CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 07:13 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113715 | VI virtualenv pypa | 2.0 | Oct 20 | virtualenv: Venv configuration readback can reinterpret path boundaries |
| CVE-2026-113717 | VI virtualenv pypa | 2.3 | Oct 20 | virtualenv: Pip seeding with download omits wheel digest verification |
| CVE-2026-113714 | VI virtualenv pypa | 2.3 | Oct 20 | virtualenv: Downloaded wheel selection and caching precede verification |
| CVE-2026-113665 | AP apostrophe apostrophecms | 3.7 | Oct 20 | ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints |
| CVE-2026-113657 | AP apostrophe apostrophecms | 3.7 | Oct 20 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) |
| CVE-2026-113651 | AP apostrophe apostrophecms | 3.3 | Oct 20 | ApostropheCMS: Path traversal in uploadfs |
| CVE-2026-113648 | IM import-export @apostrophecms | 3.1 | Oct 20 | ApostropheCMS: Missing Authentication in `cleanExport` Route |
| CVE-2026-113609 | BA Bandizip Bandisoft | 3.3 | Oct 20 | Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts |
| CVE-2026-113596 | WE webstudio webstudio-is | 3.1 | Oct 20 | Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds |
| CVE-2026-90799 | AC Apache CouchDB Apache Software Foundation | 1.3 | Oct 20 | Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values |
| CVE-2026-90798 | AC Apache CouchDB Apache Software Foundation | 0.6 | Oct 20 | Apache CouchDB: Replicator follows redirects indefinitely |
| CVE-2026-112945 | VI vite vitejs | 2.1 | Oct 20 | Vite: Cross origin script execution through Vite custom middleware |
| CVE-2026-112941 | FI filelock tox-dev | 3.3 | Oct 20 | filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock |
| CVE-2026-112912 | FI filelock tox-dev | 2.5 | Oct 20 | filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker |
| CVE-2026-113357 | E2 @e2e-dev/github tester-army | 3.5 | Oct 20 | @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker |
| CVE-2026-110725 | FA fast-uri fast-uri | 3.7 | Oct 20 | fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references |
| CVE-2026-110095 | FA fast-uri fast-uri | 3.7 | Oct 20 | fast-uri vulnerable to improper path equivalence in relative reference normalization |
| CVE-2026-86933 | MA macOS Apple | 3.3 | Oct 20 | A permissions issue was addressed with additional sandbox restrictions |
| CVE-2026-86874 | XC Xcode Apple | 3.3 | Oct 20 | An out-of-bounds read was addressed with improved input validation |
| CVE-2026-84547 | MA macOS Apple | 3.5 | Oct 20 | A memory corruption issue was addressed with improved input validation |
| CVE-2026-84490 | IA iOS and iPadOS Apple | 2.0 | Oct 20 | This issue was addressed through improved state management |
| CVE-2026-111766 | MA markdown-it markdown-it | 3.7 | Oct 19 | markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled |
| CVE-2026-112769 | PA parse-server parse-community | 2.3 | Oct 19 | Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass |
| CVE-2026-112249 | GR grandnode2 grandnode | 2.4 | Oct 19 | grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting |
| CVE-2026-1501 | CO Concert IBM | 3.7 | Oct 19 | IBM Concert Software Improper Certificate Validation |
| CVE-2026-3303 | CO Concert IBM | 3.7 | Oct 19 | IBM Concert Software Permissive Cross-domain Security Policy |
| CVE-2026-6930 | CO Concert IBM | 3.7 | Oct 19 | IBM Concert Software Risky Cryptographic Algorithm |
| CVE-2026-111749 | AI aiohttp aio-libs | 2.3 | Oct 19 | AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies |
| CVE-2024-4412 | WA WSO2 API Manager WSO2 | 2.7 | Oct 19 | Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations |
| CVE-2026-112193 | AE Aureus ERP Webkul | 3.7 | Oct 19 | Webkul Aureus ERP UserForm.php weak password |
| CVE-2026-12660 | MA MQ Advanced container images IBM | 2.7 | Oct 19 | IBM MQ Path Traversal |
| CVE-2026-111046 | FO FOSSBilling FOSSBilling | 2.3 | Oct 19 | FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions |
| CVE-2026-112157 | ME memmy-agent MemTensor | 3.1 | Oct 19 | MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption |
| CVE-2026-112288 | LA laravel-crm krayin | 3.3 | Oct 19 | Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding |
| CVE-2026-112284 | LI libaribcaption xqq | 3.3 | Oct 19 | libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR |
| CVE-2026-112274 | LI libtins libtins | 3.7 | Oct 19 | libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init |
| CVE-2026-111935 | NO NoteGen codexu | 2.6 | Oct 19 | NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis |
| CVE-2026-112106 | TI TikTok-Video-Downloader-PHP TufayelLUS | 3.7 | Oct 19 | TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation |
| CVE-2026-112105 | PA Passy GlitterWare | 3.7 | Oct 19 | GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation |
| CVE-2026-112103 | FA fatfree-core f3-factory | 3.7 | Oct 19 | f3-factory fatfree-core HTTP Client web.php _curl certificate validation |
| CVE-2026-112097 | IS Inventory System SourceCodester | 3.5 | Oct 19 | SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting |
| CVE-2026-112096 | IS Inventory System SourceCodester | 3.5 | Oct 19 | SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting |
| CVE-2026-112095 | IS Inventory System SourceCodester | 3.5 | Oct 19 | SourceCodester Inventory System Product Management products_handler.php save cross site scripting |
| CVE-2026-91831 | ST Subscribe to Comments | 3.8 | Oct 19 | Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting |
| CVE-2026-110034 | SB Salon Booking System | 3.7 | Oct 19 | Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code |
| CVE-2026-112042 | DI diem diem-project | 3.5 | Oct 19 | diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting |
| CVE-2026-112041 | DI diem diem-project | 3.7 | Oct 19 | diem-project diem dmString.php random weak prng |
| CVE-2026-112039 | DI diem diem-project | 2.4 | Oct 19 | diem-project diem Administrative Console actions.class.php append cross site scripting |
| CVE-2026-112038 | DI diem diem-project | 2.4 | Oct 19 | diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting |
| CVE-2026-112037 | DI diem diem-project | 3.7 | Oct 19 | diem-project diem Google Analytics Client gapi.class.php certificate validation |