01:03 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-80954 | LI Linux Linux | 7.8 | Sep 11 | i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() |
| CVE-2026-80953 | LI Linux Linux | 8.4 | Sep 11 | i3c: master: adi: initialize the lock before enabling interrupts |
| CVE-2026-80952 | LI Linux Linux | 7.8 | Sep 11 | i3c: master: Fix info leak and UAF in device unregister path |
| CVE-2026-80950 | LI Linux Linux | 7.8 | Sep 11 | i3c: renesas: Check that the transfer is valid before accessing it |
| CVE-2026-80947 | LI Linux Linux | 7.8 | Sep 11 | wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop |
| CVE-2026-80944 | LI Linux Linux | 7.8 | Sep 11 | wifi: mwifiex: Detach sync cmd buffer on interrupted wait |
| CVE-2026-80943 | LI Linux Linux | 7.6 | Sep 11 | wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids |
| CVE-2026-80937 | LI Linux Linux | 8.8 | Sep 11 | wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy |
| CVE-2026-80936 | LI Linux Linux | 7.8 | Sep 11 | wifi: mt76: mt7925: cancel mlo_pm_work on stop |
| CVE-2026-80935 | LI Linux Linux | 8.8 | Sep 11 | wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy |
| CVE-2026-80933 | LI Linux Linux | 7.8 | Sep 11 | wifi: mt76: mt7996: validate default EEPROM firmware size |
| CVE-2026-80932 | LI Linux Linux | 8.4 | Sep 11 | vsock/virtio: flush works in dependency order |
| CVE-2026-80931 | LI Linux Linux | 7.8 | Sep 11 | w1: ds28e17: reject an oversize length on an I2C block read |
| CVE-2026-80929 | LI Linux Linux | 7.8 | Sep 11 | sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] |
| CVE-2026-80928 | LI Linux Linux | 7.8 | Sep 11 | smack: fix cred UAF in smack_file_send_sigiotask() |
| CVE-2026-62089 | MA Master Addons for Elementor Pixar Labs | 7.1 | Sep 11 | WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability |
| CVE-2026-62112 | AM Amelia Melograno Venture Studio | 7.6 | Sep 11 | WordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability |
| CVE-2026-62109 | SA Sky Addons for Elementor wowDevs | 7.6 | Sep 11 | WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability |
| CVE-2026-62107 | ML Masteriyo - LMS masteriyo | 8.8 | Sep 11 | WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability |
| CVE-2026-62106 | SA SMS Alert Order Notifications Cozy Vision Technologies Pvt. Ltd. | 8.8 | Sep 11 | WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability |
| CVE-2026-62102 | GG Gato GraphQL Gato GraphQL | 8.8 | Sep 11 | WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability |
| CVE-2026-67211 | AO Apache OpenNLP Apache Software Foundation | 7.5 | Sep 11 | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer |
| CVE-2026-89099 | MO MongoDB MongoDB | 7.5 | Sep 11 | Race Condition in MongoDB Server Document Value Layer Leads to Memory Corruption |
| CVE-2026-72708 | SP SPIP SPIP | 7.5 | Sep 11 | SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html |
| CVE-2026-89066 | PR projen AWS | 7.8 | Sep 11 | OS command injection in the task synthesis component in projen |
| CVE-2026-89065 | PR projen AWS | 7.1 | Sep 11 | Relative path traversal in the generated file manifest cleanup component in projen |
| CVE-2026-7863 | PS Pardus Software TUBITAK BILGEM Software Technologies Research Institute | 8.4 | Sep 11 | OS Command Injection in TUBITAK BILGEM's Pardus Software |
| CVE-2026-89013 | DO Dolibarr Dolibarr | 7.5 | Sep 11 | Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php |
| CVE-2026-70341 | ME Microsoft Edge (Chromium-based) Microsoft | 8.8 | Sep 11 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-68497 | JA jackson-databind FasterXML | 7.5 | Sep 11 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service |
| CVE-2026-89262 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check |
| CVE-2026-89260 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint |
| CVE-2026-38056 | 3T 3315-Series terminals ST Engineering iDirect | 8.8 | Sep 11 | ST Engineering iDirect iQ-Series Terminals Missing Authorization |
| CVE-2026-38058 | 3T 3315-Series terminals ST Engineering iDirect | 8.1 | Sep 11 | ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere |
| CVE-2026-8301 | PB Pardus Boot Repair TUBITAK BILGEM Software Technologies Research Institute | 7.8 | Sep 11 | OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair |
| CVE-2026-85979 | PE Puppet Enterprise Perforce Software | 8.6 | Sep 11 | Command Injection in Puppet Enterprise |
| CVE-2026-82578 | MC Mirth Connect NextGen Healthcare | 7.5 | Sep 11 | NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference |
| CVE-2026-78224 | MC Mirth Connect NextGen Healthcare | 8.2 | Sep 11 | NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference |
| CVE-2026-82583 | MC Mirth Connect NextGen Healthcare | 8.3 | Sep 11 | NextGen Healthcare Mirth Connect SQL Injection |
| CVE-2026-8303 | PA Pardus-software TUBITAK BILGEM Software Technologies Research Institute | 7.8 | Sep 11 | Privilege Escalation in TUBITAK BILGEM's Pardus-software |
| CVE-2026-87020 | DS DICOM Server Orthanc | 8.1 | Sep 11 | Orthanc DICOM Server Integer Overflow or Wraparound |
| CVE-2026-57842 | NE NetBSD The NetBSD Foundation | 7.0 | Sep 11 | NetBSD COMPAT_NETBSD32 Double Free / Use-After-Free via recvmsg() msg_iovlen |
| CVE-2026-71416 | HE headroom headroomlabs-ai | 8.8 | Sep 11 | Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) |
| CVE-2026-89212 | AK Akana Perforce | 8.6 | Sep 11 | XML External Entity in Akana API Platform |
| CVE-2026-87776 | CO compression compression | 7.5 | Sep 11 | compression vulnerable to Denial of Service via memory leak on premature response close |
| CVE-2026-89256 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo Bookmark Plugin Stored XSS via Chapter Names |
| CVE-2026-89255 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo LoginControl Stored XSS via PGP Public Key |
| CVE-2026-89254 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo CustomizeUser Stored XSS via field_name Parameter |
| CVE-2026-89253 | AV AVideo WWBN | 8.7 | Sep 11 | AVideo Stored XSS via donationLink in watch page button |
| CVE-2026-89250 | AV AVideo WWBN | 7.5 | Sep 11 | WWBN AVideo Unauthenticated File Read via getRecordedFile.php |