Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Low	2.1	CVE-2026-116101	A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 26 01:17 UTC
CVE-2026-116101A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 Executive summary A SQL injection flaw has been reported in the Online Cake Ordering System version 1.0 from itsourcecode. An attacker could potentially read, change, or disrupt the application's database, and the advisory describes the risk as serious. The advisory recommends using prepared statements, validating user input, limiting database account permissions, and running regular security audits; it does not state a vendor-issued fix. Technical summary The flaw is an SQL injection in the id parameter of /deletetransac.php, which the advisory says fails to sanitize or validate input before it is used in SQL queries. The proof of concept is a GET request with a crafted id value that uses GTID_SUBSET error-based injection against the host 154.219.114.125:9012. The advisory is inconsistent about preconditions: the root cause text says the attacker must log in with valid credentials, while the POC section says no authentication is required and exploitation does not require prior access. Affected version is listed as V1.0. A fixed version is not stated, no CVSS score is stated, and exploitation in the wild is not stated. The suggested repairs are prepared statements, input validation, minimal database permissions, and security audits; no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/RyanCarter9527/submit/issues/1 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-114384	A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 21 22:16 UTC
CVE-2026-114384A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0 From the advisory A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 21, 2026 22:16 UTC Read the advisory
	Low	2.1	CVE-2026-114381	A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 21 22:16 UTC
CVE-2026-114381A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0 From the advisory A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 21, 2026 22:16 UTC Read the advisory
	Low	2.1	CVE-2026-114380	A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 21 21:17 UTC
CVE-2026-114380A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 From the advisory A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argument prcd results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 21, 2026 21:17 UTC Read the advisory
	Low	2.1	CVE-2026-114378	A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 21 21:17 UTC
CVE-2026-114378A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0 From the advisory A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 21, 2026 21:17 UTC Read the advisory
	Low	2.1	CVE-2026-113741	A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 21 01:17 UTC
CVE-2026-113741A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0 From the advisory A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-113740	A flaw has been found in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 21 01:17 UTC
CVE-2026-113740A flaw has been found in itsourcecode Online Cake Ordering System 1.0 From the advisory A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-112087	A weakness has been identified in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 19 07:16 UTC
CVE-2026-112087A weakness has been identified in itsourcecode Online Cake Ordering System 1.0 From the advisory A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confirm.php. This manipulation of the argument cancel causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 19, 2026 07:16 UTC Read the advisory
	Low	2.1	CVE-2026-108959	A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 13 03:16 UTC
CVE-2026-108959A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0 From the advisory A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 13, 2026 03:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects