CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 21:23 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-1501 | CO Concert IBM | 3.7 | Oct 19 | IBM Concert Software Improper Certificate Validation |
| CVE-2026-3303 | CO Concert IBM | 3.7 | Oct 19 | IBM Concert Software Permissive Cross-domain Security Policy |
| CVE-2026-6930 | CO Concert IBM | 3.7 | Oct 19 | IBM Concert Software Risky Cryptographic Algorithm |
| CVE-2026-111749 | AI aiohttp aio-libs | 2.3 | Oct 19 | AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies |
| CVE-2024-4412 | WA WSO2 API Manager WSO2 | 2.7 | Oct 19 | Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations |
| CVE-2026-112193 | AE Aureus ERP Webkul | 3.7 | Oct 19 | Webkul Aureus ERP UserForm.php weak password |
| CVE-2026-12660 | MA MQ Advanced container images IBM | 2.7 | Oct 19 | IBM MQ Path Traversal |
| CVE-2026-111046 | FO FOSSBilling FOSSBilling | 2.3 | Oct 19 | FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions |
| CVE-2026-112157 | ME memmy-agent MemTensor | 3.1 | Oct 19 | MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption |
| CVE-2026-112288 | LA laravel-crm krayin | 3.3 | Oct 19 | Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding |
| CVE-2026-112284 | LI libaribcaption xqq | 3.3 | Oct 19 | libaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR |
| CVE-2026-112274 | LI libtins libtins | 3.7 | Oct 19 | libtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init |
| CVE-2026-111935 | NO NoteGen codexu | 2.6 | Oct 19 | NoteGen through 0.38.3 Local File Disclosure via Chat Image Analysis |
| CVE-2026-112106 | TI TikTok-Video-Downloader-PHP TufayelLUS | 3.7 | Oct 19 | TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation |
| CVE-2026-112105 | PA Passy GlitterWare | 3.7 | Oct 19 | GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation |
| CVE-2026-112103 | FA fatfree-core f3-factory | 3.7 | Oct 19 | f3-factory fatfree-core HTTP Client web.php _curl certificate validation |
| CVE-2026-112097 | IS Inventory System SourceCodester | 3.5 | Oct 19 | SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting |
| CVE-2026-112096 | IS Inventory System SourceCodester | 3.5 | Oct 19 | SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting |
| CVE-2026-112095 | IS Inventory System SourceCodester | 3.5 | Oct 19 | SourceCodester Inventory System Product Management products_handler.php save cross site scripting |
| CVE-2026-91831 | ST Subscribe to Comments | 3.8 | Oct 19 | Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting |
| CVE-2026-110034 | SB Salon Booking System | 3.7 | Oct 19 | Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code |
| CVE-2026-112042 | DI diem diem-project | 3.5 | Oct 19 | diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting |
| CVE-2026-112041 | DI diem diem-project | 3.7 | Oct 19 | diem-project diem dmString.php random weak prng |
| CVE-2026-112039 | DI diem diem-project | 2.4 | Oct 19 | diem-project diem Administrative Console actions.class.php append cross site scripting |
| CVE-2026-112038 | DI diem diem-project | 2.4 | Oct 19 | diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting |
| CVE-2026-112037 | DI diem diem-project | 3.7 | Oct 19 | diem-project diem Google Analytics Client gapi.class.php certificate validation |
| CVE-2026-112031 | LM LMS Chamilo | 3.5 | Oct 18 | Chamilo LMS Ticket TicketManager.php addProject cross site scripting |
| CVE-2026-112112 | BI BIRD nic | 2.3 | Oct 18 | An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address… |
| CVE-2026-112029 | DI diem diem-project | 2.5 | Oct 18 | diem-project diem SHA1 PluginDmUser.class.php weak password hash |
| CVE-2026-112026 | CM cms light0011 | 3.7 | Oct 18 | light0011 cms UserModel.class.php sha1 weak password hash |
| CVE-2026-97204 | GI Gitea Gitea | 3.1 | Oct 18 | Gitea label deletion across repository and organization IDs |
| CVE-2026-111993 | ST StudentManagement Soarkey | 3.3 | Oct 18 | Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage |
| CVE-2026-112050 | GI gitify gitify-app | 3.1 | Oct 18 | Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation |
| CVE-2026-112004 | TE teable teableio | 3.1 | Oct 18 | Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint |
| CVE-2026-111874 | OP OpenCATS Opencats | 3.7 | Oct 18 | OpenCATS Career Portal CareersUI.php processLogin excessive authentication |
| CVE-2026-111934 | CO coder coder | 3.7 | Oct 17 | Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header |
| CVE-2026-111933 | CO coder coder | 3.7 | Oct 17 | Coder before 2.34.2 User Enumeration via Login Placeholder Hash |
| CVE-2026-111932 | CO coder coder | 3.4 | Oct 17 | Coder before 2.34.2 Stored HTML Injection via Appearance Settings |
| CVE-2026-111926 | CO coder coder | 3.3 | Oct 17 | Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest |
| CVE-2026-111888 | PH phpMyFAQ thorsten | 2.7 | Oct 17 | phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API |
| CVE-2026-92431 | PW Patreon WordPress | 3.7 | Oct 17 | Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration |
| CVE-2026-111602 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 3.7 | Oct 17 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter |
| CVE-2026-17591 | RH Red Hat Enterprise Linux 10 Red Hat | 3.6 | Oct 16 | Libarchive: libarchive: use-after-free via aliased mac metadata copy |
| CVE-2026-17068 | I i IBM | 3.3 | Oct 16 | IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System |
| CVE-2026-111714 | TA tarteaucitron.js AmauriC | 3.1 | Oct 16 | tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge |
| CVE-2026-111678 | AN antiword Adri van Os | 3.3 | Oct 16 | Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing |
| CVE-2026-111658 | SS SSCMS SiteServer | 3.8 | Oct 16 | SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API |
| CVE-2026-111655 | TH think-plugs-admin zoujingli | 3.8 | Oct 16 | ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit |
| CVE-2026-111648 | BU buildadmin build-admin | 2.7 | Oct 16 | BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter |
| CVE-2026-111624 | UM Umbraco-CMS umbraco | 3.7 | Oct 16 | Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs |