CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 12:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116579 New | AU autobahn-python crossbario | 5.9 | Oct 26 | Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) |
| CVE-2026-116577 New | TO tornado tornadoweb | 5.3 | Oct 26 | Tornado: Quadratic CPU usage when parsing HTTP headers with line folding |
| CVE-2026-116502 New | EX ExLlamaV2 turboderp-org | 4.4 | Oct 26 | turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write |
| CVE-2026-116575 New | ME mem0 mem0ai | 6.3 | Oct 26 | Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) |
| CVE-2026-70382 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 4.1 | Oct 26 | Stored Cross-Site Scripting in Web Interface |
| CVE-2026-65630 New | JO jose potatosalad | 5.9 | Oct 26 | Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose |
| CVE-2026-65632 New | JO jose potatosalad | 5.1 | Oct 26 | ECDSA signature length is not validated in jose, allowing signature malleability |
| CVE-2026-65631 New | JO jose potatosalad | 6.9 | Oct 26 | erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service |
| CVE-2026-65628 New | JO jose potatosalad | 5.9 | Oct 26 | Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types |
| CVE-2026-65627 New | JO jose potatosalad | 6.9 | Oct 26 | Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 |
| CVE-2026-57184 New | AS asterisk asterisk | 6.3 | Oct 26 | Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon) |
| CVE-2026-65626 New | JO jose potatosalad | 5.9 | Oct 26 | Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose |
| CVE-2026-65625 New | JO jose potatosalad | 5.9 | Oct 26 | Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose |
| CVE-2026-70381 New | CP Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 5.3 | Oct 26 | Unauthorized Access to Internal Web Resources |
| CVE-2026-57193 New | AS asterisk asterisk | 6.9 | Oct 26 | Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure) |
| CVE-2026-70380 New | CP Cynap Pro, Cynap Core Pro, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro WolfVision | 5.3 | Oct 26 | Resource Exhaustion in MICE Service |
| CVE-2026-116479 New | A2 a2a-java a2aproject | 4.3 | Oct 26 | a2aproject a2a-java JSON-RPC Error getMessage information exposure |
| CVE-2026-115927 New | TO tornado tornadoweb | 5.3 | Oct 26 | Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks |
| CVE-2026-116478 New | A2 a2a-go a2aproject | 5.3 | Oct 26 | a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure |
| CVE-2026-116477 New | A2 a2a-dotnet a2aproject | 4.3 | Oct 26 | a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure |
| CVE-2026-116476 New | A2 a2a-dotnet a2aproject | 5.4 | Oct 26 | a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition |
| CVE-2026-116631 New | Product not mapped yet | 5.4 | Oct 26 | External protocol handler (tel:) address bar spoof |
| CVE-2026-116632 New | Product not mapped yet | 5.4 | Oct 26 | Facetime protocol handler enabled spoofing |
| CVE-2026-116471 New | DE Decoy BKWLD | 4.3 | Oct 26 | BKWLD Decoy Authorization Policy Policy.php privileges management |
| CVE-2026-116467 New | LL llama.cpp ggml-org | 5.3 | Oct 26 | ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion |
| CVE-2026-115804 New | CO Consul HashiCorp | 6.4 | Oct 26 | Consul vulnerable to an authorization bypass in health check registration |
| CVE-2026-116634 New | OM OmniRoute cheaper-inference | 5.9 | Oct 26 | OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens |
| CVE-2026-50096 New | AS ArcGIS Server Esri | 6.1 | Oct 26 | BUG-000187164 - ArcGIS Server has a security vulnerability. |
| CVE-2026-50095 New | AS ArcGIS Server Esri | 6.1 | Oct 26 | BUG-000187165 - ArcGIS Server has a security vulnerability. |
| CVE-2026-33522 New | AS ArcGIS Server Esri | 5.3 | Oct 26 | BUG-000182936 - ArcGIS Server has a security vulnerability. |
| CVE-2026-33520 New | AS ArcGIS Server Esri | 6.1 | Oct 26 | BUG-000185167 - ArcGIS Server has a security vulnerability. |
| CVE-2026-116463 New | IV Image Viewer FastStone | 6.3 | Oct 26 | FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds |
| CVE-2026-115923 New | BA backstage backstage | 6.5 | Oct 26 | Backstage catalog rules can be bypassed for URL locations using encoded path segments |
| CVE-2026-70379 New | CP Cynap Pro, Cynap Core Pro WolfVision | 6.5 | Oct 26 | Unauthorized Access to vSolution Matrix RTSP |
| CVE-2026-116461 New | RP Restro POS Omega Solution | 4.3 | Oct 26 | Omega Solution Restro POS sale-invoice logic error |
| CVE-2026-115922 New | ON onnx onnx | 6.2 | Oct 26 | ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs |
| CVE-2026-116408 New | GP Gallery PhotoBlocks WP Chill | 6.5 | Oct 26 | WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115921 New | ON onnx onnx | 6.2 | Oct 26 | ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute |
| CVE-2026-112839 New | CC Customer Coupons for WooCommerce VillaTheme | 4.3 | Oct 26 | WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability |
| CVE-2026-115966 New | TT Typing Text – Give your texts many typing effects bPlugins | 6.5 | Oct 26 | WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-116400 New | BB Button Block bPlugins | 6.5 | Oct 26 | WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-116398 New | CS Content Slider Block bPlugins | 6.5 | Oct 26 | WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-115920 New | ON onnx onnx | 6.2 | Oct 26 | ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank |
| CVE-2026-115919 New | ON onnx onnx | 6.2 | Oct 26 | ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) |
| CVE-2026-115918 New | VL vllm vllm-project | 6.5 | Oct 26 | vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs |
| CVE-2026-115917 New | VL vllm vllm-project | 4.7 | Oct 26 | vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server |
| CVE-2026-81509 New | NF nforwardauth nosduco | 6.1 | Oct 26 | nforwardauth: Unvalidated r parameter allows post-authentication open redirect |
| CVE-2026-115916 New | VL vllm vllm-project | 6.5 | Oct 26 | vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) |
| CVE-2026-115914 New | VL vllm vllm-project | 6.5 | Oct 26 | vLLM DeepSeek-OCR image processing vulnerable to denial of service |
| CVE-2026-72757 New | RO Routinator NLnet Labs | 5.3 | Oct 26 | Routinator HTTP server becomes unavailable with many unclosed connections |