Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 419new in the last 7 days
- 8added as actively exploited
- 37critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-62277 | Medium CVSS 6.5 |
- Applications & supply chain |
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8,… | 30 Oct 2026 |
| CVE-2026-55614 | Medium CVSS 6.9 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases… | 30 Oct 2026 |
| CVE-2026-55613 | Medium CVSS 6.9 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize… | 30 Oct 2026 |
| CVE-2026-55612 | Low CVSS 3.7 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an… | 30 Oct 2026 |
| CVE-2026-55147 | Medium CVSS 6.3 |
- Applications & supply chain |
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and… | 30 Oct 2026 |
| CVE-2026-55146 | Medium CVSS 4.3 |
- Applications & supply chain |
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and… | 30 Oct 2026 |
| CVE-2026-16760 | High CVSS 8.8 |
- Applications & supply chain |
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the… | 30 Oct 2026 |
| CVE-2026-118938 | High CVSS 8.8 |
- Operating systems & software |
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example… | 30 Oct 2026 |
| CVE-2026-111578 | High CVSS 7.5 |
- Applications & supply chain |
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape… | 30 Oct 2026 |
| CVE-2026-62991 | Medium CVSS 6.5 |
- Applications & supply chain |
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route… | 30 Oct 2026 |
| CVE-2026-62990 | High CVSS 8.7 |
- Applications & supply chain |
Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases… | 30 Oct 2026 |
| CVE-2026-62989 | High CVSS 8.1 |
- Applications & supply chain |
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in… | 30 Oct 2026 |
| CVE-2026-62979 | High CVSS 8.4 |
- Cloud & SaaS |
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0,… | 30 Oct 2026 |
| CVE-2026-62968 | High CVSS 8.7 |
- Operating systems & software |
Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled… | 30 Oct 2026 |
| CVE-2026-62967 | High CVSS 8.1 |
- Applications & supply chain |
ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support. Prior to 0.8.0, any… | 30 Oct 2026 |
| CVE-2026-62966 | High CVSS 7.5 |
- Applications & supply chain |
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to… | 30 Oct 2026 |
| CVE-2026-62965 | High CVSS 7.0 |
- Applications & supply chain |
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in… | 30 Oct 2026 |
| CVE-2026-62958 | High CVSS 7.9 |
- Operating systems & software |
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the… | 30 Oct 2026 |
| CVE-2026-62864 | High CVSS 7.5 |
- Applications & supply chain |
Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5,… | 30 Oct 2026 |
| CVE-2026-62863 | Critical CVSS 9.6 |
- Applications & supply chain |
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`,… | 30 Oct 2026 |
| CVE-2026-62860 | Medium CVSS 5.3 |
- Identity & access |
Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login`… | 30 Oct 2026 |
| CVE-2026-62853 | Critical CVSS 9.9 |
- OT, ICS & IoT |
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts… | 30 Oct 2026 |
| CVE-2026-62849 | Critical CVSS 9.1 |
- OT, ICS & IoT |
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the… | 30 Oct 2026 |
| CVE-2026-62848 | High CVSS 7.3 |
- Applications & supply chain |
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18,… | 30 Oct 2026 |
| CVE-2026-62847 | High CVSS 8.2 |
- Applications & supply chain |
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. Prior to 2025.1.18, 2026.0.25 and… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.