CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 14:33 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-98945 New | LI Linux Linux | 7.8 | Oct 23 | HID: steam: Rearrange teardown sequence |
| CVE-2026-98944 New | LI Linux Linux | 7.8 | Oct 23 | HID: steam: Refactor registration |
| CVE-2026-63120 New | PG pghoard Aiven-Open | 8.4 | Oct 23 | PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write |
| CVE-2026-98941 New | LI Linux Linux | 7.0 | Oct 23 | ext4: don't enable large folios on encrypted inodes |
| CVE-2026-98932 New | LI Linux Linux | 7.4 | Oct 23 | EDAC/altera: Fix use-after-free in error paths |
| CVE-2026-57117 New | PR PraisonAI MervinPraison | 8.8 | Oct 23 | PraisonAI: Compute-bridged file tools allow shell command injection |
| CVE-2026-57146 New | PR PraisonAI MervinPraison | 7.5 | Oct 23 | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default |
| CVE-2026-57144 New | PR PraisonAI MervinPraison | 8.8 | Oct 23 | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable |
| CVE-2026-57142 New | PR PraisonAI MervinPraison | 7.8 | Oct 23 | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml |
| CVE-2026-57121 New | PR PraisonAI MervinPraison | 8.1 | Oct 23 | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API |
| CVE-2026-98927 New | LI Linux Linux | 7.0 | Oct 23 | KVM: arm64: nv: Fix life cycle of the nested_mmus array |
| CVE-2026-57114 New | PR PraisonAI MervinPraison | 7.2 | Oct 23 | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding |
| CVE-2026-57113 New | PR PraisonAI MervinPraison | 8.1 | Oct 23 | PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion |
| CVE-2026-56840 New | PR PraisonAI MervinPraison | 8.8 | Oct 23 | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools |
| CVE-2026-56838 New | PR PraisonAI MervinPraison | 7.8 | Oct 23 | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement |
| CVE-2026-56837 New | PR PraisonAI MervinPraison | 8.6 | Oct 23 | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing |
| CVE-2026-56836 New | PR PraisonAI MervinPraison | 8.2 | Oct 23 | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard |
| CVE-2026-56835 New | PR PraisonAI MervinPraison | 8.3 | Oct 23 | PraisonAI Slack app_mention bypasses configured user/channel authorization |
| CVE-2026-56834 New | PR PraisonAI MervinPraison | 7.5 | Oct 23 | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage |
| CVE-2026-56833 New | PR PraisonAI MervinPraison | 7.5 | Oct 23 | PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal |
| CVE-2026-56832 New | PR PraisonAI MervinPraison | 8.8 | Oct 23 | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals |
| CVE-2026-98911 New | LI Linux Linux | 7.5 | Oct 23 | dpaa2-switch: fix the error path in dpaa2_switch_rx() |
| CVE-2026-98899 New | LI Linux Linux | 7.8 | Oct 23 | netfilter: ipset: mark the rcu locked areas properly |
| CVE-2026-112904 New | VV Vvveb givanz | 8.7 | Oct 23 | Vvveb: Path Traversal in nextRestore() and nextBackup() |
| CVE-2026-98895 New | LI Linux Linux | 7.0 | Oct 23 | net/mlx5: HWS, Handle destroying table that has a miss table |
| CVE-2026-98889 New | LI Linux Linux | 7.8 | Oct 23 | wifi: iwlwifi: mvm: fix sched scan IE sizing |
| CVE-2026-98870 New | LI Linux Linux | 8.8 | Oct 23 | ksmbd: remove stale channels from all sessions on teardown |
| CVE-2026-115727 New | AG AgenticSeek Fosowl | 8.1 | Oct 23 | AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server |
| CVE-2026-115726 New | AI aider Aider-AI | 7.8 | Oct 23 | Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings |
| CVE-2026-115723 New | SN snap7 davenardella | 7.4 | Oct 23 | Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion |
| CVE-2026-16762 New | QT qt qt | 8.7 | Oct 23 | Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt |
| CVE-2026-89320 New | EK Eclipse KeyPont - GOSE Eclipse Foundation | 8.8 | Oct 23 | HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity |
| CVE-2026-25716 New | BL BlueSpice Hallo Welt! GmbH | 7.1 | Oct 23 | BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users |
| CVE-2025-30052 New | CC CGM CLININET CGM | 8.8 | Oct 23 | Authentication Bypass via IP Spoofing in CGM CLININET rsyncd |
| CVE-2025-30049 New | CC CGM CLININET CGM | 8.2 | Oct 23 | Use of Unsalted MD5 Password Hashes in CGM CLININET |
| CVE-2025-30045 New | CC CGM CLININET CGM | 8.6 | Oct 23 | Code Injection in CGM CLININET |
| CVE-2025-30043 New | CC CGM CLININET CGM | 7.1 | Oct 23 | Missing Authentication in CGM CLININET |
| CVE-2026-112835 New | VI VikRentCar e4jvikwp | 7.1 | Oct 23 | WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-112837 New | GA GamiPress Ruben Garcia | 8.5 | Oct 23 | WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability |
| CVE-2026-112359 New | WP WPMobile.App Amauri.IO | 7.5 | Oct 23 | WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability |
| CVE-2026-112838 New | VI VikRentCar e4jvikwp | 7.1 | Oct 23 | WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-75775 New | RO Router ASUS | 7.7 | Oct 23 | Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted… |
| CVE-2026-93489 New | RO Router ASUS | 8.7 | Oct 23 | Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform… |
| CVE-2026-75779 New | RO Router ASUS | 8.6 | Oct 23 | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick… |
| CVE-2026-94268 New | AC Advanced Custom Fields: Extended | 8.1 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action |
| CVE-2026-94262 New | AC Advanced Custom Fields: Extended | 8.1 | Oct 23 | Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action |
| CVE-2026-113500 New | LC LiteSpeed Cache | 7.5 | Oct 23 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization |
| CVE-2026-113499 New | LC LiteSpeed Cache | 7.5 | Oct 23 | LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting |
| CVE-2026-111982 New | UP User Profile Builder | 7.2 | Oct 23 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change |
| CVE-2026-109936 New | OB Otter Blocks | 7.5 | Oct 23 | Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter |