CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 11:42 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-43684 | MA macOS Apple | 7.8 | Sep 14 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-43692 | MA macOS Apple | 8.8 | Sep 14 | A validation issue was addressed with improved input sanitization |
| CVE-2026-28935 | MA macOS Apple | 7.5 | Sep 14 | The issue was addressed with improved memory handling |
| CVE-2026-65364 | MA macOS Apple | 7.5 | Sep 14 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-43702 | MA macOS Apple | 7.8 | Sep 14 | The issue was addressed with improved memory handling |
| CVE-2026-43688 | MA macOS Apple | 7.8 | Sep 14 | A memory corruption issue was addressed with improved input validation |
| CVE-2026-65344 | MA macOS Apple | 7.8 | Sep 14 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-84516 | MA macOS Apple | 8.1 | Sep 14 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-65391 | MA macOS Apple | 8.8 | Sep 14 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-84629 | IO iOS Apple | 7.5 | Sep 14 | This issue was addressed with additional entitlement checks |
| CVE-2026-65390 | MA macOS Apple | 8.8 | Sep 14 | An integer overflow was addressed with improved input validation |
| CVE-2026-65410 | MA macOS Apple | 7.5 | Sep 14 | The issue was addressed with improved checks |
| CVE-2026-28938 | IO iOS Apple | 7.5 | Sep 14 | A privacy issue was addressed by moving sensitive data |
| CVE-2026-43689 | MA macOS Apple | 7.8 | Sep 14 | A permissions issue was addressed with additional restrictions |
| CVE-2026-84632 | MA macOS Apple | 7.3 | Sep 14 | The issue was addressed with improved memory handling |
| CVE-2026-81901 | CC Concrete CMS Concrete CMS | 8.7 | Sep 14 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint |
| CVE-2026-81902 | CC Concrete CMS Concrete CMS | 8.1 | Sep 14 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup |
| CVE-2026-90819 | A2 a2a-java a2aproject | 7.3 | Sep 14 | a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting |
| CVE-2026-13107 | BA Business Automation Workflow containers and traditional IBM | 7.1 | Sep 14 | Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 |
| CVE-2026-53714 | GA gateway envoyproxy | 7.4 | Sep 14 | Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode |
| CVE-2026-13260 | SV Security Verify Access IBM | 7.5 | Sep 14 | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access |
| CVE-2026-19816 | FE Fedora Fedora | 7.1 | Sep 14 | PackageKit: dnf5 backend ignores SIMULATE on RepoRemove |
| CVE-2026-65838 | SK skipper zalando | 8.2 | Sep 14 | Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream |
| CVE-2026-54632 | SI sipsorcery sipsorcery-org | 7.5 | Sep 14 | SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS) |
| CVE-2026-15955 | DB Db2 IBM | 7.5 | Sep 14 | IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths |
| CVE-2026-54628 | AN anyquery julien040 | 8.6 | Sep 14 | Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode |
| CVE-2026-82028 | MA magistrala absmach | 8.8 | Sep 14 | Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API |
| CVE-2026-54629 | AN anyquery julien040 | 7.5 | Sep 14 | Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode |
| CVE-2026-47253 | AN anyquery julien040 | 7.3 | Sep 14 | Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion |
| CVE-2026-54447 | PY python-garminconnect cyberjunky | 8.4 | Sep 14 | garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store |
| CVE-2026-16335 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-16338 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-73496 | MC mcp-atlassian sooperset | 7.7 | Sep 14 | MCP Atlassian: Arbitrary server-side file read via attachment upload |
| CVE-2026-16428 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-16466 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-16673 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-17133 | AC App Connect Enterprise IBM | 7.8 | Sep 14 | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs |
| CVE-2026-17156 | AC App Connect Enterprise IBM | 7.8 | Sep 14 | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs |
| CVE-2026-17416 | AC App Connect Enterprise IBM | 7.8 | Sep 14 | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs |
| CVE-2026-17467 | CP Cloud Pak for Data System (Yosemite 1.0) IBM | 8.2 | Sep 14 | Vulnerabilities exists in IBM Cloud Pak for Data System |
| CVE-2026-19624 | EP Extra Packages for Enterprise Linux (EPEL) Fedora | 7.8 | Sep 14 | NetworkManager-l2tp: local privilege escalation via ipsec.conf injection |
| CVE-2026-82049 | CP CPython Python Software Foundation | 8.4 | Sep 14 | tarfile extraction filters allow file modification and content disclosure via hard link to symlink |
| CVE-2026-82035 | PY PyMuPDF PyMuPDF | 7.1 | Sep 14 | PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch |
| CVE-2026-89023 | DF Domain For Sale ThemeAtelier | 8.6 | Sep 14 | ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API |
| CVE-2026-90809 | NA nanobot HKUDS | 7.3 | Sep 14 | HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection |
| CVE-2026-77884 | GP Gallery - Private Photo Vault Brain Trust | 7.1 | Sep 14 | Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure |
| CVE-2026-86830 | IA iam-identity-center-team AWS | 7.2 | Sep 14 | Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center |
| CVE-2026-54180 | CR CRUD Laravel-Backpack | 7.6 | Sep 14 | backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR) |
| CVE-2026-91080 | WE webhook adnanh | 7.5 | Sep 14 | webhook through 2.8.3 Memory Exhaustion via Oversized Request Body |
| CVE-2026-91079 | PL platform hcengineering | 8.5 | Sep 14 | Huly Platform through 0.7.426 SSRF via Print Service |