CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 12:39 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-20683 | MA macOS Apple | 7.1 | Sep 14 | An authentication issue was addressed with improved state management |
| CVE-2026-65362 | MA macOS Apple | 7.8 | Sep 14 | This issue was addressed with improved checks |
| CVE-2026-65374 | MA macOS Apple | 8.8 | Sep 14 | A memory corruption issue was addressed with improved validation |
| CVE-2026-84623 | IO iOS Apple | 7.5 | Sep 14 | An authorization issue was addressed with improved state management |
| CVE-2026-65375 | MA macOS Apple | 7.5 | Sep 14 | The issue was addressed with improved authentication |
| CVE-2026-84566 | MA macOS Apple | 7.8 | Sep 14 | The issue was addressed with improved memory handling |
| CVE-2026-43683 | MA macOS Apple | 7.1 | Sep 14 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-65359 | MA macOS Apple | 7.1 | Sep 14 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-84507 | MA macOS Apple | 7.8 | Sep 14 | A race condition was addressed with improved state handling |
| CVE-2026-64712 | MA macOS Apple | 7.8 | Sep 14 | This issue was addressed with improved checks |
| CVE-2026-84546 | MA macOS Apple | 8.4 | Sep 14 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-84511 | MA macOS Apple | 7.8 | Sep 14 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-84497 | MA macOS Apple | 7.8 | Sep 14 | A buffer overflow was addressed with improved size validation |
| CVE-2026-64790 | MA macOS Apple | 7.8 | Sep 14 | A path handling issue was addressed with improved validation |
| CVE-2026-84598 | IO iOS Apple | 7.5 | Sep 14 | A path traversal issue was addressed with improved path validation |
| CVE-2026-84577 | MA macOS Apple | 8.2 | Sep 14 | An access issue was addressed with additional sandbox restrictions |
| CVE-2026-43684 | MA macOS Apple | 7.8 | Sep 14 | A use-after-free issue was addressed with improved memory management |
| CVE-2026-43692 | MA macOS Apple | 8.8 | Sep 14 | A validation issue was addressed with improved input sanitization |
| CVE-2026-28935 | MA macOS Apple | 7.5 | Sep 14 | The issue was addressed with improved memory handling |
| CVE-2026-65364 | MA macOS Apple | 7.5 | Sep 14 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-43702 | MA macOS Apple | 7.8 | Sep 14 | The issue was addressed with improved memory handling |
| CVE-2026-43688 | MA macOS Apple | 7.8 | Sep 14 | A memory corruption issue was addressed with improved input validation |
| CVE-2026-65344 | MA macOS Apple | 7.8 | Sep 14 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-84516 | MA macOS Apple | 8.1 | Sep 14 | An out-of-bounds read was addressed with improved bounds checking |
| CVE-2026-65391 | MA macOS Apple | 8.8 | Sep 14 | An out-of-bounds write issue was addressed with improved bounds checking |
| CVE-2026-84629 | IO iOS Apple | 7.5 | Sep 14 | This issue was addressed with additional entitlement checks |
| CVE-2026-65390 | MA macOS Apple | 8.8 | Sep 14 | An integer overflow was addressed with improved input validation |
| CVE-2026-65410 | MA macOS Apple | 7.5 | Sep 14 | The issue was addressed with improved checks |
| CVE-2026-28938 | IO iOS Apple | 7.5 | Sep 14 | A privacy issue was addressed by moving sensitive data |
| CVE-2026-43689 | MA macOS Apple | 7.8 | Sep 14 | A permissions issue was addressed with additional restrictions |
| CVE-2026-84632 | MA macOS Apple | 7.3 | Sep 14 | The issue was addressed with improved memory handling |
| CVE-2026-81901 | CC Concrete CMS Concrete CMS | 8.7 | Sep 14 | Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint |
| CVE-2026-81902 | CC Concrete CMS Concrete CMS | 8.1 | Sep 14 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup |
| CVE-2026-90819 | A2 a2a-java a2aproject | 7.3 | Sep 14 | a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting |
| CVE-2026-13107 | BA Business Automation Workflow containers and traditional IBM | 7.1 | Sep 14 | Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 |
| CVE-2026-53714 | GA gateway envoyproxy | 7.4 | Sep 14 | Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode |
| CVE-2026-13260 | SV Security Verify Access IBM | 7.5 | Sep 14 | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access |
| CVE-2026-19816 | FE Fedora Fedora | 7.1 | Sep 14 | PackageKit: dnf5 backend ignores SIMULATE on RepoRemove |
| CVE-2026-65838 | SK skipper zalando | 8.2 | Sep 14 | Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream |
| CVE-2026-54632 | SI sipsorcery sipsorcery-org | 7.5 | Sep 14 | SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS) |
| CVE-2026-15955 | DB Db2 IBM | 7.5 | Sep 14 | IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths |
| CVE-2026-54628 | AN anyquery julien040 | 8.6 | Sep 14 | Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode |
| CVE-2026-82028 | MA magistrala absmach | 8.8 | Sep 14 | Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API |
| CVE-2026-54629 | AN anyquery julien040 | 7.5 | Sep 14 | Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode |
| CVE-2026-47253 | AN anyquery julien040 | 7.3 | Sep 14 | Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion |
| CVE-2026-54447 | PY python-garminconnect cyberjunky | 8.4 | Sep 14 | garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store |
| CVE-2026-16335 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-16338 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |
| CVE-2026-73496 | MC mcp-atlassian sooperset | 7.7 | Sep 14 | MCP Atlassian: Arbitrary server-side file read via attachment upload |
| CVE-2026-16428 | DO DataStage on Cloud Pak for Data IBM | 8.8 | Sep 14 | DataStage on Cloud Pak for Data has several vulnerabilities due to open source software |