CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 08:02 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116884 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 5.0.0 before 7.3.1 Stored XSS via Tooltip Module data-* Attributes |
| CVE-2026-116883 New | SE SemanticMediaWiki SemanticMediaWiki | 4.8 | Oct 27 | Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions |
| CVE-2026-116882 New | SE SemanticMediaWiki SemanticMediaWiki | 4.8 | Oct 27 | Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels |
| CVE-2026-116881 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | Semantic MediaWiki 3.0.0 before 7.3.1 XSS via Property-Value Autocomplete |
| CVE-2026-116879 New | SE SemanticMediaWiki SemanticMediaWiki | 5.4 | Oct 27 | Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task |
| CVE-2026-116877 New | SE SemanticMediaWiki SemanticMediaWiki | 6.5 | Oct 27 | Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event |
| CVE-2026-116875 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters |
| CVE-2026-116874 New | SE SemanticMediaWiki SemanticMediaWiki | 6.1 | Oct 27 | SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter |
| CVE-2026-117530 New | JC Junie CLI JetBrains | 6.7 | Oct 27 | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands |
| CVE-2026-111548 New | NW NPort W2150A-W4/W2250A-W4 Series Moxa | 5.3 | Oct 27 | A stack-based buffer overflow vulnerability exists in the web management interface of affected Moxa wireless device servers |
| CVE-2026-107147 New | TW twofactor_gauthenticator alexandregz | 6.3 | Oct 27 | Authentication bypass by spoofing in twofactor_gauthenticator |
| CVE-2026-107146 New | TW twofactor_gauthenticator alexandregz | 6.3 | Oct 27 | Insufficient session expiration in twofactor_gauthenticator |
| CVE-2026-107145 New | TW twofactor_gauthenticator alexandregz | 6.3 | Oct 27 | Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticator |
| CVE-2026-102787 New | PD Phoca Download extension for Joomla phoca.cz | 5.3 | Oct 27 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 |
| CVE-2026-65213 New | MB MBD-X12SPI SMCI | 6.6 | Oct 27 | Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability |
| CVE-2026-65210 New | MB MBD-X12SPI SMCI | 4.9 | Oct 27 | Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability |
| CVE-2026-10511 New | JX Jupiter X Core artbees | 6.4 | Oct 27 | Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter |
| CVE-2026-107472 New | QT Qt qt | 4.3 | Oct 27 | Out-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt |
| CVE-2026-101034 New | SG Symantec Ghost Solution Suite Broadcom | 6.8 | Oct 27 | Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials |
| CVE-2026-105946 New | QT qt qt | 5.3 | Oct 27 | Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt |
| CVE-2026-103359 New | PW PayDunya WooCommerce Payment Gateway | 5.3 | Oct 27 | PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery |
| CVE-2026-103312 New | PI Payment Integration Wompi | 5.3 | Oct 27 | Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback |
| CVE-2026-103332 New | PP Payex Payment Gateway for Woocommerce | 5.3 | Oct 27 | Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key |
| CVE-2026-117472 New | PS Psono esaqa GmbH | 4.3 | Oct 27 | URL prefix handling permits API key read-scope bypass in Psono Server |
| CVE-2026-117471 New | PS Psono esaqa GmbH | 5.4 | Oct 27 | User-controlled Duo host permits authenticated SSRF in Psono Server |
| CVE-2026-117470 New | PS Psono esaqa GmbH | 6.5 | Oct 27 | WebAuthn assertion replay permits second-factor bypass in Psono Server |
| CVE-2026-117469 New | PS Psono esaqa GmbH | 5.4 | Oct 27 | File-transfer type confusion permits unauthorized repository writes in Psono Server |
| CVE-2026-117468 New | PS Psono esaqa GmbH | 6.5 | Oct 27 | Device-code claim permits restricted token escalation in Psono Server |
| CVE-2026-88781 New | MF motherboards firmware ASUS | 6.8 | Oct 27 | Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an arbitrary memory address via an I/O command, leading to… |
| CVE-2026-116844 New | FT ftpserverlib fclairamb | 4.8 | Oct 27 | Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P |
| CVE-2026-116842 New | DE DevilutionX diasurgical | 6.1 | Oct 27 | DevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup |
| CVE-2026-116841 New | DE DevilutionX diasurgical | 5.5 | Oct 27 | DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup |
| CVE-2026-116840 New | LL llama.cpp ggml-org | 6.1 | Oct 27 | llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader |
| CVE-2026-116829 New | LL llama.cpp ggml-org | 6.6 | Oct 27 | llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader |
| CVE-2025-71439 New | LL llama.cpp ggml-org | 5.5 | Oct 27 | llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info |
| CVE-2024-58399 New | LL llama.cpp ggml-org | 6.1 | Oct 27 | llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets |
| CVE-2026-116608 New | VI VideoLLaMA2 DAMO Academy | 5.4 | Oct 27 | DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check |
| CVE-2026-116605 New | OF Online Food Ordering System SourceCodester | 5.3 | Oct 27 | SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security |
| CVE-2026-116604 New | OF Online Food Ordering System SourceCodester | 6.5 | Oct 26 | SourceCodester Online Food Ordering System delete_admin.php missing authentication |
| CVE-2026-116603 New | OF Online Food Ordering System SourceCodester | 4.7 | Oct 26 | SourceCodester Online Food Ordering System add_food.php unrestricted upload |
| CVE-2026-116828 New | YE yeswiki YesWiki | 4.9 | Oct 26 | YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand |
| CVE-2026-116827 New | YE yeswiki YesWiki | 6.8 | Oct 26 | YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import |
| CVE-2026-116826 New | YE yeswiki YesWiki | 6.8 | Oct 26 | YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile |
| CVE-2026-116825 New | YE yeswiki YesWiki | 6.5 | Oct 26 | YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox |
| CVE-2026-116824 New | YE yeswiki YesWiki | 6.1 | Oct 26 | YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler |
| CVE-2026-116823 New | YE yeswiki YesWiki | 6.1 | Oct 26 | YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback |
| CVE-2026-116822 New | YE yeswiki YesWiki | 5.3 | Oct 26 | YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter |
| CVE-2026-116821 New | YE yeswiki YesWiki | 6.5 | Oct 26 | YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames |
| CVE-2026-116820 New | YE yeswiki YesWiki | 5.3 | Oct 26 | YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter |
| CVE-2026-116817 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board |