CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 10:04 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-57146 New | PR PraisonAI MervinPraison | 7.5 | Oct 23 | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default |
| CVE-2026-57144 New | PR PraisonAI MervinPraison | 8.8 | Oct 23 | PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable |
| CVE-2026-57142 New | PR PraisonAI MervinPraison | 7.8 | Oct 23 | PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml |
| CVE-2026-57121 New | PR PraisonAI MervinPraison | 8.1 | Oct 23 | PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API |
| CVE-2026-98927 New | LI Linux Linux | 7.0 | Oct 23 | KVM: arm64: nv: Fix life cycle of the nested_mmus array |
| CVE-2026-57114 New | PR PraisonAI MervinPraison | 7.2 | Oct 23 | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding |
| CVE-2026-57113 New | PR PraisonAI MervinPraison | 8.1 | Oct 23 | PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion |
| CVE-2026-56840 New | PR PraisonAI MervinPraison | 8.8 | Oct 23 | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools |
| CVE-2026-56838 New | PR PraisonAI MervinPraison | 7.8 | Oct 23 | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement |
| CVE-2026-56837 New | PR PraisonAI MervinPraison | 8.6 | Oct 23 | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing |
| CVE-2026-56836 New | PR PraisonAI MervinPraison | 8.2 | Oct 23 | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard |
| CVE-2026-56835 New | PR PraisonAI MervinPraison | 8.3 | Oct 23 | PraisonAI Slack app_mention bypasses configured user/channel authorization |
| CVE-2026-56834 New | PR PraisonAI MervinPraison | 7.5 | Oct 23 | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage |
| CVE-2026-56833 New | PR PraisonAI MervinPraison | 7.5 | Oct 23 | PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal |
| CVE-2026-56832 New | PR PraisonAI MervinPraison | 8.8 | Oct 23 | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals |
| CVE-2026-98911 New | LI Linux Linux | 7.5 | Oct 23 | dpaa2-switch: fix the error path in dpaa2_switch_rx() |
| CVE-2026-98899 New | LI Linux Linux | 7.8 | Oct 23 | netfilter: ipset: mark the rcu locked areas properly |
| CVE-2026-112904 New | VV Vvveb givanz | 8.7 | Oct 23 | Vvveb: Path Traversal in nextRestore() and nextBackup() |
| CVE-2026-98895 New | LI Linux Linux | 7.0 | Oct 23 | net/mlx5: HWS, Handle destroying table that has a miss table |
| CVE-2026-98889 New | LI Linux Linux | 7.8 | Oct 23 | wifi: iwlwifi: mvm: fix sched scan IE sizing |
| CVE-2026-98870 New | LI Linux Linux | 8.8 | Oct 23 | ksmbd: remove stale channels from all sessions on teardown |
| CVE-2026-115727 New | AG AgenticSeek Fosowl | 8.1 | Oct 23 | AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server |
| CVE-2026-115726 New | AI aider Aider-AI | 7.8 | Oct 23 | Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings |
| CVE-2026-115723 New | SN snap7 davenardella | 7.4 | Oct 23 | Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion |