CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 17:07 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-92027 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the DOM: Streams component |
| CVE-2026-92026 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Networking component |
| CVE-2026-92025 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the DOM: Navigation component |
| CVE-2026-92024 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the SVG component |
| CVE-2026-92023 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the XML component |
| CVE-2026-92022 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the DOM: HTML Parser component |
| CVE-2026-92021 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the JavaScript Engine: JIT component |
| CVE-2026-92020 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component |
| CVE-2026-92019 | FI Firefox Mozilla | 8.1 | Sep 15 | Mitigation bypass in the Remote Settings Client component |
| CVE-2026-92017 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation in the DOM: Service Workers component |
| CVE-2026-92016 | FI Firefox Mozilla | 8.8 | Sep 15 | Use-after-free in the Disability Access APIs component |
| CVE-2026-92015 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation in the WebExtensions component |
| CVE-2026-92014 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics component |
| CVE-2026-92013 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component |
| CVE-2026-92012 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component |
| CVE-2026-92011 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component |
| CVE-2026-92010 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component |
| CVE-2026-92009 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component |
| CVE-2026-92008 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component |
| CVE-2026-92007 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component |
| CVE-2026-92006 | FI Firefox Mozilla | 8.8 | Sep 15 | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component |
| CVE-2026-91996 | LA lamp-cloud dromara | 7.5 | Sep 15 | lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint |
| CVE-2026-91925 | PO polyaxon polyaxon | 8.8 | Sep 15 | Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine |
| CVE-2026-91924 | PG pgweb sosedoff | 8.5 | Sep 15 | pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint |
| CVE-2026-91923 | KU kubesphere kubesphere | 7.7 | Sep 15 | KubeSphere through 4.1.3 SSRF via git credential verification endpoint |
| CVE-2026-1758 | GA GateManager Secomea | 8.3 | Sep 15 | Session Fixation |
| CVE-2026-52827 | KI kimai kimai | 7.1 | Sep 15 | Kimai: Two-factor authentication bypass on the Kimai API |
| CVE-2026-57133 | PR PraisonAI MervinPraison | 8.8 | Sep 15 | PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining |
| CVE-2026-57135 | PR PraisonAI MervinPraison | 7.6 | Sep 15 | PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients |
| CVE-2026-57134 | PR PraisonAI MervinPraison | 8.2 | Sep 15 | PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation |
| CVE-2026-57136 | PR PraisonAI MervinPraison | 8.8 | Sep 15 | PraisonAI SandboxExecutor allowedCommands bypass via shell chaining |
| CVE-2026-57137 | PR PraisonAI MervinPraison | 8.8 | Sep 15 | PraisonAI AgentLoop onToolCall approval runs after tool execution |
| CVE-2026-57112 | PR PraisonAI MervinPraison | 8.3 | Sep 15 | PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools |
| CVE-2026-47426 | OP OpenAM OpenIdentityPlatform | 7.6 | Sep 15 | OpenAM OAuth Client Impersonation via JWKS Resolver Cache |
| CVE-2026-47424 | OP OpenAM OpenIdentityPlatform | 7.5 | Sep 15 | OpenAM Authenticated RCE via Groovy Sandbox Escape |
| CVE-2026-41573 | OP OpenAM OpenIdentityPlatform | 7.1 | Sep 15 | OpenAM LDAP Injection via `_queryId` Parameter |
| CVE-2026-19515 | WI WSO2 Integrator: MI for Visual Studio Code WSO2 | 7.0 | Sep 15 | OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution |
| CVE-2026-46623 | OP OpenAM OpenIdentityPlatform | 7.4 | Sep 15 | OpenAM Account Takeover via Unverified Password Change in OAuth2 Module |
| CVE-2026-46498 | OP OpenAM OpenIdentityPlatform | 7.6 | Sep 15 | OpenAM Arbitrary OAuth Token Minting via Push Registration |
| CVE-2026-45794 | OP OpenAM OpenIdentityPlatform | 7.7 | Sep 15 | OpenAM Unsafe Java Deserialization via SNS |
| CVE-2026-45048 | OP OpenAM OpenIdentityPlatform | 8.5 | Sep 15 | OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC |
| CVE-2026-44203 | OP OpenAM OpenIdentityPlatform | 8.3 | Sep 15 | OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) |
| CVE-2026-53660 | OP OpenAM OpenIdentityPlatform | 7.4 | Sep 15 | OpenAM Insecure SSO Cookie Initialization |
| CVE-2026-44793 | OP OpenAM OpenIdentityPlatform | 7.0 | Sep 15 | OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` |
| CVE-2026-80217 | FF FF-RFI078I4 LITE-ON Technology Corporation | 8.8 | Sep 15 | Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS… |
| CVE-2026-77853 | FF FF-RFI078I4 LITE-ON Technology Corporation | 8.8 | Sep 15 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4 |
| CVE-2026-76159 | DU Duplicati Duplicati | 7.0 | Sep 15 | Duplicati for Windows - Incorrect Permission Assignment for Critical Resource |
| CVE-2026-91846 | MI MISP MISP | 7.1 | Sep 15 | MISP Collection Element Add Missing Authorization on Referenced Object UUID |
| CVE-2026-75092 | RH Red Hat Enterprise Linux 9 Red Hat | 7.3 | Sep 15 | Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins |
| CVE-2026-91825 | MI MISP MISP | 7.1 | Sep 15 | MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit |