CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 08:27 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112037 | DI diem diem-project | 3.7 | Oct 19 | diem-project diem Google Analytics Client gapi.class.php certificate validation |
| CVE-2026-112031 | LM LMS Chamilo | 3.5 | Oct 18 | Chamilo LMS Ticket TicketManager.php addProject cross site scripting |
| CVE-2026-112112 | BI BIRD nic | 2.3 | Oct 18 | An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address… |
| CVE-2026-112029 | DI diem diem-project | 2.5 | Oct 18 | diem-project diem SHA1 PluginDmUser.class.php weak password hash |
| CVE-2026-112026 | CM cms light0011 | 3.7 | Oct 18 | light0011 cms UserModel.class.php sha1 weak password hash |
| CVE-2026-97204 | GI Gitea Gitea | 3.1 | Oct 18 | Gitea label deletion across repository and organization IDs |
| CVE-2026-111993 | ST StudentManagement Soarkey | 3.3 | Oct 18 | Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage |
| CVE-2026-112050 | GI gitify gitify-app | 3.1 | Oct 18 | Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation |
| CVE-2026-112004 | TE teable teableio | 3.1 | Oct 18 | Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint |
| CVE-2026-111874 | OP OpenCATS Opencats | 3.7 | Oct 18 | OpenCATS Career Portal CareersUI.php processLogin excessive authentication |
| CVE-2026-111934 | CO coder coder | 3.7 | Oct 17 | Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header |
| CVE-2026-111933 | CO coder coder | 3.7 | Oct 17 | Coder before 2.34.2 User Enumeration via Login Placeholder Hash |
| CVE-2026-111932 | CO coder coder | 3.4 | Oct 17 | Coder before 2.34.2 Stored HTML Injection via Appearance Settings |
| CVE-2026-111926 | CO coder coder | 3.3 | Oct 17 | Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest |
| CVE-2026-111888 | PH phpMyFAQ thorsten | 2.7 | Oct 17 | phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API |
| CVE-2026-92431 | PW Patreon WordPress | 3.7 | Oct 17 | Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration |
| CVE-2026-111602 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 3.7 | Oct 17 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter |
| CVE-2026-17591 | RH Red Hat Enterprise Linux 10 Red Hat | 3.6 | Oct 16 | Libarchive: libarchive: use-after-free via aliased mac metadata copy |
| CVE-2026-17068 | I i IBM | 3.3 | Oct 16 | IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System |
| CVE-2026-111714 | TA tarteaucitron.js AmauriC | 3.1 | Oct 16 | tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge |
| CVE-2026-111678 | AN antiword Adri van Os | 3.3 | Oct 16 | Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing |
| CVE-2026-111658 | SS SSCMS SiteServer | 3.8 | Oct 16 | SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API |
| CVE-2026-111655 | TH think-plugs-admin zoujingli | 3.8 | Oct 16 | ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit |
| CVE-2026-111648 | BU buildadmin build-admin | 2.7 | Oct 16 | BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter |
| CVE-2026-111624 | UM Umbraco-CMS umbraco | 3.7 | Oct 16 | Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs |
| CVE-2026-111609 | OJ Open Journal Systems PKP | 3.8 | Oct 16 | PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription |
| CVE-2026-111604 | EL eladmin elunez | 3.8 | Oct 16 | eladmin through 2.7 Broken Access Control via /api/users Update and Delete |
| CVE-2026-109839 | DG Db2 Genius Hub IBM | 3.1 | Oct 16 | IBM Db2 Genius Hub Missing Cryptographic Step |
| CVE-2026-111581 | RH Red Hat Enterprise Linux 10 Red Hat | 3.3 | Oct 16 | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method |
| CVE-2026-110805 | SE Server Devolutions | 2.6 | Oct 16 | Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne… |
| CVE-2026-109401 | WM WP Mail Logging smub | 2.7 | Oct 16 | WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email |
| CVE-2026-110191 | PD Product Delivery Date for WooCommerce | 2.7 | Oct 16 | Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions |
| CVE-2026-110039 | SM Smush | 2.7 | Oct 16 | Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite |
| CVE-2026-111448 | WH Wheels Wheels | 3.7 | Oct 16 | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems |
| CVE-2026-111354 | CR crmeb_java crmeb | 3.1 | Oct 15 | crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints |
| CVE-2026-111332 | OX OxiCloud AtalayaLabs | 3.7 | Oct 15 | OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie |
| CVE-2026-111169 | DO docs suitenumerique | 3.1 | Oct 15 | La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation |
| CVE-2026-55876 | PL platform HeliumEdu | 3.5 | Oct 15 | Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts |
| CVE-2026-55453 | CU cups OpenPrinting | 3.3 | Oct 15 | CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip |
| CVE-2026-55467 | CU cups OpenPrinting | 2.5 | Oct 15 | CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix) |
| CVE-2026-61610 | LY Lychee LycheeOrg | 2.3 | Oct 15 | Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous |
| CVE-2026-57569 | LY Lychee LycheeOrg | 2.3 | Oct 15 | Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation |
| CVE-2026-55184 | ES espocrm espocrm | 3.5 | Oct 15 | EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled |
| CVE-2026-53575 | ES espocrm espocrm | 2.7 | Oct 15 | EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user |
| CVE-2026-79835 | HN HPE Nonstop KMS Server Hewlett Packard Enterprise | 2.8 | Oct 15 | HPE Nonstop KMS Server - Buffer overflow vulnerability |
| CVE-2025-29897 | QC Qsync Central QNAP Systems Inc. | 2.3 | Oct 15 | Stack-based Buffer Overflow in qsyncsrv.cgi |
| CVE-2025-29896 | QC Qsync Central QNAP Systems Inc. | 2.3 | Oct 15 | NULL Pointer Dereference in qsyncsrv.cgi |
| CVE-2025-29895 | QC Qsync Central QNAP Systems Inc. | 2.3 | Oct 15 | NULL Pointer Dereference in qsyncsrv.cgi |
| CVE-2026-110810 | WH whisper.cpp ggml-org | 2.8 | Oct 15 | ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds |
| CVE-2026-110861 | BE better-auth better-auth | 3.7 | Oct 14 | Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition |