CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 18:21 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-15466 New | GD Graphics DDK Imagination Technologies | – | Oct 30 | GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM() |
| CVE-2026-91920 New | RH Red Hat build of Apache Camel for Spring Boot 4 Red Hat | 6.5 | Oct 30 | Undertow: undertow: chunkreader message length permits chunk-size overflow |
| CVE-2026-112605 New | XC Xcode Apple | – | Oct 30 | This issue was addressed with improved handling of symlinks |
| CVE-2026-112602 New | XC Xcode Apple | – | Oct 30 | An authorization issue was addressed with improved state management |
| CVE-2026-110133 New | RH Red Hat Enterprise Linux 10 Red Hat | 5.8 | Oct 30 | Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback |
| CVE-2026-118959 New | RH Red Hat Build of Keycloak Red Hat | 5.4 | Oct 30 | Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter |
| CVE-2026-118947 New | RH Red Hat Build of Keycloak Red Hat | 4.3 | Oct 30 | Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor |
| CVE-2026-119272 New | CH Chrome Google | 4.3 | Oct 30 | Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page |
| CVE-2026-119271 New | CH Chrome Google | 8.8 | Oct 30 | Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-119270 New | CH Chrome Google | 8.8 | Oct 30 | Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted… |
| CVE-2026-119269 New | CH Chrome Google | 8.8 | Oct 30 | Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-119268 New | CH Chrome Google | 8.8 | Oct 30 | Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-119267 New | CH Chrome Google | 8.8 | Oct 30 | Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-119266 New | CH Chrome Google | 8.8 | Oct 30 | Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-119265 New | CH Chrome Google | 8.8 | Oct 30 | Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-119264 New | CH Chrome Google | 8.8 | Oct 30 | Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-119263 New | CH Chrome Google | 9.6 | Oct 30 | Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-119262 New | CH Chrome Google | 8.8 | Oct 30 | Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-119261 New | CH Chrome Google | 9.6 | Oct 30 | Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… |
| CVE-2026-119260 New | CH Chrome Google | 8.8 | Oct 30 | Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-76031 New | CH Chrome Google | 8.8 | Oct 30 | Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-76030 New | CH Chrome Google | 8.8 | Oct 30 | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-76029 New | CH Chrome Google | 8.8 | Oct 30 | Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-76028 New | CH Chrome Google | 8.8 | Oct 30 | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-76027 New | CH Chrome Google | 4.3 | Oct 30 | Memory corruption in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to read memory via a crafted HTML page |
| CVE-2026-76026 New | CH Chrome Google | 8.8 | Oct 30 | Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-76025 New | CH Chrome Google | 8.8 | Oct 30 | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page |
| CVE-2026-76024 New | CH Chrome Google | 6.5 | Oct 30 | Memory corruption in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page |
| CVE-2026-117346 New | Product not mapped yet | – | Oct 30 | Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit |
| CVE-2026-117184 New | Product not mapped yet | – | Oct 30 | An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the GraphQL endpoint |
| CVE-2026-117183 New | Product not mapped yet | – | Oct 30 | A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on… |
| CVE-2026-117182 New | Product not mapped yet | – | Oct 30 | An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via… |
| CVE-2025-49602 New | Product not mapped yet | – | Oct 30 | An issue was discovered in Keyfactor EJBCA 9 |
| CVE-2026-117349 New | Product not mapped yet | – | Oct 30 | Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue |
| CVE-2026-117028 New | Product not mapped yet | – | Oct 30 | Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method |
| CVE-2026-117350 New | Product not mapped yet | – | Oct 30 | Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue |
| CVE-2026-92744 New | PM Privilege Manager Delinea | 8.7 | Oct 29 | Delinea Privilege Manager agent unauthenticated remote code execution vulnerability |
| CVE-2026-107238 New | MP Management Pack for Microsoft System Center Veeam | 8.7 | Oct 29 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft… |
| CVE-2026-107239 New | MP Management Pack for Microsoft System Center Veeam | 8.8 | Oct 29 | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for… |
| CVE-2023-22793 New | MP Management Pack for Microsoft System Center Veeam | 9.3 | Oct 29 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack… |
| CVE-2026-119286 New | GR graphql-core graphql-python | 7.5 | Oct 29 | GraphQL-core: Denial of service via memory leak in aborted validations |
| CVE-2026-115943 New | Product not mapped yet | – | Oct 29 | Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt |
| CVE-2026-119285 New | FI fiber gofiber | 5.9 | Oct 29 | Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads |
| CVE-2026-119284 New | JO joserfc authlib | 6.9 | Oct 29 | joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection |
| CVE-2026-61719 New | WE WeGIA LabRedesCefetRJ | 8.9 | Oct 29 | WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field |
| CVE-2026-61707 New | CO CoPilot socfortress | 9.0 | Oct 29 | SOCFortress CoPilot: Stored case-report template injection permits backend code execution |
| CVE-2026-61673 New | WE WeGIA LabRedesCefetRJ | 6.3 | Oct 29 | WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover |
| CVE-2026-61671 New | WE WeGIA LabRedesCefetRJ | 8.1 | Oct 29 | WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes |
| CVE-2026-61654 New | LI lightdash lightdash | 8.3 | Oct 29 | Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key |
| CVE-2026-61645 New | DO docat docat-org | 9.1 | Oct 29 | Docat has Arbitrary File Upload exists in Upload API |