Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	6.9	CVE-2026-115973	A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3 faveosuitefaveosuite faveo-helpdesk	NVD	Oct 24 19:17 UTC
CVE-2026-115973A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3 Executive summary A weakness in the password recovery feature of FaveoSuite Faveo Helpdesk version 2.0.3 has been disclosed. The advisory does not state how severe the issue is or what fix is available, and it notes that the vendor was contacted early about the disclosure. Technical summary The advisory describes a weak password recovery flaw in ForgotPasswordController::sendResetLinkEmail and PasswordController::reset in app/Http/Controllers/Auth/ForgotPasswordController.php in Faveo Helpdesk 2.0.3. The advisory says the attack may be initiated remotely. It does not state the vulnerability class in detail, any preconditions, a CVSS score, a fixed version, a workaround, or whether exploitation has been observed. It also gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects faveosuite faveosuite faveo-helpdesk NIST National Vulnerability DatabasePublished Oct 24, 2026 19:17 UTC Read the advisory
	Medium	6.9	CVE-2026-115972	A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 faveosuitefaveosuite faveo-helpdesk	NVD	Oct 24 18:16 UTC
CVE-2026-115972A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 Executive summary A flaw has been found in FaveoSuite Faveo Helpdesk versions up to 2.0.3. The advisory says it lets someone change the status of helpdesk items without the proper authorization checks, and it can be attacked remotely. The advisory does not state a severity score or a vendor fix. Technical summary The weakness is missing authorization (CWE-type access control flaw) in the UnAuthController functions changeStatus, close, open, and resolve in app/Http/Controllers/Client/helpdesk/UnAuthController.php. An attacker can manipulate the id and status arguments to change ticket state remotely. The advisory says the vendor was contacted early about the disclosure. Affected versions are stated as up to 2.0.3. A fixed version is not stated, no workaround is stated, no detection guidance is stated, and whether the flaw is exploited in the wild is not stated. No CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects faveosuite faveosuite faveo-helpdesk NIST National Vulnerability DatabasePublished Oct 24, 2026 18:16 UTC Read the advisory
	Medium	5.3	CVE-2026-111676	Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler faveosuitefaveosuite faveo-helpdesk	NVD	Oct 16 18:17 UTC
CVE-2026-111676Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler From the advisory Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects faveosuite faveosuite faveo-helpdesk NIST National Vulnerability DatabasePublished Oct 16, 2026 18:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee