Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 08:05 UTC

Critical in the last 24 hours

1601 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

181-70% vs 7-day avg of 598

2 critical, 65 high, 73 medium, 31 low

Expand	Severity	Score	Advisory	Title	Source	Flags	Published
	Low	2.1	CVE-2026-116224	A vulnerability has been found in fr0tt benotes up to 2.8.1 laravel, fr0ttLaravel, fr0tt benotes	NVD		Oct 26 07:17 UTC
CVE-2026-116224A vulnerability has been found in fr0tt benotes up to 2.8.1 Executive summary A server-side request forgery flaw has been reported in fr0tt benotes version 2.8.1 and earlier. Any logged-in user can make the server fetch internal addresses and read parts of the responses, which may expose internal content. The advisory gives a CVSS 3.1 base score of 4.3 (Medium) and does not state a vendor-issued fix or recommendation beyond the remediation steps the researcher proposes. Technical summary The flaw is CWE-918 server-side request forgery in the GET /api/meta endpoint, which requires an authenticated account; the advisory states accounts are created by an admin and there is no public self-registration. The URL is validated only with Laravel's url rule, which accepts any scheme, and is then fetched with curl_exec with CURLOPT_FOLLOWLOCATION enabled and no private-address or redirect checks. The advisory shows loopback fetches, redirect following, and file:// URLs reaching libcurl, with partial title and description read-back in JSON. Affected version is stated as 2.8.1 (master branch, commit cb803b32340eb7720131a9d0b93261d01800c896), and the phrase 'up to 2.8.1' appears in the advisory. No fixed version, vendor patch, or exploitation in the wild is stated. Proposed remediation is a http/https allow-list, IP range blocking with IP pinning, redirect re-validation or disabling follow-redirects, and the same policy for the Chrome crawler. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/qianqiusujiu/58f979be4c…bd1cf2864d85e79603d8 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects laravel fr0tt Laravel fr0tt benotes NIST National Vulnerability DatabasePublished Oct 26, 2026 07:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Search syntax

Welcome to CVEsee.org

What is CVEsee.org?

Disclaimer

You are leaving CVEsee.org

Install CVEsee