CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 15:29 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113189 | CH Chrome Google | 9.6 | Oct 20 | Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-113014 | CH Chrome Google | 9.6 | Oct 20 | Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… |
| CVE-2026-113283 | CH Chrome Google | 9.6 | Oct 20 | Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox… |
| CVE-2026-113078 | CH Chrome Google | 9.6 | Oct 20 | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted… |
| CVE-2026-113211 | CH Chrome Google | 9.6 | Oct 20 | Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… |
| CVE-2026-113263 | CH Chrome Google | 9.6 | Oct 20 | Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… |
| CVE-2026-113336 | CH Chrome Google | 9.6 | Oct 20 | Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… |
| CVE-2026-113222 | CH Chrome Google | 9.6 | Oct 20 | Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-113020 | CH Chrome Google | 9.6 | Oct 20 | Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML… |
| CVE-2026-113252 | CH Chrome Google | 9.6 | Oct 20 | Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
| CVE-2026-113072 | CH Chrome Google | 9.6 | Oct 20 | Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page |
| CVE-2026-112712 | FA @fastify/middie @fastify/middie | 9.1 | Oct 20 | @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch |
| CVE-2026-35499 | TO Totolink totolink | 9.1 | Oct 20 | An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
| CVE-2026-40627 | TO Totolink totolink | 9.1 | Oct 20 | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
| CVE-2026-28763 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-41223 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-33568 | TO Totolink totolink | 9.1 | Oct 20 | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-41222 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-40615 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-42020 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
| CVE-2026-42019 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 |
| CVE-2026-42024 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R… |
| CVE-2026-42023 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R… |
| CVE-2026-42022 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R… |
| CVE-2026-42021 | TO Totolink totolink | 9.1 | Oct 20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R… |
| CVE-2026-42026 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):… |
| CVE-2026-42025 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s):… |
| CVE-2026-9660 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9659 | TO Totolink totolink | 9.1 | Oct 20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9814 | TO Totolink totolink | 9.1 | Oct 20 | An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9817 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9827 | TO Totolink totolink | 9.1 | Oct 20 | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-9869 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10131 | TO Totolink totolink | 9.1 | Oct 20 | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10132 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10133 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10135 | TO Totolink totolink | 9.1 | Oct 20 | A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10136 | TO Totolink totolink | 9.1 | Oct 20 | A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10137 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10138 | TO Totolink totolink | 9.1 | Oct 20 | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10139 | TO Totolink totolink | 9.1 | Oct 20 | A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-10141 | TO Totolink totolink | 9.1 | Oct 20 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) |
| CVE-2026-92388 | CU curl curl | 9.1 | Oct 20 | FTP wildcard write callback mixup |
| CVE-2026-87866 | CU curl curl | 9.1 | Oct 20 | wolfSSL public-key pinning bypass |
| CVE-2026-87861 | CU curl curl | 9.1 | Oct 20 | cross-origin reuse of a Negotiate connection |
| CVE-2026-86414 | CU curl curl | 9.1 | Oct 20 | leaking host credentials to HTTP proxy |
| CVE-2026-86413 | CU curl curl | 9.1 | Oct 20 | Negotiate credentials sent to redirected origin |
| CVE-2026-112380 | KC Kiro Crew Amazon | 9.9 | Oct 20 | Missing authorization in the WhatsApp channel in Kiro Crew |
| CVE-2026-86411 | CU curl curl | 9.1 | Oct 20 | FTP connection reuse inherits client-certificate |
| CVE-2026-113867 | Product not mapped yet | 9.1 | Oct 20 | Stanza injection in XMPP chat |