Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 330new in the last 7 days
- 8added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-101326 | Medium CVSS 5.4 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-100155 | Medium CVSS 6.5 |
- Applications & supply chain |
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for… | 31 Oct 2026 |
| CVE-2026-77152 | Medium CVSS 5.3 |
- Operating systems & software |
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field… | 31 Oct 2026 |
| CVE-2026-63410 | Medium CVSS 5.9 |
- Operating systems & software |
secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time… | 30 Oct 2026 |
| CVE-2026-63402 | Medium CVSS 5.9 |
- Operating systems & software |
i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js`… | 30 Oct 2026 |
| CVE-2026-63401 | Medium CVSS 5.3 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and… | 30 Oct 2026 |
| CVE-2026-63399 | Medium CVSS 6.9 |
- Applications & supply chain |
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg`… | 30 Oct 2026 |
| CVE-2026-61725 | Medium CVSS 6.1 |
- Operating systems & software |
sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z… | 30 Oct 2026 |
| CVE-2026-63121 | Medium CVSS 6.3 |
- Cloud & SaaS |
Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For… | 30 Oct 2026 |
| CVE-2026-63115 | Medium CVSS 5.3 |
- Operating systems & software |
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo`… | 30 Oct 2026 |
| CVE-2026-62347 | Medium CVSS 5.9 |
- Operating systems & software |
Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call… | 30 Oct 2026 |
| CVE-2026-62277 | Medium CVSS 6.5 |
- Applications & supply chain |
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8,… | 30 Oct 2026 |
| CVE-2026-55614 | Medium CVSS 6.9 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases… | 30 Oct 2026 |
| CVE-2026-55613 | Medium CVSS 6.9 |
- Operating systems & software |
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize… | 30 Oct 2026 |
| CVE-2026-55147 | Medium CVSS 6.3 |
- Applications & supply chain |
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and… | 30 Oct 2026 |
| CVE-2026-55146 | Medium CVSS 4.3 |
- Applications & supply chain |
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and… | 30 Oct 2026 |
| CVE-2026-62991 | Medium CVSS 6.5 |
- Applications & supply chain |
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route… | 30 Oct 2026 |
| CVE-2026-62860 | Medium CVSS 5.3 |
- Identity & access |
Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login`… | 30 Oct 2026 |
| CVE-2026-62300 | Medium CVSS 6.5 |
- Hardware & firmware |
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. In daemon deployments… | 30 Oct 2026 |
| CVE-2026-62254 | Medium CVSS 5.5 |
- Applications & supply chain |
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger… | 30 Oct 2026 |
| CVE-2026-62250 | Medium CVSS 5.5 |
- Hardware & firmware |
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make… | 30 Oct 2026 |
| CVE-2026-59993 | Medium CVSS 6.5 |
- Applications & supply chain |
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In… | 30 Oct 2026 |
| CVE-2026-119343 | Medium CVSS 6.8 |
- Cloud & SaaS |
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0,… | 30 Oct 2026 |
| CVE-2026-119342 | Medium CVSS 5.3 |
- Applications & supply chain |
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until… | 30 Oct 2026 |
| CVE-2026-119340 | Medium CVSS 5.5 |
- Applications & supply chain |
Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h… | 30 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.