CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 21:23 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-119421 New | HY hyperswitch juspay | 5.9 | Oct 30 | Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation |
| CVE-2026-119420 New | LA lago getlago | 8.8 | Oct 30 | Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation |
| CVE-2026-119419 New | CA cakephp cakephp | 8.1 | Oct 30 | CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation |
| CVE-2026-119418 New | CA cakephp cakephp | 8.1 | Oct 30 | CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() |
| CVE-2026-119417 New | CA cakephp cakephp | 3.7 | Oct 30 | CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport |
| CVE-2026-119416 New | CA cakephp cakephp | 4.8 | Oct 30 | CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching |
| CVE-2026-119415 New | CA cakephp cakephp | 3.7 | Oct 30 | CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type |
| CVE-2026-119414 New | SE server bitwarden | 4.3 | Oct 30 | Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create |
| CVE-2026-119409 New | CO core opnsense | 7.2 | Oct 30 | OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting |
| CVE-2026-119408 New | N8 n8n n8n-io | 8.8 | Oct 30 | n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes |
| CVE-2026-119407 New | EL element-desktop element-hq | 7.1 | Oct 30 | Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters |
| CVE-2026-119379 New | SQ SQLite SQLite | 7.8 | Oct 30 | SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind() |
| CVE-2026-119378 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite() |
| CVE-2026-119377 New | SQ SQLite SQLite | 2.5 | Oct 30 | SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING |
| CVE-2026-119376 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain |
| CVE-2026-119375 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch |
| CVE-2026-119374 New | SQ SQLite SQLite | 7.8 | Oct 30 | SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete() |
| CVE-2026-119373 New | SQ SQLite SQLite | 7.8 | Oct 30 | SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists() |
| CVE-2026-119372 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet() |
| CVE-2026-119371 New | SQ SQLite SQLite | 5.5 | Oct 30 | SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander() |
| CVE-2026-119364 New | PR ProFTPD ProFTPD Project | 5.3 | Oct 30 | ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass |
| CVE-2026-119147 New | PR ProFTPD ProFTPD Project | 4.3 | Oct 30 | ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass |
| CVE-2026-119146 New | PR ProFTPD ProFTPD Project | 5.6 | Oct 30 | ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap |
| CVE-2026-116366 New | CL ClickHouse ClickHouse | 9.5 | Oct 30 | Unauthenticated RCE vulnerability against ClickHouse Server |
| CVE-2026-22110 New | DU Delta UFC500 Delta Electronics | 8.7 | Oct 30 | Missing authentication check on POST/PUT requests |
| CVE-2026-22105 New | DU Delta UFC500 Delta Electronics | 8.7 | Oct 30 | Use of default password based on serial number |
| CVE-2026-22109 New | DU Delta UFC500 Delta Electronics | 8.4 | Oct 30 | Default WebUI passwords stored in plaintext |
| CVE-2026-22114 New | DU Delta UFC500 Delta Electronics | 5.3 | Oct 30 | Missing brute-force protection for web interface |
| CVE-2025-31704 New | IC Intelligent Connection Center Dahua | 9.8 | Oct 30 | Dahua Intelligent Connection Center command injection |
| CVE-2026-85268 New | IP Identity Platform and Firebase Authentication Google Cloud | 8.7 | Oct 30 | Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID |
| CVE-2026-14467 New | FC Forocoches comments editor Forocoches | 8.2 | Oct 30 | Display of information in the Forocoches comments editor |
| CVE-2026-97209 New | EL elixir elixir-lang | 5.4 | Oct 30 | Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build |
| CVE-2026-115274 New | EL elixir elixir-lang | 6.9 | Oct 30 | Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir |
| CVE-2026-109821 New | EL elixir elixir-lang | 6.3 | Oct 30 | Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir |
| CVE-2026-59387 New | CC CAPI (Cloud Controller API) Cloud Foundry | 8.8 | Oct 30 | Broken access control restriction in Cloud Controller API |
| CVE-2026-59385 New | CC CAPI (Cloud Foundry Controller) Cloud Foundry | 2.7 | Oct 30 | Space Developer can extract space-scoped broker credentials |
| CVE-2026-59388 New | CC CAPI (Cloud Foundry Controller) Cloud Foundry Foundation | 6.5 | Oct 30 | Cloud Controller exposes secrets in audit log |
| CVE-2026-59386 New | CF cf-deployment Cloud Foundry | 6.5 | Oct 30 | Credential exposure to space supporter |
| CVE-2026-64618 New | AF Apache Fineract Apache Software Foundation | – | Oct 30 | Apache Fineract: SQL injection vulnerability in Search API |
| CVE-2026-59396 New | CF cf-deployment Cloud Foundry | 4.9 | Oct 30 | DoS Vulnerability in UAA Related to JWKS URI Handling |
| CVE-2026-115456 New | RH Red Hat Enterprise Linux 10 Red Hat | 3.7 | Oct 30 | Gcc: out-of-bounds read in std::from_chars |
| CVE-2026-65874 New | AF Apache Fineract Apache Software Foundation | – | Oct 30 | Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints |
| CVE-2026-82104 New | AT ATRM Teltonika Networks | 9.4 | Oct 30 | API permission bypass via logic bug |
| CVE-2026-115455 New | RH Red Hat Enterprise Linux 10 Red Hat | 6.5 | Oct 30 | Gcc: stack overflow in std::bitset on libstdc++ |
| CVE-2026-114691 New | RH Red Hat Enterprise Linux 10 Red Hat | 5.9 | Oct 30 | Gcc: integer wrap in `std |
| CVE-2026-114690 New | RH Red Hat Enterprise Linux 10 Red Hat | 6.2 | Oct 30 | Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std |
| CVE-2026-103039 New | GF Gravity Forms Gravity Forms | 9.8 | Oct 30 | Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field |
| CVE-2026-110732 New | AE AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini tigroumeow | 7.5 | Oct 30 | AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration |
| CVE-2026-116622 New | FS Food Store – Online Food Delivery & Pickup wpscripts | 7.2 | Oct 30 | Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie |
| CVE-2026-97645 New | GF Gravity Forms Gravity Forms | 7.2 | Oct 30 | Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field |