CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 10:12 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116827 New | YE yeswiki YesWiki | 6.8 | Oct 26 | YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import |
| CVE-2026-116826 New | YE yeswiki YesWiki | 6.8 | Oct 26 | YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile |
| CVE-2026-116825 New | YE yeswiki YesWiki | 6.5 | Oct 26 | YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox |
| CVE-2026-116824 New | YE yeswiki YesWiki | 6.1 | Oct 26 | YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler |
| CVE-2026-116823 New | YE yeswiki YesWiki | 6.1 | Oct 26 | YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback |
| CVE-2026-116822 New | YE yeswiki YesWiki | 5.3 | Oct 26 | YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter |
| CVE-2026-116821 New | YE yeswiki YesWiki | 6.5 | Oct 26 | YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames |
| CVE-2026-116820 New | YE yeswiki YesWiki | 5.3 | Oct 26 | YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter |
| CVE-2026-116817 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board |
| CVE-2026-116815 New | OP openpanel Openpanel-dev | 4.3 | Oct 26 | OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts |
| CVE-2026-116814 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs |
| CVE-2026-116813 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts |
| CVE-2026-116812 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter |
| CVE-2026-116810 New | OP openpanel Openpanel-dev | 5.3 | Oct 26 | OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences |
| CVE-2026-116809 New | OP openpanel Openpanel-dev | 5.3 | Oct 26 | OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure |
| CVE-2026-116807 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query |
| CVE-2026-116806 New | OP openpanel Openpanel-dev | 5.4 | Oct 26 | OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation |
| CVE-2026-116805 New | OP openpanel Openpanel-dev | 4.3 | Oct 26 | OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list |
| CVE-2026-116804 New | DO DOMPurify cure53 | 6.1 | Oct 26 | DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content |
| CVE-2026-116803 New | DO DOMPurify cure53 | 6.1 | Oct 26 | DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees |
| CVE-2026-116802 New | DO DOMPurify cure53 | 6.1 | Oct 26 | DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode |
| CVE-2026-116801 New | PA parse-server parse-community | 4.3 | Oct 26 | Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query |
| CVE-2026-116800 New | AV AVideo WWBN | 6.2 | Oct 26 | WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header |
| CVE-2026-116602 New | OF Online Food Ordering System SourceCodester | 6.5 | Oct 26 | SourceCodester Online Food Ordering System delete.php unlink path traversal |
| CVE-2026-2270 New | KU Kubernetes Kubernetes | 5.9 | Oct 26 | StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation |
| CVE-2026-76654 New | KU Kubernetes Kubernetes | 5.8 | Oct 26 | Subpath symlinking on Windows nodes permits NTLM coercion |
| CVE-2026-116515 New | OB Online Book Store itsourcecode | 6.3 | Oct 26 | itsourcecode Online Book Store book.php sql injection |
| CVE-2026-116746 New | QL qloapps qloapps | 5.3 | Oct 26 | QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview |
| CVE-2026-116745 New | QL qloapps qloapps | 6.5 | Oct 26 | QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation |
| CVE-2026-116744 New | ND nDPI ntop | 5.3 | Oct 26 | ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector |
| CVE-2026-116743 New | LI libmsiecf libyal | 5.5 | Oct 26 | libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data |
| CVE-2026-116742 New | HT htslib samtools | 4.4 | Oct 26 | HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count |
| CVE-2026-116741 New | SP speex xiph | 6.5 | Oct 26 | Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes |
| CVE-2026-116740 New | LI libcss netsurf-browser | 6.5 | Oct 26 | libcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser |
| CVE-2026-116739 New | VM vmime kisli | 4.3 | Oct 26 | VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder |
| CVE-2026-116737 New | LI libphdi libyal | 6.1 | Oct 26 | libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path |
| CVE-2026-116736 New | LI libpff libyal | 6.1 | Oct 26 | libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array |
| CVE-2026-116735 New | LI libpff libyal | 6.1 | Oct 26 | libpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries |
| CVE-2026-116732 New | LI libdwarf davea42 | 4.4 | Oct 26 | libdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table |
| CVE-2026-116731 New | FU furnace tildearrow | 6.1 | Oct 26 | Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import |
| CVE-2026-116730 New | FU furnace tildearrow | 5.5 | Oct 26 | Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import |
| CVE-2026-116728 New | LI libfvde libyal | 5.5 | Oct 26 | libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x0024 |
| CVE-2026-116725 New | GB gbsplay mmitch | 5.5 | Oct 26 | gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index |
| CVE-2026-116590 New | SN snappy-java xerial | 5.9 | Oct 26 | snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite |
| CVE-2026-116514 New | AR Airline Reservation System itsourcecode | 4.3 | Oct 26 | itsourcecode Airline Reservation System book_flight.php cross site scripting |
| CVE-2026-116507 New | A9 A950RG TOTOLINK | 5.3 | Oct 26 | TOTOLINK A950RG global.so getLanguageCfg information disclosure |
| CVE-2026-116586 New | GO go-jose go-jose | 6.9 | Oct 26 | Go JOSE: Panics in JSON parsing |
| CVE-2026-116585 New | GO go-jose go-jose | 6.9 | Oct 26 | Go JOSE: Panic during CBC-HMAC processing |
| CVE-2026-116583 New | SE seroval lxsmnsyc | 5.3 | Oct 26 | Seroval: Code injection through a typed array's own constructor property |
| CVE-2026-116582 New | SE seroval lxsmnsyc | 4.7 | Oct 26 | Seroval: Script injection through RegExp sources in serialized output |