CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 23:02 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-87286 | OG Oracle GraalVM Oracle Corporation | 8.1 | Sep 15 | Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler) |
| CVE-2026-18424 | CC Concrete CMS Concrete CMS | 7.1 | Sep 15 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports |
| CVE-2026-61544 | RU rust-libp2p libp2p | 8.2 | Sep 15 | libp2p-quic: Remote panic via certificate expiry race during QUIC handshake |
| CVE-2026-92239 | TH Thunderbird Mozilla | 8.1 | Sep 15 | Buffer overrun in IMAP |
| CVE-2026-76820 | OP opencti OpenCTI-Platform | 7.7 | Sep 15 | OpenCTI: Synchronizer SSRF: stream fetch has no URL validation |
| CVE-2026-76821 | OP opencti OpenCTI-Platform | 7.1 | Sep 15 | OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper |
| CVE-2026-88975 | HT http4s http4s | 7.5 | Sep 15 | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE |
| CVE-2026-73458 | EO EOS Arista Networks | 8.2 | Sep 15 | On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various rou |
| CVE-2026-18423 | CC Concrete CMS Concrete CMS | 7.1 | Sep 15 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres |
| CVE-2026-69202 | HT http4s http4s | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded inbound body buffering |
| CVE-2026-76693 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 7.0 | Sep 15 | Unauthenticated Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76692 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 7.1 | Sep 15 | Unauthenticated Adjacent Information Disclosure and Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76691 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 7.2 | Sep 15 | Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateway API Endpoint |
| CVE-2026-76690 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 7.2 | Sep 15 | Authenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76689 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 7.2 | Sep 15 | Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76688 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 7.5 | Sep 15 | Authentication Bypass Vulnerabilities in the Web-Based Management Interface of EdgeConnect SD-WAN Orchestrator |
| CVE-2026-76687 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 7.5 | Sep 15 | Authenticated Arbitrary File Write Leading to Remote Code Execution in EdgeConnect SD-WAN Orchestrator |
| CVE-2026-76686 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 7.5 | Sep 15 | Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76685 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.1 | Sep 15 | Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76684 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.1 | Sep 15 | Authentication Bypass Vulnerabilities in HPE Networking EdgeConnect SD-WAN Orchestrator API |
| CVE-2026-76683 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.1 | Sep 15 | Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76682 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.2 | Sep 15 | Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76681 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.5 | Sep 15 | Authenticated Information Disclosure Vulnerability in HPE Networking EdgeConnect SD-WAN Orchestrator API |
| CVE-2026-76680 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.5 | Sep 15 | Authenticated Server-Side Request Forgery Vulnerabilities Leading to Information Disclosure in EdgeConnect SD-WAN Orchestrator |
| CVE-2026-76679 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.6 | Sep 15 | Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76678 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.8 | Sep 15 | Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways |
| CVE-2026-76677 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.8 | Sep 15 | Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways |
| CVE-2026-76676 | ES EdgeConnect SD-WAN Gateways Hewlett Packard Enterprise (HPE) | 8.8 | Sep 15 | Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in EdgeConnect SD-WAN Gateways |
| CVE-2026-69218 | HT http4s http4s | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded continuation frame accumulation |
| CVE-2026-69203 | HT http4s http4s | 7.5 | Sep 15 | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS |
| CVE-2026-69217 | HT http4s http4s | 8.7 | Sep 15 | Http4s: Ember Server accepts duplicate Content-Length headers |
| CVE-2026-69210 | HT http4s http4s | 7.5 | Sep 15 | Http4s: WebSocket decoder accepts negative length, causing infinite decode loop |
| CVE-2026-69205 | HT http4s http4s | 8.7 | Sep 15 | Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) |
| CVE-2026-13327 | SE Server Devolutions | 8.3 | Sep 15 | Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged… |
| CVE-2026-69213 | HT http4s http4s | 7.5 | Sep 15 | Http4s Ember HTTP/2: unbounded outbound frame queue |
| CVE-2026-69209 | HT http4s http4s | 7.5 | Sep 15 | Http4s: WebSocket decoder accepts unbounded message sizes |
| CVE-2026-78081 | JE J2Store extension for Joomla j2commerce.com | 7.1 | Sep 15 | Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 |
| CVE-2026-81568 | JE J2Store extension for Joomla j2commerce.com | 8.7 | Sep 15 | Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 |
| CVE-2026-69208 | HT http4s http4s | 7.5 | Sep 15 | Http4s: DigestAuth nonce map grows unbounded |
| CVE-2026-81567 | JE J2Store extension for Joomla j2commerce.com | 8.7 | Sep 15 | Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 |
| CVE-2026-82189 | JE J2Store extension for Joomla j2commerce.com | 8.7 | Sep 15 | Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 |
| CVE-2026-58766 | AN Android Google | 7.8 | Sep 15 | In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code |
| CVE-2026-58744 | AN Android Google | 7.8 | Sep 15 | In multiple locations, there is a possible escalation of privilege due to improper input validation |
| CVE-2026-58734 | AN Android Google | 7.0 | Sep 15 | In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds write due to a race condition |
| CVE-2026-58728 | AN Android Google | 7.0 | Sep 15 | In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition |
| CVE-2026-58724 | AN Android Google | 7.0 | Sep 15 | In multiple locations, there is a possible use-after-free due to a race condition |
| CVE-2026-58710 | AN Android Google | 8.8 | Sep 15 | In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check |
| CVE-2026-58704 In wildKEV | AN Android Google | 8.8 | Sep 15 | Google Pixel Improper Authorization Vulnerability |
| CVE-2026-58701 | AN Android Google | 7.0 | Sep 15 | In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition |
| CVE-2026-58699 | AN Android Google | 8.4 | Sep 15 | In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check |