CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 31, 00:17 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-101967 | JO Junos OS Evolved Juniper Networks | 8.8 | Oct 14 | Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used |
| CVE-2026-102068 | JO Junos OS Evolved Juniper Networks | 7.5 | Oct 14 | Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used |
| CVE-2026-101960 | JO Junos OS Evolved Juniper Networks | 6.5 | Oct 14 | Junos OS Evolved: QFX Series: A BGP peer causes an rpd crash when global load balancing is enabled |
| CVE-2026-101978 | JO Junos OS Evolved Juniper Networks | 8.8 | Oct 14 | Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used |
| CVE-2026-101985 | JO Junos OS Evolved Juniper Networks | 6.5 | Oct 14 | Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled |
| CVE-2026-101966 | JO Junos OS Evolved Juniper Networks | 8.2 | Oct 14 | Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service |
| CVE-2026-77564 | TA talos siderolabs | 3.3 | Oct 14 | Talos Linux: Support bundle does not redact registry credentials |
| CVE-2026-86565 | FD Fast Datapath for RHEL 10 Red Hat | 8.2 | Oct 14 | Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write |
| CVE-2026-86563 | FD Fast Datapath for RHEL 10 Red Hat | 7.8 | Oct 14 | Dpdk: dpdk: double offset bug in vhost log mapping calculation |
| CVE-2026-86562 | FD Fast Datapath for RHEL 10 Red Hat | 7.8 | Oct 14 | Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) |
| CVE-2026-76519 In wildKEV | CS Cisco Secure Email Cisco | 9.8 | Oct 14 | Cisco Secure Email Gateway Arbitrary File Write Vulnerability |
| CVE-2026-67418 | RA rabbitmq-server rabbitmq | 5.3 | Oct 14 | RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers |
| CVE-2026-67414 | RA rabbitmq-server rabbitmq | 6.0 | Oct 14 | RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation |
| CVE-2026-100169 | PR Prowler Prowler | 7.6 | Oct 14 | Account pre-hijacking in the Prowler API through email based social account linking without verification |
| CVE-2026-67416 | RA rabbitmq-server rabbitmq | 5.3 | Oct 14 | RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation |
| CVE-2026-102695 | OM omnifaces omnifaces | 8.2 | Oct 14 | OmniFaces: Forged combined-resource IDs and related output/push boundaries |
| CVE-2026-53615 | UT util-linux util-linux | 8.0 | Oct 14 | util-linux libblkid DOS extended-partition overflow produces invalid partition metadata |
| CVE-2026-86002 | DO dokku dokku | 9.0 | Oct 14 | Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS |
| CVE-2026-109438 | 3P 3proxy 3proxy | 5.3 | Oct 14 | 3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4 |
| CVE-2026-110736 | GE Godot Engine godotengine | 3.6 | Oct 14 | Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message) |
| CVE-2026-100404 | ZU zulip zulip | 6.5 | Oct 14 | Zulip: Guests can read new messages in non-subscribed public channels |
| CVE-2026-102893 | ZU zulip zulip | 9.1 | Oct 14 | Zulip: OpenID Connect authentication ignores the email_verified claim |
| CVE-2026-49206 | RA rapidcsv d99kris | 2.9 | Oct 14 | rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access |
| CVE-2026-62858 | YO YOURLS YOURLS | 5.3 | Oct 14 | YOURLS: Unauthenticated File Inclusion |
| CVE-2026-86561 | FD Fast Datapath for RHEL 10 Red Hat | 6.5 | Oct 14 | Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup |
| CVE-2026-93683 | FD Fast Datapath for RHEL 10 Red Hat | 6.4 | Oct 14 | Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou |
| CVE-2026-110735 | GE Godot Engine godotengine | 2.5 | Oct 14 | Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string) |
| CVE-2026-53614 | UT util-linux util-linux | 7.0 | Oct 14 | util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass |
| CVE-2026-100394 | NE nezha nezhahq | 6.5 | Oct 14 | Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant |
| CVE-2026-91157 | DI discourse discourse | 7.5 | Oct 14 | Discourse: Media uploads remain publicly accessible after category permissions are restricted |
| CVE-2026-110734 | GE Godot Engine godotengine | 2.5 | Oct 14 | Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp) |
| CVE-2026-91156 | DI discourse discourse | 7.5 | Oct 14 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users |
| CVE-2026-91159 | DI discourse discourse | 7.7 | Oct 14 | Discourse: Stored oEmbed HTML injection via allowed iframe |
| CVE-2026-77572 | VE VeraCrypt veracrypt | 3.3 | Oct 14 | VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt |
| CVE-2026-91883 | TP Terraform Provider for OME Dell | 4.3 | Oct 14 | Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component |
| CVE-2026-89077 | MT MOVEit Transfer Progress | 8.8 | Oct 14 | MOVEit Transfer Identity validation flaw in SFTP authentication |
| CVE-2026-91882 | TP Terraform Provider for OME Dell | 8.6 | Oct 14 | Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API… |
| CVE-2026-89076 | MT MOVEit Transfer Progress | 8.8 | Oct 14 | MOVEit Transfer SQL injection in custom reporting |
| CVE-2026-89075 | MT MOVEit Transfer Progress | 7.3 | Oct 14 | MOVEit Transfer Local Disclosure of Session Information Vulnerability |
| CVE-2026-89074 | MT MOVEit Transfer Progress | 8.8 | Oct 14 | MOVEit Transfer Email MFA Bypass |
| CVE-2026-89073 | MT MOVEit Transfer Progress | 9.8 | Oct 14 | MOVEit Transfer Access restriction bypass in OAuth authentication |
| CVE-2026-103929 | MI mise jdx | 7.8 | Oct 14 | mise permits untrusted local configuration to override default shell arguments |
| CVE-2026-89072 | MT MOVEit Transfer Progress | 8.8 | Oct 14 | MOVEit Transfer Authorization Flaw in Certificate Management |
| CVE-2026-91881 | TP Terraform Provider for Redfish Dell | 9.0 | Oct 14 | Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component |
| CVE-2026-89071 | MT MOVEit Transfer Progress | 8.8 | Oct 14 | MOVEit Transfer LDAP injection in certificate-based authentication |
| CVE-2026-89070 | MT MOVEit Transfer Progress | 7.5 | Oct 14 | MOVEit Transfer OIDC Authentication Replay Vulnerability |
| CVE-2026-89069 | MT MOVEit Transfer Progress | 5.4 | Oct 14 | MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages |
| CVE-2026-89068 | MT MOVEit Transfer Progress | 9.8 | Oct 14 | MOVEit Transfer Authentication bypass in LDAP sign-on |
| CVE-2026-101896 | RO router @angular | 8.2 | Oct 14 | Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR) |
| CVE-2026-89067 | MT MOVEit Transfer Progress | 8.8 | Oct 14 | MOVEit Transfer Secure Messaging Authentication Bypass |